Cybersecurity Workforce Study Highlights Barriers to Adopting Skills-Based Talent Strategies

Moving beyond traditional talent models

The study examined employer survey data, labor market analytics and qualitative insights to assess how workforce strategies affect hiring outcomes, retention and leadership development within cybersecurity organizations.

Among the key findings: mentorship programs and skills-based development pathways can improve employee retention by as much as 18%, while organizations that incorporate structured promotion practices often see stronger representation of women in cybersecurity leadership roles.

However, transitioning to skills-based workforce strategies often requires companies to rethink long-standing promotion practices and internal development systems.

“It means moving away from subjective promotion decisions and toward consistent, skills-based frameworks that help employees understand how to grow and advance,” Dohm said.

In many cases, organizations also face practical challenges when trying to launch mentorship or development programs at scale.

“Many organizations want to invest in mentorship and professional development but do not always have the infrastructure to build and sustain these programs internally,” Dohm said.

Professional networks and industry partnerships can help address those gaps by providing mentorship connections, learning communities and other resources that extend internal workforce development efforts, she added.

Rethinking cyber talent strategy

For years, discussions about the cybersecurity workforce shortage have focused primarily on expanding the pipeline of new entrants into the field. But the new research suggests organizations should also place greater emphasis on retaining and developing the talent they already have.

“For years, the cybersecurity workforce conversation has focused on bringing more people into the field,” Dohm said. “What this research reinforces is that retention and development are just as important.”

Skills-based promotion strategies shift the emphasis away from traditional credentials and years of experience toward demonstrated capabilities and ongoing skill development, she noted.

“When organizations create transparent skills frameworks and offer personalized development pathways, they open the door for more people to grow into leadership roles while strengthening the talent they already have,” Dohm said.

That approach is particularly relevant in cybersecurity, where required skills evolve rapidly as technology and threat landscapes change.

“Organizations need systems that allow professionals to keep building new capabilities throughout their careers,” Dohm said. “When companies invest in that kind of development, they strengthen retention, build stronger leadership pipelines, and create a workforce that can adapt alongside the threat landscape.”

Creating clearer career pathways

Another key takeaway from the research is the importance of making advancement pathways more transparent.

Organizations that implemented formal mentorship programs, internal skills profiles and structured learning pathways tended to create environments where employees could more clearly see long-term career opportunities within the organization.

“One of the most encouraging patterns we saw in the research was organizations being intentional about mentorship and career development rather than leaving advancement to chance,” Dohm said.

Companies that adopted these practices often experienced stronger retention and longer employee tenure, outcomes that translate directly into financial benefits for the business.

The research also found that organizations introducing more transparent promotion processes — including decisions involving multiple leaders and clearly defined skills criteria — helped remove ambiguity around advancement opportunities.

“When employees have tools like internal skills profiles and clear criteria for growth, it removes much of the ambiguity around what it takes to move forward,” Dohm said.

These changes not only strengthen internal talent pipelines but also help expand leadership opportunities for women and other underrepresented groups within cybersecurity.

“When organizations invest in people and create clear pathways for advancement, everyone benefits,” Dohm said. “The workforce becomes stronger, the organization becomes more resilient, and the industry moves forward together.”

The full report is available to download on the WiCyS website here.