Long onboarding times can cause cybersecurity skill decay

Dive Brief:

• Despite the fast-paced, high-pressure nature of cybersecurity, onboarding represents an efficiency drag, with 57% of leaders in the sector reporting that it takes new hires six months to reach full productivity, according to research published Sept. 29 from cybersecurity training firm SkillBit.
• Nonetheless, two-thirds of companies want their new cybersecurity hires to get fully up to speed in three months, per the report. In addition, 39% of cybersecurity leaders also said skills decay was a significant concern, with that percentage increasing to 60% among companies with more than 50,000 employees.
• The report found that even in a high-demand, high-skill workforce like cybersecurity, there were recruiting, hiring and onboarding issues that could slow the talent pipeline.

Dive Insight:

The 2026 Micro-Training Survey Report, created in partnership with CyberBay and Bellini Capital, culled responses from more than 200 cybersecurity leaders.

When it comes to hiring, narrow expertise was less important than versatility, with more than two-thirds of survey respondents citing problem-solving, critical thinking and adaptability over “expertise tied to a specific technology stack.” Even so, 70% of companies said they had “few or no roles available” for applicants with less than two years’ experience.

“Organizations face challenges across the talent lifecycle, from onboarding new hires to keeping experienced professionals current as technologies and attack methods evolve,” the report said. These issues can be exacerbated by the stress to fill empty positions on cybersecurity teams who are “under pressure to defend against increasingly sophisticated threats.”

The report underscored a troubling cycle, whereby companies took “too long to build readiness” and subsequently risked facing a skills decay. 

To prevent losing critical skill sets, the research suggested companies work toward a state of continuous readiness by combining ongoing assessment with hands-on practice and shorter learning cycles.

Leaders in the sector said they overwhelmingly favor more concise, ongoing development processes, with 71% saying they preferred weekly 20-minute learning experiences instead of 30 to 40 hours of training that was offered only once or twice a year.

The results suggest that there are limits to the results that can be achieved through traditional development models such as periodic courses, point-in-time certifications and completion-based measures. Instead, the research found that as artificial intelligence capabilities become more advanced, cybersecurity attack methods and security protocols will also improve, which means companies need to develop more responsive training systems to validate cybersecurity team skills.

“A completed course or certification documents a moment in time,” SkillBit CEO Roman Bohuk said in a statement. “Security leaders need to know whether teams can perform today and be ready for tomorrow’s challenges. Continuous Readiness gives organizations a practical way to build, validate, and strengthen skills before those skills are tested in a real incident.”

Building more nimble workforce training methods can also benefit sectors outside of technology. A recent report from cloud learning platform TalentLMS found that of 1,500 U.S. managers and employees surveyed, nearly half (47%) said some of their job skills became outdated in the last five years, with 21% of managers saying their skills became outdated the last year. In addition, 38% of managers said that AI often made it difficult to know what skills their team would need in the year ahead.