“According to the industry, the problem will get worse over the years, and it is frustrating that more people are not being educated.” (DR News. 2025, September 4).
“Denmark will lack 20,000 employees with cybersecurity skills.” (Danish Business 2024. November 12)
Media and industry organizations describe a massive cyber skills shortage. The need to train more cyber talent has been portrayed as a threat in itself.
But those of us who work with cyber skills recruitment on a daily basis are surprised. We experience a job market where the supply of candidates for many areas within cybersecurity is often greater than the demand. We wonder where the numbers come from.
Has anyone investigated what the concept of cyber skills actually covers? And does anyone have an updated understanding of which jobs the real talent and skills challenges are?
The skills and talents are there – even those with experience
Among specialized headhunters within cybersecurity, there is broad agreement that the situation has changed significantly since 2019, when we saw the first figures for a widespread shortage of cyber skills.
Today, we are experiencing that many candidates, especially recent graduates – but also those with experience, are having difficulty finding jobs. This is even true in industrial safety (OT), which is often highlighted as an area where the lack of skills is critical.
Cybersecurity tends to be discussed in a very general way, despite the fact that it covers a wide range of professional disciplines. It ranges widely from compliance, regulation, processes, risk management to technical disciplines within system architecture, network, application and cloud security, not to mention analytical roles related to offensive and defensive cybersecurity.
When we talk about a 'massive' need for cybersecurity skills, we therefore need to nuance where the shortage actually exists both now and in the future. Not least, which skills companies are actually ready to hire. If we can't do that, do we even understand the problem we are trying to solve?
More education – solutions or air castles?
In recent years, there has been massive investment in establishing education and attracting more cybersecurity skills – with a particular focus on women and young people. This has been largely successful and is an effort that deserves great praise.
They are attracted to an industry with the prospect of job security and job content that is important to society. The challenge is simply that the majority of Danish SMEs do not have the capacity to hire skills without experience – so we are well underway in training young people for unemployment.
Several education programs have been a central part of the solution - however, it is crucial that they become a bridge to employment and not a dead end.
The latest initiative from the Danish Institute of Industrial Education to establish a cybersecurity education program, where business internships are an integrated part of the education, is a good initiative to create talents with useful experience.
But is it enough for a company that needs to know that the management of their cyber security is in safe hands when they can only hire the one person who will be responsible for cyber security in the company?
Few Danish SMEs have the opportunity to hire an entire team with the broadest range of skills. They have the capacity to hire a generalist who will cover as wide a range as possible. So how many customers are there for the specialists we train?
A qualified and faster solution
Companies hopefully already have employees with in-depth knowledge of their processes, operations and critical systems – employees who, with valuable knowledge of the company's culture and infrastructure, can form an important part of the organization's work to strengthen cybersecurity.
With targeted training that provides basic knowledge and skills relevant to their work, these employees can quickly be upgraded and contribute to strengthening the organization's cyber preparedness. They cannot replace specialists, of course, but they can handle a significant part of the tasks.
We are surprised that upskilling the existing workforce is not more prominent in the debate. It is an overlooked and quick way to improve cybersecurity and channel the need for education to areas where specialists are lacking.
Let's understand the problem – together
We are not saying that there is no shortage of cyber skills. But the young talents cannot get jobs and the skills can be developed faster through targeted upskilling than through longer educations.
Before investing further in education, we urge that we as an industry and society start by getting a more accurate and nuanced picture of the skills needs. This requires a close dialogue between authorities, industry organizations and the business community.
In any case, we are very happy to make our knowledge and experience available in that dialogue.
Contact Camilla Treschow Schrøder, Cybersecurity Headhunter, on tel. +45 41 27 12 57 or cts@treschowson.com.
