When I speak to security leaders about the challenges they are facing, finding and keeping the right people is rarely far from the conversation. The instinctive response is often recruitment: where can we find experienced people, how do we attract them and how do we persuade them to stay?

Those are important questions, but they only get us so far. When organizations are all looking for experienced professionals from the same relatively small pool, we may fill individual vacancies, but we are not proactively looking at ways to create more cyber talent.

If we want a stronger and more diverse workforce in the years ahead, those of us who have already built careers in cybersecurity have to accept some responsibility for helping to create it. Experienced professionals have knowledge and influence that can make a genuine difference to somebody considering or beginning a career in cyber.

Understanding the Pipeline Starts Earlier than Recruitment

The scale of the challenge remains significant. The UK government’s Cyber security skills in the UK labour market 2025 report found that 49% of businesses had a basic technical cyber skills gap, while 30% faced gaps in more advanced technical areas.

There will always be a need to recruit experienced specialists. But if we want more experienced people available in future, we need more people finding their way into the profession today.

For many, that journey begins long before they see their first cyber job advert. Young people form ideas about careers while they are still at school or university. If they never encounter cybersecurity, or see it as a highly technical profession for people who have been coding since childhood, many will understandably assume there is no place for them.

This is one of the reasons I have valued supporting initiatives such as the UK government’s CyberFirst Girls competition and ISACA’s SheLeadsTech initiative. Giving young people an opportunity to experience cybersecurity and meet people working within it can change how they see the profession and their own potential within it.

Experienced professionals can help make that happen. Speaking at a school or university event or offering meaningful work experience may introduce somebody to a career they had never considered. But as we make cyber more visible, we also need to make sure the picture we present reflects the breadth of the profession.

Cyber Needs Different People and Different Perspectives

Technical expertise is fundamental, but it is not the only quality that makes somebody valuable to a security team. The strongest teams also need people who can understand the wider business context and apply sound judgement to complex situations. The challenges we face rarely arrive as purely technical exercises.

Some excellent cyber professionals have taken unconventional routes into the industry. Making those journeys visible helps people understand that there is no single route into the profession or fixed idea of what a successful cyber career should look like.

That is particularly important for people who do not see many people like themselves in senior positions. The UK Government's aforementioned 2025 research found that women represented 17% of the cybersecurity workforce, falling to 12% among those with more than six years' experience.

This matters beyond representation. Cybersecurity requires us to question assumptions and consider what others may have overlooked. The experiences people bring influence the questions they ask and the risks they notice. As threats become more complex, having people who approach problems differently and with open curiosity can strengthen organizational resilience.

But bringing a wider range of people into cyber is only the beginning. If we want them to become the experienced professionals and leaders we will need in the future, we also have to help them develop once they arrive and recognize the key part that we as leaders can play in this development.

Mentoring is Only Part of What Leaders Can Offer

Mentoring has been an important part of my own contribution to the industry, through SheLeadsTech and my involvement with the Worshipful Company of Information Technologists, through which I also became a Freeman of the City of London. For me, that involvement is about giving something back to a profession that has given me a rewarding career.

When you have worked in cyber for many years, it is easy to forget how difficult the industry can be to navigate when you are starting out. Often, the conversations that matter most are not technical. They might involve talking through a career decision, encouraging someone to put themselves forward for a role or providing a space where they can ask questions.

There is also a role for sponsorship. Senior professionals have access to networks and opportunities that somebody starting out does not. Making an introduction, recommending someone for an opportunity or putting their name forward when they are not in the room can have a lasting impact.

Mentoring can provide guidance and confidence; sponsorship can turn that support into opportunity. Both matter if we want talented people not only to enter cybersecurity, but to progress within it.

Of course, CISOs and other senior professionals are busy, and mentoring, volunteering and outreach can easily be pushed down the priority list, but the rewards often outweigh the challenges. If you can make a difference to just one person then for me that's a great job well done. That is why employers need to create space for people to contribute and the recognition of their lasting impacts.

Developing Talent Needs to Become Part of the Job

As well as supporting talent at the education and entry level, including through apprenticeships, organizations also need to invest in people once they are inside the business.

The capabilities cyber teams require are changing quickly. An ISC2 survey of UK cybersecurity professionals published in May 2026 found AI to be the most commonly reported skills gap, followed by cloud security. We cannot assume there will always be a ready-made expert to recruit whenever a new capability becomes important.

Read now: Hiring for the AI Era: A New Challenge for CISOs

Developing people therefore needs to be part of workforce planning. Organizations can provide the structure and opportunities, but those programs only work when experienced people are prepared to participate.

Most of us who have been in this profession for some time can remember somebody who helped us at an important point in our career. Perhaps they offered advice, made an introduction, took a chance on us or encouraged us towards an opportunity we might otherwise have overlooked.

We now have the chance to do the same for somebody else.

Schools and universities can introduce people to cybersecurity. Government and employers can create pathways into the profession. But those of us already working in cyber bring something different: experience, knowledge and networks built over the course of our careers.

We cannot keep talking about the cyber skills shortage as though the next generation of experienced professionals will simply appear when we need them. We need to introduce people to the profession, give them opportunities and help them develop once they arrive. Today's cyber leaders are in a position to make that happen. We must make the time to do it well.