Experienced cybersecurity professionals are leaving critical government roles while AI transforms how younger workers learn, raising concerns about America’s ability to protect essential systems.

WHAT’S HAPPENING

The United States faces a growing cybersecurity workforce challenge as experienced professionals leave critical government positions while artificial intelligence changes how the next generation of security specialists develops its skills.

An October 2026 report highlights concerns that the loss of experienced cybersecurity personnel could weaken national security at a time when cyberattacks are becoming more sophisticated and increasingly assisted by AI.

The concern is especially significant for federal agencies responsible for protecting government networks, critical infrastructure, and sensitive information.

Organizations such as the Cybersecurity and Infrastructure Security Agency (CISA) depend on experienced personnel who understand complicated government systems, emerging threats, and the operational weaknesses that attackers may exploit.

Many of these professionals have spent years or decades developing specialized knowledge.

When they leave, replacing them involves more than filling an open position.

Organizations may also lose institutional knowledge that cannot be easily recovered from manuals, software tools, or automated systems.

Recent cybersecurity workforce research underscores the challenge.

According to 2026 SANS Institute and GIAC research:

• 60% of surveyed organizations reported cybersecurity skills gaps.

• 27% reported breaches associated with capability gaps, demonstrating the potential operational consequences of insufficient expertise.

• 74% reported AI-driven changes to cybersecurity team structures, reflecting the growing influence of automation on security work.

These findings come from an international workforce survey and should not be interpreted as measurements exclusively of U.S. government agencies.

The research also raises questions about how AI is changing the development of cybersecurity professionals.

Traditionally, junior analysts gain experience by reviewing security alerts, investigating suspicious activity, analyzing software vulnerabilities, and learning how systems behave.

AI increasingly assists with these responsibilities.

Automated systems can examine large amounts of information, summarize incidents, identify potential vulnerabilities, and recommend responses.

While these capabilities may improve productivity, they also introduce an unintended risk.

If entry-level responsibilities become increasingly automated, younger professionals may have fewer opportunities to develop the practical experience required to become senior cybersecurity experts.

The result could be a workforce facing pressure from both directions: experienced professionals leaving and fewer traditional pathways for developing their replacements.

WHY IT MATTERS

Cybersecurity is not simply a matter of installing the latest security software.

Protecting critical systems often requires understanding how technology, people, operational procedures, and interconnected infrastructure function together.

Many government agencies and businesses continue relying on older software and specialized systems developed over decades.

These systems may have limited documentation, unusual configurations, or dependencies that are poorly understood outside the teams responsible for maintaining them.

Experienced cybersecurity professionals often know why particular systems operate the way they do.

They understand previous incidents, security workarounds, system limitations, and the potential consequences of making changes.

When that knowledge disappears, replacing the employee may not immediately restore the organization’s capabilities.

AI can identify suspicious activity, but it cannot automatically replace years of experience understanding why a critical system behaves a particular way.

This problem becomes more serious when organizations are protecting infrastructure that cannot easily be taken offline.

Electric utilities, transportation networks, telecommunications providers, financial institutions, and government services may depend on systems that must operate continuously.

Security decisions in those environments require technical knowledge as well as an understanding of operational consequences.

The second challenge involves workforce development.

AI is increasingly automating responsibilities that traditionally helped junior cybersecurity professionals learn.

An inexperienced analyst might previously spend hours examining suspicious network traffic or investigating alerts.

Today, an AI system may produce a summary and suggest a response in minutes.

That can improve efficiency.

However, if employees routinely accept automated conclusions without understanding the underlying evidence, they may struggle when an unfamiliar or particularly sophisticated attack occurs.

The danger is not that AI assistance automatically makes cybersecurity workers less capable.

Properly used, AI could accelerate learning by helping employees understand threats and explore solutions.

The risk arises when automation replaces experience rather than supporting its development.

This creates a long-term concern for employers.

An organization may improve short-term productivity by automating routine security work while unintentionally weakening the training pipeline needed to develop future specialists.

The effects may not become obvious immediately.

They could emerge years later when experienced employees retire or leave and organizations discover that fewer workers possess the expertise needed to replace them.

WHO BENEFITS

• Experienced cybersecurity professionals: Their specialized knowledge may become increasingly valuable as organizations recognize the importance of retaining institutional expertise.

• Cybersecurity training providers: Could see growing demand for practical training, incident simulations, and professional development.

• Educational institutions: Gain opportunities to develop programs combining hands-on cybersecurity experience with responsible AI use.

• Businesses offering knowledge-management systems: May help organizations document critical technical information before experienced employees depart.

• AI-assisted cybersecurity platforms: Could benefit by developing tools that strengthen human expertise rather than simply automate responsibilities.

• Government contractors: May find opportunities providing specialized cybersecurity services and expertise to agencies facing workforce shortages.

• Students entering cybersecurity careers: Could benefit from increased emphasis on practical skills, mentorship, and specialized training.

• Organizations investing in employee development: May build stronger long-term defenses by combining AI technology with experienced security personnel.

WHO LOSES

• Government agencies unable to retain experienced personnel: Could lose critical knowledge about sensitive systems and established security procedures.

• Businesses depending exclusively on automated cybersecurity tools: May struggle when incidents require judgment beyond the capabilities of their software.

• Organizations eliminating too many entry-level opportunities: Risk creating future shortages of experienced professionals.

• Junior cybersecurity workers without practical training: May find it harder to develop the skills needed for advanced technical positions.

• Companies neglecting knowledge transfer: Could experience costly disruptions when key employees leave unexpectedly.

• Critical infrastructure operators with limited security staffing: May face greater exposure if essential technical expertise becomes difficult to replace.

• Technology providers promising complete replacement of human security teams: Could face increased scrutiny if automated systems fail to handle complex real-world incidents.

WHAT HAPPENS NEXT

Government agencies and private businesses will need to reconsider how they recruit, train, retain, and develop cybersecurity professionals as AI becomes more deeply integrated into security operations.

The immediate priority for many organizations will be preserving the expertise of experienced employees.

That may require structured knowledge-transfer programs, mentoring arrangements, improved technical documentation, and stronger succession planning.

Organizations may also need to identify systems that depend heavily on the knowledge of a small number of individuals.

If only one experienced employee understands how a critical application is configured or maintained, the organization faces a risk that extends beyond ordinary cybersecurity vulnerabilities.

AI tools may help preserve some of that knowledge.

For example, authorized systems could assist with organizing technical documentation, maintaining searchable operational histories, and helping newer employees understand established procedures.

However, AI-generated explanations must be checked against reliable records and expert knowledge.

The next challenge is maintaining effective training opportunities.

Cybersecurity education may need to place greater emphasis on hands-on investigations, realistic attack simulations, and situations where automated recommendations are incomplete or incorrect.

Junior analysts should understand how AI reaches its conclusions and develop the ability to investigate independently.

Rather than eliminating every repetitive task, organizations may need to preserve selected learning opportunities that build professional judgment.

This approach could apply well beyond cybersecurity.

Software engineering, financial analysis, healthcare, and other skilled professions also depend on experience accumulated through increasingly sophisticated responsibilities.

If AI automates too much of the introductory work in those fields, employers may face similar questions about how future experts will be trained.

For cybersecurity specifically, the next meaningful indicators will include government workforce retention, the availability of qualified specialists, security incident performance, and whether organizations can demonstrate that AI-assisted employees are developing stronger capabilities.

Businesses should also examine the practical results of their AI investments.

Faster detection and incident summaries are valuable, but they do not automatically establish that an organization is better prepared to handle a serious cyberattack.

Security performance ultimately depends on how effectively people, technology, and operating procedures work together.

Organizations that combine automated tools with experienced personnel and structured workforce development may be better positioned to manage evolving threats.

The longer-term challenge is ensuring that AI strengthens the cybersecurity profession without undermining the experience needed to sustain it.

The larger shift is clear: America’s cybersecurity challenge is not limited to increasingly sophisticated AI-enabled attacks. It also involves preserving the human knowledge required to defend critical systems. As experienced professionals leave and AI automates traditional training responsibilities, organizations must ensure that short-term productivity gains do not create long-term shortages of expertise. The strongest cybersecurity strategy will depend on developing human judgment alongside artificial intelligence—not assuming one can fully replace the other.