Every spring the cybersecurity talent surveys arrive and they all say thousands of people are missing. For whoever runs internal audit or technology risk, the headline matters less than the nuance. The problem that stalls the plan is rarely a shortage of people. It is a shortage of the right people, and the scarcest are the senior ones.
What is actually scarce
A junior profile learns to run a test in weeks. Learning to calibrate what they find takes years, because it is acquired through cases and not through training.
That judgement is what lets someone look at a supplier changing terms, a system connecting to another, a rule coming into force or an incident under way and know what is serious, what is noise and what evidence to ask for before concluding. There is no shortcut, which is why the market does not produce it at the rate it consumes it.
The market does not have a quantity problem. It has a judgement problem, and judgement takes years to form.
Why it reaches audit before anyone else
An internal audit team competes for that same profile with security, with risk and with the firms, and almost always pays less than all three. The consequence is not an open vacancy, it is a list of engagements that fall out of the plan because nobody on the team can review them with confidence. Cloud, identity, AI agents and supply chain almost always land on that list.
Then one of two exits usually follows. The first, covering the work with a well meaning mid-level profile who can run tests but cannot calibrate what they find. The second, outsourcing the whole review and losing the in-house judgement needed to challenge it, which is worse. Either way the report reaches the committee with conclusions nobody on the team can defend in depth.
The data explains why this is not fixed with training or one more tool. What is missing is the judgement to read new situations, a supplier changing terms, a system connecting to another, a rule coming into force, an incident that has to be calibrated. That judgement comes with years and cases, which is why it is scarce.
What can be done this cycle
The useful question is not how to hire that profile, it is where the judgement you already have is being spent today. In most teams it is spent gathering evidence, reconciling exports and chasing answers, which is necessary work and needs no judgement at all. When that work is put in order, senior hours go back to where they pay off, deciding what a finding means and what to do about it.
That is where the capability gap the profession itself measures shows up, the one covered in the capability gap in the profession.
The team that gets ahead is not the one that manages to hire the most expensive profile on the market. It is the one that stops spending its senior people on work that asks for no judgement.
