Cybersecurity Skills Gap Becomes a Business Risk: Fortinet

Fortinet’s 2026 Cybersecurity Skills Gap Report finds that 71% of organizations view the skills gap as an additional business risk, while 86% experienced at least one breach in the past year and 56% of those incidents were partly linked to a lack of trained IT security personnel.

The cybersecurity skills shortage is moving beyond the human resources agenda and into the center of business risk management. As cyberattacks become more automated and sophisticated through AI organizations face a growing challenge: having the technology to detect threats is not enough if they lack the people capable of deploying, managing, and defending it.

Fortinet’s 2026 Cybersecurity Skills Gap Report highlights the scale of the challenge. According to the report, 71% of surveyed organizations say the cybersecurity skills gap represents an additional risk to their business, while 86% experienced at least one breach over the past year. More than half of those breaches, 56%, were attributed in part to a lack of trained IT security personnel with cybersecurity capabilities.

For Melonia da Gama, Director of Training and Education Programs, Fortinet, the figures point to a shift in how organizations should approach cybersecurity. The issue is no longer limited to filling open positions, but to ensuring that businesses have the capabilities required to withstand an increasingly sophisticated threat environment.

The connection between talent and resilience is becoming harder to separate. Without sufficient cybersecurity expertise within an organization, business resilience, continuity and executive accountability can be affected.

AI Is Increasing the Need for Cybersecurity Skills

The expansion of AI is adding another layer to the skills challenge. Cybercriminals are increasingly using this technology to automate attacks and increase their speed and sophistication, raising the capabilities required on the defensive side. At the same time, organizations continue to invest in AI, automation and security platforms. These technologies can strengthen security operations, but they still depend on trained professionals to configure, manage and respond to the risks they create.

Fortinet argues that AI-powered security tools should therefore be viewed as force multipliers rather than replacements for cybersecurity personnel. The distinction becomes more relevant as organizations deploy more AI products across their operations. Greater adoption creates demand for employees with more advanced AI capabilities, potentially widening the same skills gap that organizations are attempting to address through technology investments.

This creates a business challenge that extends beyond security teams. IT departments, developers, and business leaders also need a baseline understanding of how AI systems operate, the risks associated with them, and the controls that can be used to limit those risks. Expanding this knowledge across the organization can help companies capture the productivity and security benefits of AI while reducing unintended consequences.

Cyber Resilience Depends on Workforce Resilience

The skills gap also has implications beyond specialized cybersecurity roles. Employees across an organization remain an important component of its defensive posture, particularly as attackers use AI to accelerate credential theft, phishing, and social engineering campaigns.

Continuous learning, training, and upskilling can help organizations strengthen the knowledge and experience of their existing workforce. Cybersecurity awareness is therefore becoming part of the broader resilience strategy rather than an isolated activity managed by the security department.

Organizations making progress on this front are increasingly treating cybersecurity as a shared responsibility. Security leaders, IT departments, human resources, and executive leadership all have a role in developing the capabilities needed to manage an evolving threat landscape. This approach also changes the business case for cybersecurity training. Rather than being viewed primarily as an employee development initiative or a response to vacant positions, workforce development becomes part of risk management.

As AI changes both the offensive and defensive sides of cybersecurity, organizations face a dual investment requirement. Technology can expand their ability to identify and respond to threats, but skilled people remain necessary to operate those systems and make decisions when risks emerge.

The cybersecurity skills gap is consequently becoming a question of organizational resilience. Companies that prioritize experienced cybersecurity professionals and continuous workforce development will be better positioned to manage the threats associated with AI.