57% of security execs report challenges with onboarding entry-level staff

A study released September 29 by SkillBit found that cybersecurity managers are having difficulty onboarding new employees and finding cyber talent, and as a result, maintaining cyber resilience has become very challenging.

In a survey of 200 security executives, 57% reported a six-month time-to-value for a new employee, which puts a lot of pressure on security managers racing to onboard people in the wake of the compressed timeline for managing patches in the AI era.

The survey also found that 70% of organizations say they have few roles available to candidates with under two years of experience, which means there’s fewer and fewer qualified entry-level candidates.  

In terms of training, 71% of security managers said they prefer 20-minute weekly upskilling sessions over annual training, yet 84% sponsor “Certification” training for their staff. While more thorough, this training often takes a large amount of time to complete, at a time when most security teams can barely keep up.

“We can’t keep asking for experienced cybersecurity professionals without giving people a chance to gain that experience,” said Michael Jenkins, chief technology officer at ThreatLocker. “AI can help with some tasks, but it cannot replace human judgement, and that needs to be learned through experience.”

On the 57% time-to-value number, Jenkins said every job has a learning curve when someone joins a new organization: what matters is whether they get the chance to contribute and grow during that training time.

For his team, Jenkins said they tend to hire early-career employees, including people straight out of high school, and help them grow into more advanced roles. Jenkins said he’s mentored people who started in junior support and later moved into important roles on the development team.

“A lot of that learning happens through the work itself,” said Jenkins. “Every code commit is reviewed by multiple people, and significant actions get a second look, even when a senior employee is involved. Newer employees see how experienced colleagues think through decisions and get feedback while the work happens. I also like that they ask why we do things a certain way. They haven’t had as much time to pick up workarounds and bad habits elsewhere.”

The SkillBit survey found that cybersecurity leaders are wrestling with the issue of finding more roles and training for junior staff by becoming open to the idea of changing the strict 2-year experience requirement so long as the candidate can demonstrate some subject knowledge.

According to the survey, 30% of leaders are receptive to “Interactive Lab” formats as a credential substitute, and another 49.5% are open to it if presented with convincing evidence of its effectiveness. By replacing static resumes with interactive challenges, security executives can validate a candidate’s ability to perform in a live environment, effectively widening the candidate pipeline across security teams without lowering the skill level.

Ram Varadarajan, chief executive officer at Acalvio, added that these latest findings reflect a meaningful shift from just a few years ago, when cybersecurity training was viewed as discretionary spending.

Varadarajan said today, rising threats, cloud adoption, regulatory pressures, and AI have made workforce development and employee onboarding a strategic priority. Varadarajan said the continued focus on AI, cloud, networking, risk management, administration, and analysis highlights the need for cybersecurity professionals to combine technical, operational, and business skills.

“They also need to understand emerging concepts such as AI-driven, game-theoretic cyber defense, which uses intelligent deception and adaptive strategies to shape attacker behavior,” said Varadarajan. “To overcome training-time and onboarding challenges, organizations should treat learning as a business requirement with protected time and measurable goals. For those entering the field, it’s encouraging news: employers are investing more in training and onboarding, however, candidates still need foundational IT, cloud, networking, and AI skills to get hired and take advantage of those opportunities.”

Diana Kelley, chief information security officer at Noma Security, said AI will create new cybersecurity roles, but employers are still looking for experience and proof-of-capability, even at the entry level. For new candidates, Kelley said that means pairing foundational knowledge with hands-on experience, whether that’s labs, internships, or contributing to real projects, and developing a working fluency in how AI gets used in enterprise environments.

“The long-term risk is a pipeline that runs dry,” said Kelley. “Cut off the early-career pathways and we lose the next generation of defenders. If we don't rebuild deliberate on-ramps, including apprenticeship models, AI-amplified junior roles, and academic pipelines that connect to real work, senior talent will age out faster than we can replenish it. The organizations that thrive will figure out how to onboard new employees quickly, and use AI to make junior practitioners more capable, rather than replace them.”