2026-10-13
AI Agents Didn't Close the Security Skills Gap. New 2026 Data Shows They Widened It.
For the last couple of years, the pitch around AI in security work has had two competing versions. One says AI agents will close the talent gap by letting junior analysts punch above their weight. The other says AI will route around the skills problem entirely — fewer humans needed, full stop. Two data sets published this year give us an actual answer, and it's less comfortable than either pitch: AI isn't closing the skills gap. It's making the gap between skilled and unskilled people wider, faster.
That matters for anyone running a security team, and it matters even more for anyone deciding what to teach or how to screen candidates — which is most of why we're writing this.
The headcount story was already wrong
Start with SANS's 2026 Cybersecurity Workforce Research Report, presented at RSAC this year. For a long time the standard narrative was "we don't have enough people." That's no longer what practitioners are saying. Asked whether their bigger problem is not enough staff or staff without the right skills, 60% of organizations pointed to skills, versus 40% citing headcount — a sharp reversal from just a year earlier, when the two answers were nearly tied.
The same report found 74% of organizations say AI is already reshaping their security team's size or structure — but mostly not through layoffs. 49% reported less manual analysis work, 48% cited workflow automation, and only 16% reported actual headcount reduction. AI is changing what the job looks like, not eliminating the job.
And here's the gap inside the gap: 54% of organizations say they have an AI governance policy, but only 21% have a comprehensive AI security framework, and just 38% provide comprehensive AI security training to their own staff. Most teams have decided AI is part of the job now and have not yet taught anyone how to do that job well.
What actually happens when AI agents compete
The second data set is more interesting because it's not a survey — it's a benchmark. Hack The Box ran its NeuroGrid study earlier this year across 1,078 competing teams: 120 using agentic AI tooling, 958 human-only, spread across four difficulty tiers. Averaged across every skill level, AI-assisted teams completed up to 1.4x more tasks in the same time window. That sounds like a modest, broadly-distributed boost — a rising tide.
It wasn't. Reported separately, elite teams using AI agents saw gains as high as 3–4x over elite teams without them. Lower-skilled teams using the same tooling saw meaningfully smaller gains. The 1.4x average isn't a story about everyone getting a bit faster — it's an average of a few teams getting dramatically faster and most teams barely moving, which is a very different thing to plan a training program around.
HTB's own follow-up, the 2026 Global Cyber Skills Benchmark run in August, backs this up with a cleaner number. AI agent accounts made up only 2.7% of all registered competitors — but showed up in 17 of the top 25 teams, or 68%. Those agents accounted for 4.2% of submitted flags and 4.6% of points scored. A tool that's 2.7% of the population and 68% of the leaderboard isn't a general equalizer. It's a force multiplier that correlates strongly with teams who were already strong.
HTB is explicit about this in its own reporting: the overlap between "uses AI agents" and "finishes in the top 25" is correlational, not causal. It's entirely possible that the teams sophisticated enough to deploy agentic tooling well were also just the teams most likely to finish near the top regardless. Don't read "top teams use AI" as "AI makes teams top." That distinction matters every time a vendor benchmark shows up in your inbox, not just this one.
Taken together, both data sets tell the same story from different angles: AI tooling rewards people who already know what a solved problem looks like, and does comparatively little for people who don't. Median time-to-solve across HTB's platform did fall — from 26.1 hours in 2024 to 13.8 hours in 2026 — but that's an average pulled down hard by the top of the distribution, not evidence that everyone got proportionally faster.
The two benchmarks, side by side
| SANS Workforce Report (2026) | HTB NeuroGrid / Skills Benchmark (2026) | |
|---|---|---|
| What it measures | Self-reported org priorities, ~1,000 respondents | Actual competitive performance, 1,078+ teams |
| Headline finding | Skills gap (60%) now outranks headcount gap (40%) | AI-assisted elite teams: 3–4x gains; weaker teams: far less |
| AI's role | Automating/augmenting work (49% less manual analysis) | Correlates with top-25 finishes (68%) despite 2.7% of entrants |
| The honest caveat | Only 38% provide comprehensive AI security training | Correlation, not proven causation, per HTB's own framing |
Why this raises the floor instead of lowering it
The intuitive read of "AI helps people do security work" is that it should lower the bar to entry — more people can contribute sooner. The data says close to the opposite: AI is a lever, and a lever only moves the thing you attach it to. Attach it to someone who already understands the underlying primitive — how a buffer overflow actually corrupts memory, why a SAML parser trusting an unsigned assertion is dangerous, what a real privilege-escalation chain looks like step by step — and they move faster. Attach it to someone who's pattern-matching without that understanding, and the output is plausible-looking nonsense at machine speed, which is arguably worse than no output at all, because it's harder to catch.
That's not an argument against AI tooling in security work. It's an argument that fundamentals training didn't get less important when AI agents showed up — it got more important, because fundamentals are now the multiplier on top of a multiplier. A team that skips hands-on training and goes straight to "give the junior analyst an AI copilot" isn't closing their skills gap. They're amplifying it, in whichever direction it was already pointed.
And it changes what hiring should validate
The SANS report has one more data point worth sitting with: certifications are now the leading skill-validation method in hiring, at 64%, while academic degrees rank lowest at 17%. That's a vote of confidence in credentials — but only credentials that actually validate something real. A multiple-choice cert that tests memorized terminology doesn't tell you whether a candidate can do the thing HTB just measured: solve a novel problem under time pressure, with or without AI assistance. A live, proctored, hands-on assessment does.
This is the same reason we built 0Labs' candidate assessments around real lab environments instead of a question bank — a flag captured on a live target is evidence of a skill that's going to compound well whether or not that person ever touches an AI agent. A multiple-choice score tells you what someone memorized before the exam. If the gap between skilled and unskilled is widening, the thing worth measuring in both training and hiring isn't whether someone can describe a vulnerability — it's whether they can find one.