The cyber jobs market, in six months of actual data, with the marketing scraped off...

The cyber jobs market, in six months of actual data, with the marketing scraped off...

DSIT's 2026 Sectoral Analysis just landed. Cyber sector employment grew 3% year-on-year. That's the lowest growth rate since the study began in 2018.
Eight years of expansion has just hit the brakes, and nobody on LinkedIn is posting about it because nobody on LinkedIn is paid to post about it.

Meanwhile, on your feed, every recruiter is repeating the same line: "83% of employers plan to hire" (Barclay Simpson), "44% of companies plan to recruit in the next six months" (Robert Half), "demand significantly outweighs supply," and so on, in perpetuity, with a stock photo of a padlock.

The stated hiring intent and the actual employment growth do not match. One of them is wrong. Guess which one is being repeated.

What the data says:

Service/MSSP employment: effectively flat (42,425 FTEs, up from 42,232). The growth engine of the last decade has stalled.
Product/vendor firms: +13% headcount to 27,164 FTEs. All the growth is here.

The "workforce gap" is 3,800 professionals. Not millions. Three thousand eight hundred. Say it slowly.

What this means, said plainly:
The market is bifurcating. Vendor side is hiring, because they're selling the AI-driven detection products absorbing the junior SOC work. Internal teams are being squeezed, because their CFO read the same vendor pitch deck. Contract IR market is being compressed by IR35 and by AI swallowing the tier-1 toil that kept contractors busy.

Senior with hands-on architecture, cloud, IR, or AI governance — still getting calls. Mid-career trying to move — the role exists, now wants three certifications it didn't want last year, pays the same. Junior trying to break in — the door is narrower than the "skills shortage" headline pretends. The SOC L1 role that was your way in is being quietly automated by the product the vendor sold to the CFO who cut your training budget to pay for it.

So what does all this mean?

The cyber jobs market is now a Ponzi scheme of optimism — recruiters quoting employer surveys to candidates, candidates quoting recruiter surveys to each other, and employers quoting both back to the board to justify not hiring anyone. The shortage isn't of people. It's of employers willing to train them, CFOs willing to fund them, and honest posts about any of it.

If you're in the chair, stay in it, get harder to replace, and learn the thing your replacement vendor hasn't built yet. If you're trying to get into the chair, stop collecting certifications like Pokémon and start collecting problems you've actually solved. If you're hiring, train someone...it's cheaper than the consultant you'll pay £1,400 a day to do the job the junior you didn't hire would've done for £40k.

The market isn't dead. It's sorting. Be on the right side of the sort.
And if a recruiter tells you there's a skills shortage, ask them how many people they trained this year. Then listen to the silence. That silence is the data.