Key Takeaways
- AI is increasingly embedded in cybersecurity defenses, with a majority of organizations using or experimenting with AI‑enabled tools and reporting improved threat detection and team performance.
- Board‑level awareness of cybersecurity is rising, but there remains a significant gap between prioritizing security as a business issue and allocating the necessary budget, creating a 14‑point delta that hampers effective risk management.
- The cybersecurity skills gap persists as the top cause of breaches; 86 % of organizations suffered at least one attack linked to insufficient team skills, and nearly half struggle to hire qualified talent.
- Reactive hiring and training after an incident are common, yet proactive up‑skilling—through certifications, internships, apprenticeships, and hands‑on experience—is viewed as essential by over 90 % of respondents.
- Shadow AI (unmanaged employee use of AI tools) poses an emerging risk, calling for C‑suite and board‑level governance to establish clear guardrails and policies.
- Fortinet’s pledge to train one million people by the end of 2026 is on track, reflecting a broader industry commitment to closing the skills gap through education, certification, and workforce development initiatives.
AI Adoption Driving Security Effectiveness
Survey results show that 91 % of global IT and cybersecurity decision‑makers are either deploying AI‑enabled security solutions or actively experimenting with them. Specifically, 41 % report live‑network use of AI, while another 42 % are in the trial phase. Leaders attest that these tools accelerate detection of subtle network anomalies, allowing senior analysts to intervene swiftly. Consequently, 84 % observe measurable improvements in their teams’ performance, and many are beginning to trust AI to handle core security functions with limited human oversight. This “fight fire with fire” approach is becoming a cornerstone of modern defense strategies as adversaries themselves leverage AI to launch faster, more organized attacks.
Board‑Level Inaction and Education Gaps
Despite growing recognition of cybersecurity as a strategic priority, board members often fail to translate that awareness into financial commitment. The report highlights a 14‑percent delta between those who rank cybersecurity as a business priority and those who actually allocate budget for it. Moreover, many directors lack sufficient education on both general cybersecurity and the specific implications of AI, leaving them ill‑equipped to govern risk effectively. This disconnect stalls initiatives such as hiring, training, and technology investment, leaving organizations vulnerable despite heightened awareness at the operational level.
Impact of the Skills Gap on Breach Frequency
The skills gap remains the leading cause of security incidents. Eighty‑six percent of organizations experienced at least one cyber attack in the past year that they attributed to insufficient skills or knowledge within their IT and security teams; 29 % endured five or more such attacks. These figures have remained stable over the last three years, underscoring that technology alone cannot compensate for a deficit in human expertise. The persistent reliance on skilled personnel to configure, monitor, and respond to security tools means that any shortfall directly translates into heightened breach risk.
Hiring Challenges and Reactive Training Practices
Nearly half (49 %) of respondents reported difficulty hiring additional security staff, a challenge that often leads organizations to address skill deficiencies only after an incident occurs. This reactive posture—hiring and training post‑breach—means that defensive improvements lag behind the evolving threat landscape. The report stresses that waiting for an attack to trigger up‑skilling is a costly gamble, especially given the speed at which AI‑powered attacks can infiltrate networks. Proactive talent acquisition and continuous learning are therefore critical to staying ahead of adversaries.
Emerging Risks: Shadow AI and Governance Needs
As AI tools proliferate across everyday work functions, employees are increasingly using unsanctioned AI applications—termed “shadow AI”—without organizational oversight. This unmanaged usage introduces data leakage, model poisoning, and compliance risks. The report urges C‑suite leaders and boards to establish clear AI governance frameworks, define acceptable use policies, and implement monitoring mechanisms. By treating AI governance as a board‑level responsibility, organizations can mitigate the hidden dangers posed by ad‑hoc AI experimentation while still benefiting from its legitimate applications.
Workforce Impact of AI Integration
Beyond threat detection, AI is reshaping the cybersecurity workforce. Forty‑two percent of respondents said they would trust AI systems with limited human oversight, indicating a shift toward AI as a collaborative team member. This integration reduces the burden of repetitive tasks, allowing analysts to focus on higher‑order threat hunting and strategic decision‑making. However, it also necessitates up‑skilling in areas such as model interpretation, AI ethics, and prompt engineering, ensuring that human operators can effectively supervise and correct AI‑driven outputs.
Training and Certification Trends
A strong consensus exists on the value of formal training: 91 % of organizations want to hire candidates with technology certifications, and 92 % are willing to fund certification for current employees—a figure that has rebounded from a low of 73 % the previous year. Employers are broadening their talent pipelines beyond traditional degrees, embracing internships, apprenticeships, and partnerships that deliver hands‑on experience. The Fortinet Training Institute, for example, emphasizes practical labs and real‑world scenarios as the most effective way to build expertise, aligning with industry demand for practitioners who can immediately apply learned skills.
Fortinet’s Training Pledge and Global Commitment
In 2021, Fortinet launched a pledge to train one million people in cybersecurity by the end of 2026, leveraging its certification program, career‑growth initiatives, and employment‑assistance partnerships. The initiative is progressing on schedule, with the company reporting that it is on track to meet the target. This effort is framed not only as a response to the skills gap but also as a broader contribution to global cybersecurity resilience—creating a pipeline of certified professionals who can help organizations defend against increasingly sophisticated, AI‑enhanced threats.
Conclusion: Aligning Strategy, Education, and Governance
The 2026 Global Cybersecurity Skills Gap Report paints a picture of an industry that is rapidly adopting AI to counter AI‑driven threats, yet is hampered by board‑level inertia and a persistent shortage of skilled personnel. Closing the gap requires a three‑pronged approach: securing executive and financial commitment at the board level, instituting robust AI governance to manage shadow usage, and investing in continuous, hands‑on training and certification programs. Fortinet’s ongoing pledge exemplifies how vendors can support this ecosystem, but success ultimately depends on organizations translating awareness into actionable, resourced strategies that prioritize people as much as technology.