Is Cybersecurity a Good Career in 2026?

Why this question matters more in 2026 than it did a few years ago

A few years ago, “is cybersecurity a good career” had a fairly simple answer: yes, unambiguously, driven almost entirely by a widely cited talent shortage. That framing has gotten more complicated, not because the field weakened, but because the conversation matured. Layoffs at major tech companies touched cybersecurity teams too. AI tools started automating some of the repetitive alert-triage work that used to anchor entry-level SOC roles. And employers, burned by hiring people who had certifications but couldn’t actually do the work, got more selective.

None of that makes the honest yes below less true. It does mean the honest yes needs real caveats attached to it now, which is exactly what the rest of this page covers.

The honest yes: the numbers are real

According to the U.S. Bureau of Labor Statistics, information security analysts had a 2024 median pay of $124,910 per year, and the occupation is projected to grow 29% from 2024 to 2034. For comparison, BLS projects total employment across all U.S. occupations to grow just 3% over the same period. That makes information security analyst one of the five fastest-growing occupations BLS tracks, well ahead of most other career paths people compare it to.

This is not a niche or declining field propped up by hype. It is one of a small number of occupations where both the growth rate and the pay are genuinely above almost everything else in the labor market, and that combination is rare enough to take seriously on its own merits.

The honest complications: it’s not immune to cuts

Cybersecurity is not exempt from the economic pressure other industries face. ISC2’s 2025 Cybersecurity Workforce Study, based on responses from 16,029 cybersecurity professionals worldwide, found that 36% of organizations reported budget cuts and 24% reported layoffs affecting their cybersecurity teams. Both figures were down slightly from 2024, suggesting conditions are stabilizing rather than worsening, but they had not disappeared.

The real shift: skills, not headcount, is the bottleneck

The most useful finding in the 2025 ISC2 study is a change in what teams say they’re actually short on. For the first time, ISC2 declined to publish a single global “workforce gap” number, a figure that circulated for years in the form of “3.4 million” or “4.8 million” open cybersecurity jobs. ISC2’s own reasoning: skills shortages now outweigh pure headcount shortages as the top concern. In the 2025 study, 59% of respondents reported critical or significant skills shortages on their team, up from 44% the year before, and 95% reported at least one skills gap of some kind.

In plain terms: organizations increasingly have people, but not always people who can do the specific work needed. That is a genuinely good environment for a beginner who can show up with real, demonstrated ability, and a genuinely bad environment for someone relying on a certification alone to open doors.

Industry and regional variance

None of these figures apply evenly everywhere. Regulated industries, finance, healthcare, insurance, government contracting, tend to have more stable cybersecurity budgets, since compliance requirements don’t disappear during a downturn the way discretionary security spending sometimes does. Tech companies, by contrast, have historically been more prone to the kind of broad layoffs that swept up cybersecurity roles alongside everything else during past downturns.

Geography matters too. Major metro areas with large financial services, healthcare, or government presence tend to have deeper, steadier entry-level hiring than smaller markets, where a single employer’s hiring freeze can noticeably shrink the local job pool. This doesn’t mean smaller markets are closed off, remote roles have narrowed the gap considerably, but it’s a real factor worth weighing alongside the national averages cited above.

Company size shapes the experience too, not just the hiring volume. Large enterprises tend to offer more structured onboarding and clearer career ladders, but also more bureaucracy and slower decision-making. Smaller companies and managed security service providers offer faster exposure to a wider variety of work, sometimes at the cost of less formal training. Neither is objectively better, but it’s worth factoring into where you target applications, not just what title you’re chasing.

Who this career genuinely isn’t a good fit for

Honesty here matters as much as the encouraging numbers above. A few patterns tend to predict a rough fit with cybersecurity work, regardless of how strong the field’s growth is overall.

• People looking for a fast, low-effort path to a high salary. The pay is real, but it comes after months of study and a genuine skills investment, not from the field’s growth alone.
• People who dislike ongoing learning. Threats, tools, and best practices change constantly. Professionals who stop learning after their first certification fall behind quickly.
• People who strongly dislike documentation and writing. A large share of the actual work, across every specialization, involves writing clearly for other people to read and act on.
• People who need constant certainty. Investigative work involves sitting with ambiguous, incomplete evidence and making judgment calls, which is uncomfortable for some people and genuinely engaging for others.

None of these are disqualifying forever, they’re worth an honest gut check before investing months of study into a direction that might not suit how you actually like to work.

What this means for you, specifically

Put together, the honest picture is this: the field is growing fast and pays well, but it is also selective, cyclical like any industry, and increasingly focused on whether a candidate can actually do the work rather than whether they merely studied it. That is the entire premise behind CYBRTRESS. Certifications and courses get you the vocabulary and the fundamentals. Projects, documentation, and practical scenario work are what let you prove, to an employer who has been burned by unqualified hires before, that you can actually do the job.

Compared to adjacent tech fields, general software development, IT support, or data analysis, cybersecurity’s growth and pay numbers hold up well, and it offers something those fields increasingly don’t: a genuinely accessible entry point that doesn’t strictly require a four-year degree. That combination, strong demand plus a realistic non-degree path in, is a meaningfully rare position for a career to be in right now.

Frequently asked questions