Fortinet’s 2026 skills gap report says 68% of organisations struggle to find security staff with AI experience, even as breaches grow costlier and companies raise spending on certifications and training.
Finding cybersecurity professionals with hands-on AI expertise has emerged as the biggest recruitment hurdle for organisations, according to a new study from Fortinet, the cybersecurity company.
The firm released its 2026 Global Cybersecurity Skills Gap Report on 26 October. It found that a shortage of security skills, partly caused by too little investment in talent, remains a leading reason behind damaging breaches. While defenders are already using AI-powered tools well, the survey says staff need upskilling and reskilling to get the full benefit.
“Cybersecurity is not simply a technical issue but a strategic business risk. This year’s survey suggests that while boards generally recognize the importance of cybersecurity, more investment is needed to address key issues, such as emerging AI risks and the ongoing cybersecurity skills shortage. Addressing these issues is critical to business resilience in an increasingly complex threat landscape,” said Carl Windsor, CISO at Fortinet.
Breaches common and costly
The numbers underline the pressure on security teams. Some 94% of organisations reported at least one breach in the past 12 months, and 74% said breaches cost them more than $1 million, up from 60% in 2024. North America saw the highest losses, with the average breach costing about $2 million.
For the third year running, IT leaders named a lack of cybersecurity skills as a main cause of breaches (63%). Nearly half (48%) said senior-level expertise is what they need most, yet 67% find it hard to win approval for extra security hires. That gap exists even though 67% said executives and board members have faced penalties after a cyberattack.
AI: A tool and a risk
AI-driven security tools are now widely used. About 95% of respondents are using or testing them, and 92% said such tools make IT and security teams more effective and efficient. Scepticism about AI in security has eased slightly, to 45% from 48% last year. At the same time, attackers have access to the same technology, and 45% named defending against AI-driven attacks as a top concern.
Employee use of AI is also creating risks that boards may not grasp. Only 70% of leaders believe their board members are fully aware of those risks. Looking ahead, 73% expect a greater need for AI oversight and governance roles in security teams over the next three years.
Training spending on the rise
Asked about recruitment, 68% said their toughest challenge is finding people with specific AI-related security experience. In response, 93% are likely to invest in AI-related training or certifications within the next 12 months. Organisations said they need skills in AI tool oversight (60%), security automation (58%) and AI model development (42%). While 68% are building internal reskilling programmes, 48% are buying training from industry vendors.
Willingness to fund certifications has also risen: 97% would pay for an employee to get certified, compared with 82% in the 2025 report. To widen the talent pool, 98% use internships, apprenticeships, partnerships and similar programmes, and 80% have formal hiring targets for underutilised groups.
What Fortinet recommends
The report calls for board-level investment in a layered approach combining people, processes and technology, resting on three pillars: awareness and education, targeted training and certification, and advanced security technology.
Fortinet said its Training Institute offers one of the industry’s largest training programmes, including security awareness training for organisations. The company said it is on track to train one million people in cybersecurity this year, a pledge it began in 2022.
See What’s Next in Tech With the Fast Forward Newsletter
Tweets From @varindiamag
Nothing to see here - yet
When they Tweet, their Tweets will show up here.
