Shortage of skilled security engineers¶
Imagine the city of Ankh-Morpork suddenly decided it needed Watch officers who could spot a Klatchian spy, break up a troll bar fight, mediate a guild dispute, and understand dwarf mining law before breakfast. Now imagine there are twelve such people in the whole city, and everyone from The Patrician to Mrs Cake’s boarding house wants to hire them. Welcome to the world of security engineering.
The arithmetic does not add up and has not for years. Universities cannot graduate experienced engineers on demand, training an existing IT person takes years, and every organisation that digitises suddenly wants a security person. Security work moves sideways: to the generalist who already has three jobs, to the consultant who appears after the incident, to the developer who inherits the security review, or to nobody at all. And yet the city expects miracles.
The clerk’s brief¶
From the clerks, for the Patrician’s eyes
Compiled September 2026. Newest first; the long view sits at the end, under Last in line. The clerks apologise for the brevity of this file. The people who could have written more of it were, without exception, busy.
September 2026: Nobody to call¶
The UK government’s Cyber security skills in the UK labour market 2026, published 29 September 2026, finds 57 per cent of UK businesses with a basic technical skills gap, up from 49 per cent a year earlier, and the gap especially wide in small businesses and charities. Almost half of the people responsible for cyber security in businesses and in charities, 47 per cent in each, lacked the confidence to deal with a breach or attack and had not outsourced the job.
December 2025: Help wanted¶
ENISA’s NIS Investments report, published December 2025 from data across all 27 member states, cites ISC2’s estimate of a shortage of 299,000 cybersecurity professionals in the EU in 2024, and finds three quarters of organisations reporting difficulty attracting qualified staff and 71 per cent difficulty retaining those they have. The same report finds security budgets going more on technology and outsourcing than on growing internal teams, and names talent constraints as one possible reason among several. ISC2 left the estimate out of its own December 2025 study, because its respondents now rank skills above headcount.
January 2025: Temporary staff at twice the price¶
The National Audit Office’s report on government cyber resilience, published January 2025, found that in 2023-24 one in three cyber security roles in UK central government was vacant or filled by temporary staff, who cost at least twice as much as permanent civil servants. Digital and technology leaders named what government can pay and civil service recruitment processes among the biggest barriers to hiring and keeping them. The clerks note that the workaround costs twice as much and is still a workaround.
Last in line¶
The clerks’ standing assessment: a shortage this structural does not resolve, it redistributes, away from those who can least afford the market rate.