Cybersecurity hiring practices leave little room for junior talent
A SkillBit survey finds most employers hire few junior cybersecurity staff and favor weekly 20-minute training.
SkillBit's cybersecurity micro-training report says more than 80 percent of surveyed executives used their full 2025 training budgets, yet 70 percent of organizations have no or very few roles for candidates with less than two years of experience. Fifty-seven percent of executives said new hires take about six months to reach full proficiency, most often because of gaps in general IT knowledge and security processes. Seventy-one percent would rather use weekly 20-minute sessions than 30-to-40-hour courses once or twice a year. Skills decay was cited by 39 percent of respondents and 60 percent at companies with at least 50,000 employees, while leaders reported no common standard for measuring team readiness.
- Seventy percent of organizations offer few or no roles for people with under two years' experience.
- Executives said 57 percent of new hires need about six months to become fully proficient.
- Seventy-one percent prefer weekly 20-minute sessions over annual 30-to-40-hour courses.
- Reported skills decay was 39 percent overall and 60 percent at employers with 50,000-plus staff.
Full article447 words · extracted from helpnetsecurity.com · click to collapse
Twenty-minute training sessions that fit into the workweek could help new hires become productive sooner, keep employees’ skills current and build problem-solving skills they can use across different tools, according to SkillBit’s The Shift to Continuous Cybersecurity Micro-Training report.
Reasons for missing development goals (Source:SkillBit)
More than 80% of executives surveyed used their full 2025 training budgets. Experience requirements can limit the pool of junior cybersecurity candidates. Seventy percent of organizations have no junior roles, or very few, that they can fill with candidates who have less than two years of experience. Thirty percent of leaders said they were receptive to using interactive labs in place of experience credentials, while another 49.5% were open to the idea if shown evidence that it works.
57% of executives reported that new hires take an average of six months to reach full proficiency. General IT knowledge and cybersecurity processes were the most cited causes of delays. Shortening the time to proficiency could reduce costs and improve team readiness.
Seventy-one percent of security leaders said they would prefer 20-minute online or interactive sessions each week to training that requires 30 to 40 hours once or twice a year.
Urgent daily tasks are a leading reason employees miss development goals. Respondents also cited too much vendor training, time away from the office, concerns about wasting time and training they do not enjoy
Skills decay affects team readiness
Thirty-nine percent of respondents said their teams face skills decay, rising to 60% at companies with at least 50,000 employees. Of those who identified the problem, 75% called its impact a “moderate irritation.” They said it can weaken team readiness and morale, raise training costs, make staff harder to assign and leave important tasks unattended.
About two-thirds of respondents favored problem-solving skills that apply across technology stacks over expertise in a specific set of tools. Leaders also valued curiosity about technical problems, proactive learning, forensic skills and knowledge of their organization’s environment.
Readiness reports lack a common measure
Asked about their ability to provide objective data on team readiness, 59% of executives said they were somewhat confident and 37% said they were extremely confident.
Executives reported similar confidence in identifying employees with potential for specialized roles. Sixty-five percent were somewhat confident and 33% were extremely confident.
Security leaders use different measures to report organizational readiness to their boards. Some cited “personal observation,” “trust” and “anecdotal notes.” One respondent said their board “tends to not want a full update unless something has happened.”
The industry lacks a common standard for measuring readiness, so board reports often combine audit results, performance reviews and certification counts, which may not show whether a team can stop an active breach.