The Cyber Talent Crunch Impacts Us All

By: | June 20, 2025

Michelle Chia has two decades of cyber, technology, and professional liability insurance experience. She spent the past ten years building teams that experienced triple digit growth while optimizing operational efficiency, developing innovative and customer centric products and services, and engaging in public private partnership to advise on policy and to build resilience. Prior to joining AXA XL as the Chief Underwriting Officer for Cyber, Design and Select Professionals in the Americas, Michelle was the Head of Professional Liability and Cyber at Zurich North America, which became a top ten cyber insurance carrier. Michelle graduated Tufts University with a Bachelor of Arts in Economics and a Bachelor of Arts in Child Development. She also received her Master of Business Administration at The Wharton School of the University of Pennsylvania.

In cybersecurity, there’s no shortage of threats.  In fact, according to the Honeywell 2025 Cyber Threat Report, ransomware attacks jumped by 46 percent in the first quarter of 2025.  That’s troubling. But what’s even more concerning is the alarming shortage of people capable of preventing these attacks.

The global cyber talent crunch and its impact should concern us all.  It is reshaping the way cyber insurers need to operate, exposing businesses to greater risks, and creating vulnerabilities that bad actors are all too ready to exploit.   

Demand outpacing supply

The global cybersecurity workforce gap stood at over 4 million professionals as of 2024, says the 2024 ISC Cybersecurity Workforce Study.  Despite efforts to boost training, reskilling, and automation, demand continues to outpace supply.

According to the World Economic Forum’s Global Cybersecurity Outlook 2025, the cyber skills gap has already increased by 8% since 2024. Two out of three organizations report moderate-to-critical skills gaps, including a lack of essential talent and skills to meet their security requirements. Only 14% of organizations are confident that they have the people and skills they need today.

Volume isn’t the only problem.  It is also the lack of expertise. Cybersecurity is evolving so rapidly that traditional career pipelines can’t keep up. AI, cloud infrastructure, ransomware-as-a-service, supply chain attacks all demand highly specialized skill sets that most professionals simply don’t have yet or can develop quickly. Meanwhile, the attack surface for cyber criminals is growing with every new device, platform, and remote worker added to the network.

The result is a strained, under-resourced cybersecurity workforce. That puts pressure on insurers, who rely on accurate data and resilient security infrastructure to underwrite risk. It also puts pressure on our clients who may struggle to recruit the expertise needed to build a strong cyber risk posture.

How it’s impacting cyber insurers

Effective cyber underwriting depends on understanding a client’s cyber hygiene, infrastructure, and threat exposure.  Without enough skilled professionals to gather and interpret that data, many insurers could be flying blind. Inconsistent risk assessments and outdated models are leading to mispriced policies and unexpected losses.

The landscape of cyber threats is continually evolving, and insurers are recognizing the need to stay ahead of these trends. A low-risk six months ago might now be a hot target. While it may be challenging to find experienced cyber underwriters, risk consultants, and claims specialists, this also presents an opportunity to develop talent through training programs and partnerships with educational institutions.  AXA XL, for example, formed the Cyber Academy to help its underwriters keep pace with changes in the cyber landscape.  Through the Cyber Academy, underwriters can pursue continuing education and industry credentials like their Certified Cyber Insurance Specialist (CCIS) accreditation.

When breaches occur, insurers are committed to supporting their clients through incident response. As cyber claims become more complex, the need for specialized talent within claims departments is growing. Insurers are aware of this and are focusing on recruiting and training professionals with the necessary technical fluency. This strategic investment can lead to more efficient claims resolution and enhance customer satisfaction.  Many insurers are also exploring collaborations with external experts and investing in tools that can streamline response efforts to reduce response times and manage costs effectively.

Ultimately, while the cyber talent crunch presents challenges, it also encourages innovation and collaboration within the insurance sector. By embracing these opportunities, insurers can better support their clients and navigate the evolving cyber landscape.

Our clients are feeling the heat too

The impact on businesses, our clients, is just as serious—if not more so. Many organizations may struggle to allocate the budget or establish the brand presence needed to attract top cybersecurity talent, which can leave them exposed to potential vulnerabilities including:

  • Increased Risk Exposure: Without in-house cyber experts, businesses are often unaware of their true risk exposure. They may be running outdated systems, missing patches, or leaving critical data unprotected, leaving lots of open opportunities for cybercriminals.
  • Trouble meeting insurance requirements: Insurers, recognizing this increased exposure, are tightening underwriting requirements or raising premiums—especially for companies that can’t demonstrate strong cyber hygiene. Some businesses are even being denied coverage entirely.
  • Compliance Pressure: Regulatory requirements are mounting. From GDPR to CCPA to sector-specific rules, compliance is non-negotiable. But compliance isn’t plug-and-play.  It requires continuous monitoring, risk assessment, and documentation. Without experienced cyber pros, companies struggle to stay compliant, opening the door to fines and penalties.
  • Dependence on Third-Party Vendors: To fill the gap, many businesses outsource cybersecurity functions. This can be effective, but it creates its own risks. Relying on third parties increases supply chain vulnerabilities and makes it harder to respond quickly to incidents. Plus, the same talent crunch means vendors themselves may be stretched too thin to provide high-quality, timely support.

What can be done?

While there’s no quick fix for the challenges posed by the cybersecurity talent crunch, there are several promising paths forward for both insurers and their clients.

Insurers and businesses alike should prioritize investments in internships, apprenticeships, and internal training programs to cultivate the next generation of cybersecurity professionals. We also need to rethink hiring criteria, placing greater value on aptitude and adaptability rather than strictly adhering to traditional credentials like college degrees.

Public-private partnerships can play a bigger role in addressing the talent gap. Collaboration between governments and industry groups can help establish broader cyber training pipelines that begin as early as high school. By fostering interest in cybersecurity careers from a young age, we can build a more robust workforce ready to tackle these evolving challenges.

Automation and artificial intelligence (AI) will have a role to play too. While these technologies won’t replace cybersecurity professionals, they can enhance their capabilities, allowing them to achieve more with fewer resources. Areas such as threat detection, risk scoring, and incident triage are well-suited for automation, which can free up human talent to focus on more strategic and complex tasks.

Insurers should particularly embrace AI-powered underwriting tools and risk analytics to mitigate their reliance on scarce talent. This approach not only streamlines processes but also enhances the accuracy of risk assessments for our clients.

Final thoughts

While the journey ahead may be challenging, a strategic focus on education, collaboration, and technology can pave the way for a more secure future in cybersecurity for both insurers and their clients.

The cyber talent crunch isn’t just a staffing issue—it’s a systemic risk multiplier. It’s distorting underwriting, delaying incident response, and making it harder for businesses to protect themselves.

Addressing the talent gap requires a collective effort—training new professionals, investing in smarter tools, and rethinking the way we approach cybersecurity. Until we do, every business is playing defense with a shrinking bench. And that’s a game none of us can afford to lose. &

More from Risk & Insurance