Table of Contents
The Fortinet 2026 Cybersecurity Skills Gap Global Research Report, based on a survey of 2,750 IT and cybersecurity decision-makers across 32 countries including the Philippines, reveals a paradox at the heart of modern cybersecurity: artificial intelligence is simultaneously the biggest threat facing security teams and the most promising tool for defending against it. The cybersecurity skills gap is no longer just a headcount problem — it is an AI capability crisis. Organizations that cannot find professionals with AI security expertise are the same ones being attacked by AI-powered threats. For Filipino cybersecurity professionals, this convergence creates both urgency and opportunity: the skills that employers desperately need are precisely the ones that separate high earners from average ones.
Key Takeaway
- 🤖 91% of organizations are using or experimenting with AI cybersecurity solutions: AI adoption in security has become near-universal, but 60% of organizations say their top recruiting challenge is finding talent with specific AI cybersecurity experience — the skills gap is shifting from traditional security to AI security.
- 💥 86% of organizations suffered 1+ breaches in the past year, with 52% costing over $1 million: The cybersecurity skills gap is directly tied to breach costs — 56% of respondents cite lack of cybersecurity skills as the top perceived cause of breaches, more than any other factor.
- 🎯 Asia Pacific leads AI security adoption at 58% but faces the toughest AI talent shortage: 66% of Asia Pacific organizations struggle to find AI cybersecurity talent, and 90% experienced breaches — making this the most acute regional cybersecurity skills gap.
- 📜 92% of organizations will invest in AI-related cybersecurity training in the next 12 months: Certifications remain the top hiring preference (91%), and organizations are willing to pay for them — creating a clear career pathway for Filipino professionals.
- ⚠️ Board awareness is dangerously low: Only 50% of leaders think their board is fully aware of AI risks, and just 50% believe their board has a deep understanding of the cybersecurity skills gap — meaning leadership inaction is driving cyber risk.
The 2026 Cybersecurity Skills Gap Explained
The Fortinet 2026 Cybersecurity Skills Gap Global Research Report is the fifth edition of Fortinet’s annual survey, conducted in December 2025 with 2,750 IT and cybersecurity decision-makers across 32 locations — including the Philippines, Saudi Arabia, Vietnam, Singapore, Malaysia, and Japan. The report measures how organizations are coping with the persistent shortage of qualified cybersecurity professionals and how artificial intelligence is reshaping both the threat landscape and the talent market.
The cybersecurity skills gap refers to the ongoing shortage of qualified cybersecurity professionals relative to the growing demand for security expertise. According to the Fortinet 2026 report, 71% of organizations say the cybersecurity skills shortage continues to pose a risk — up from 67% in 2024. More than half (56%) say they struggle to recruit and hire cybersecurity talent, and 52% struggle to retain the talent they already have. The shortage is not improving; it is getting worse, and AI is the primary reason.
For Filipino professionals, this matters because the Philippines is one of the surveyed countries, and Asia Pacific is the most affected region. The Philippine cybersecurity skills gap has left 98% of firms vulnerable, and the Fortinet data shows the regional context: Asia Pacific organizations experienced the most breaches (90%), face the toughest AI talent shortage (66%), and have the highest expectation of needing AI oversight roles (72%).
AI as Both Weapon and Shield
The defining insight of the Fortinet 2026 report is that AI is now simultaneously the most significant threat to cybersecurity and the most promising defense tool — and organizations are caught in between. On the threat side, 44% of respondents cite defending against AI-powered cybersecurity attacks as their top AI concern, tied with data and confidential information leakage (45%). Cybercriminals are using AI to automate phishing, generate deepfakes, create polymorphic malware, and conduct autonomous reconnaissance — the same AI-driven attack surge documented by CYFIRMA in the Philippines.
On the defense side, 91% of organizations are either using (49%) or experimenting with (42%) AI-powered cybersecurity solutions. 84% say AI-enhanced tools have made their IT and security teams more effective and efficient — up from 80% in 2024. A striking 42% say they would trust AI to handle core security functions independently, with another 41% willing to trust it with limited human oversight. Only 1% say they would not trust AI for core security functions at all.
This creates a paradox: organizations need AI to defend against AI-powered attacks, but they lack the human talent with AI security expertise to deploy and manage these tools safely. 45% of respondents worry about a lack of staff with sufficient AI expertise — and that concern is directly connected to the skills gap. AI cannot close the gap alone; it requires skilled professionals who understand both the defensive and offensive dimensions of AI in cybersecurity.
Breach Costs and the Skills Gap Connection
The Fortinet report draws a direct line between the talent shortage and breach costs. 86% of organizations experienced one or more breaches in the past 12 months, with 29% reporting five or more. More than half (52%) say breaches cost them more than $1 million — a figure that has held steady for three years but is up dramatically from 38% in 2021. The mean cost of a breach in Asia Pacific is $1.9 million.
When asked about the top perceived causes of breaches, the results point directly at human factors:
| Perceived Cause | 2025 | 2024 | 3-Year Trend |
|---|---|---|---|
| Lack of cybersecurity skills | 56% | 54% | Rising |
| Lack of security awareness | 55% | 50% | Rising |
| Lack of cybersecurity products | 54% | 50% | Stable |
| Lack of leadership understanding | 50% | 54% | Fluctuating |
For three consecutive years, lack of cybersecurity skills has been the #1 cited cause of breaches — more than any technology deficiency. This means the talent gap is not just a hiring problem; it is a direct cause of security failures. Organizations that cannot find qualified professionals are the ones getting breached, and the breaches are costing them millions.
Recovery times are also worsening. 20% of organizations report it took four to six months to recover from a cyberattack, up from 14% in 2024. 61% took one month or longer to recover. The longer recovery period means greater business disruption, lost revenue, and damage to reputation — costs that compound when the team lacks the skills to respond quickly.
Asia Pacific: The Most Affected Region
The Fortinet 2026 report includes the Philippines in its Asia Pacific regional breakdown, and the data is sobering. Asia Pacific organizations are the most aggressive adopters of AI for cybersecurity, but they also face the most acute talent shortage.
| Metric | Asia Pacific | Global Average |
|---|---|---|
| Using AI cybersecurity solutions | 58% | 49% |
| Experienced 1+ breaches | 90% | 86% |
| Struggle to find AI security talent | 66% | 60% |
| Expect more AI oversight roles | 72% | 63% |
| Need senior-level skills most | 55% | 51% |
| Formal diversity hiring targets | 81% | 71% |
| Mean breach cost | $1.9M | $1.7M |
Asia Pacific leads in AI adoption (58% actively using AI cybersecurity solutions versus 49% globally) but pays the price: 90% experienced breaches, and the mean breach cost is $1.9 million. The region also faces the toughest AI talent shortage — 66% of Asia Pacific organizations struggle to find candidates with AI cybersecurity experience, compared to 59% in North America and 56% in EMEA.
This is the context for the Philippines specifically. The Philippine cybersecurity workforce gap exceeds 33,000 professionals, and the Fortinet data shows the regional pressure is intensifying. 72% of Asia Pacific organizations expect to need more AI oversight and governance roles in the next three years — roles that do not yet exist in most Philippine companies. The demand is coming; the question is whether the Filipino talent pipeline can meet it.
The AI Talent Shortage Is Getting Worse
The talent gap is not static — the talent shortage is shifting from traditional security skills to AI-specific security skills, and the shift is accelerating. 60% of respondents now say finding candidates with specific AI experience in cybersecurity is a challenge, up from 57% in 2024. In Asia Pacific specifically, that figure jumps to 66%.
Organizations are trying multiple approaches to address the AI talent shortage. 59% are developing internal training or reskilling programs for AI. 58% are hiring new AI-skilled talent. 52% are procuring training or reskilling from industry vendors. But the scale of the challenge is evident in the types of new skills organizations need:
- AI model development: 55% of organizations need staff who can build and tune AI security models
- AI tool oversight: 54% need professionals who can govern and monitor AI systems
- Security automation: 52% need teams who can automate threat detection and response
The AI/Machine Learning role category has jumped to second place among the hardest cybersecurity roles to fill, behind only cloud security. This is a dramatic shift from five years ago, when AI security was not even a distinct job category. The demand for these roles is being created faster than the education and certification systems can produce qualified candidates.
Meanwhile, traditional security hiring remains challenging. 56% of organizations struggle to recruit cybersecurity talent (up from 52%), and 49% struggle to get approval for additional cybersecurity headcount. 51% say they need senior-level cybersecurity skills most of all — meaning the gap is sharpest at the top of the experience ladder, not at the entry level.
Certifications and Training Still Matter Most
Despite the rise of AI, certifications remain the single most valued credential in cybersecurity hiring. 91% of IT decision-makers prefer candidates with technology-focused certifications — consistent with 89% in 2024 and 91% in 2023. 92% of organizations say they would pay for an employee to get certified, rebounding from a dip to 73% in 2024.
Most significantly for the AI security trend, 92% of organizations say they are likely to invest in AI-related cybersecurity training or certifications in the next 12 months — 58% very likely and 34% somewhat likely. This is a near-universal signal: organizations know they need AI security skills and are willing to fund the training.
Professional certifications are preferred over four-year degrees: 66% prefer candidates with professional certifications, compared to 56% who prefer candidates with a four-year degree. The gap has been consistent for years, reinforcing that in cybersecurity, demonstrated competence matters more than academic credentials.
For Filipino professionals, the career pathway is clear. The SANS 2026 Cybersecurity Workforce Research Report confirms this trend: skills gaps now outweigh headcount as the primary concern, and certifications are the primary mechanism for validating those skills. CISSP, CEH, CompTIA Security+, CISM, and OSCP remain the most demanded certifications, but AI-specific certifications like Certified AI Security Professional (CAISP) are the fastest-growing category — directly addressing the AI security skills gap that the Fortinet report documents.
Board Inaction Driving Cyber Risk
One of the most troubling findings in the Fortinet 2026 report is that corporate boards remain dangerously unaware of cybersecurity and AI risks, despite increasing board focus on cybersecurity as a business priority. While 73% of respondents say cybersecurity is a high business priority for their board (up from 68% in 2024), only 59% say it is also a financial priority with budget behind it — down from 63% last year.
The awareness gap is stark: only 50% of leaders think their board members are fully aware of the potential risks from AI use — unchanged from 49% in 2024. Despite the rapid evolution of AI threats, boards are not getting better at understanding them. Similarly, only 50% of organizations think their board has a deep understanding of the cybersecurity talent shortage and its risks.
The consequences of this inaction are real. 50% of respondents say board members or executives have faced penalties after a cyberattack — including fines, jail time, or loss of position. Boards may be saying cybersecurity is important, but their budgets and awareness do not match their rhetoric.
This matters for Filipino professionals because it means that cybersecurity investment decisions are often made by leaders who do not fully understand the risks. Professionals who can translate technical threats into business language — who can explain to a board why the talent shortage matters in terms of breach costs, regulatory penalties, and competitive risk — will be invaluable. The gap between board awareness and operational reality is itself a career opportunity for security professionals who can bridge it.
What Filipino Professionals Must Do About the Cybersecurity Skills Gap
The Fortinet report is not just a survey — it is a career roadmap for Filipino cybersecurity professionals. The data shows exactly what skills employers need and are willing to pay for.
1. Pursue AI security certifications now. 92% of organizations plan to invest in AI-related cybersecurity training in the next 12 months. Getting certified in AI security — whether through CAISP, Fortinet’s own NSE certifications, or SANS/GIAC AI security programs — positions professionals at the intersection of the two fastest-growing demand areas: cybersecurity and AI.
2. Build AI oversight and governance skills. 63% of organizations expect to need AI oversight and governance roles in the next three years. These roles do not yet exist in most Philippine companies, which means the professionals who develop these skills now will be the ones who define the roles when they arrive.
3. Target senior-level positions. 51% of organizations say they need senior-level cybersecurity skills most of all. The entry-level market is competitive, but the senior market is desperate. Filipino professionals with 5+ years of experience who add AI security skills to their existing expertise will command premium compensation.
4. Develop internal training capabilities. 59% of organizations are developing internal AI training programs. Professionals who can design and deliver AI security training — who understand both the technical content and the pedagogical approach — are in demand as trainers, not just as practitioners.
5. Bridge the board communication gap. Only 50% of boards fully understand AI risks. Professionals who can translate technical cybersecurity concepts into business risk language will be sought after for CISO, security director, and advisory roles. The ability to communicate upward is as valuable as the ability to configure a firewall.
6. Leverage the Philippines’ global cybersecurity position. The Philippines is already recognized as a source of offshore cybersecurity talent. The Philippine cybersecurity market is projected at $282.68 million by 2026, and global demand for Filipino security professionals continues to grow. Adding AI security skills makes Filipino professionals even more competitive in the global market — whether working remotely for international clients or within Philippine organizations.
Frequently Asked Questions About the Cybersecurity Skills Gap
What is the cybersecurity skills gap in 2026?
The cybersecurity skills gap refers to the ongoing shortage of qualified cybersecurity professionals relative to demand. In 2026, the Fortinet report shows 71% of organizations say the skills shortage poses a risk to their operations, 56% struggle to recruit talent, and 52% struggle to retain it. The gap is shifting from traditional security skills to AI-specific security skills, with 60% of organizations now citing difficulty finding AI cybersecurity talent as their top recruiting challenge.
How does AI affect the cybersecurity skills gap?
AI affects the cybersecurity skills gap in two ways. First, AI-powered threats (automated phishing, deepfakes, AI-generated malware) are creating new attack vectors that require new defensive skills. Second, AI-powered security tools require professionals who understand how to deploy, govern, and oversee them. 91% of organizations are using or experimenting with AI cybersecurity solutions, but 45% worry about the lack of staff with sufficient AI expertise. AI is both creating the need for new skills and serving as a partial solution to the talent shortage.
What certifications should Filipino cybersecurity professionals get in 2026?
The Fortinet report shows 91% of IT decision-makers prefer candidates with certifications, and 92% are willing to pay for employee certification. For 2026, the most in-demand certifications remain CISSP, CEH, CompTIA Security+, CISM, and OSCP for traditional security roles. For AI security specifically, Certified AI Security Professional (CAISP), Fortinet NSE certifications, and SANS/GIAC AI security programs are the fastest-growing categories. 92% of organizations plan to invest in AI-related cybersecurity training in the next 12 months.
How much do cybersecurity breaches cost in 2026?
According to the Fortinet 2026 report, 86% of organizations experienced one or more breaches in the past 12 months. 52% of breaches cost more than $1 million, and the mean cost in Asia Pacific is $1.9 million. 29% of organizations experienced five or more breaches. Recovery times are also increasing, with 20% of organizations taking four to six months to recover — up from 14% the previous year.
Why is the cybersecurity skills gap worse in Asia Pacific?
Asia Pacific leads the world in AI cybersecurity adoption (58% of organizations actively using AI security solutions), but faces the toughest talent shortage (66% struggle to find AI cybersecurity talent). The region also experienced the most breaches (90%) and has the highest expectation of needing AI oversight roles (72%). The rapid pace of AI adoption in Asia Pacific has outstripped the talent pipeline, creating an acute gap between the technology being deployed and the human expertise needed to manage it.
What should boards do about the cybersecurity skills gap?
The Fortinet report shows only 50% of boards fully understand AI risks and the skills shortage. Boards should invest in their own cybersecurity education, ensure cybersecurity expertise is represented at the board level, and align cybersecurity budgets with their stated priorities. Only 59% of organizations that say cybersecurity is a business priority also treat it as a financial priority with budget — a gap that leaves security teams underfunded and understaffed. Boards should also develop cyber-resilience strategies that go beyond day-to-day security controls.
How can Filipino professionals close the AI cybersecurity skills gap?
Filipino professionals should pursue AI-specific security certifications, build AI oversight and governance skills, target senior-level positions where demand is highest, and develop the ability to communicate cybersecurity risks to business leaders. The Philippines is already a recognized source of offshore cybersecurity talent, and adding AI security skills makes Filipino professionals more competitive in the global market. 92% of organizations plan to invest in AI cybersecurity training in the next 12 months — professionals who are ready for that training will be the ones who benefit.
This article is for informational purposes only and does not constitute professional career or certification advice. The cybersecurity skills gap data is based on the Fortinet 2026 Cybersecurity Skills Gap Global Research Report. Always conduct your own research or consult a qualified professional before making career decisions.
