The UK’s Cyber Security and Resilience Bill risks failing its objectives unless the government tackles a deepening skills gap, according to a new report.
The report, The UK Cyber Skills Gap: Building Capability and Resilience, was published this month by The CSBR. It found that while the UK has built a solid foundation of cyber initiatives, an unstable “hourglass” labour market structure, combined with expanding regulatory burdens, threatens to undermine genuine digital resilience across critical national infrastructure.
Following Royal Assent, the bill is expected to expand regulatory powers to managed service providers and introduce strict 24-hour incident reporting. But the report warns this will trigger an unprecedented surge in demand for compliance and assurance skills, risking the UK trapping scarce technical talent in a cycle of bureaucratic box-ticking.
Drawing on official evidence including the Government Cyber Action Plan, the NCSC Annual Review 2025, the Cyber Security Breaches Survey 2025 and the Cyber Security Skills in the UK Labour Market 2025 report, the analysis found 49% of UK businesses and 58% of government organisations are already suffering a basic cyber skills gap.
Without systemic reform, the report says, critical personnel will be diverted into compliance management rather than practical threat defence, resulting in legal contestation instead of security.
Hourglass workforce
The report identifies a structural crisis in the UK cyber workforce, which it likens to an hourglass: high demand for experienced mid-to-senior level practitioners, but a severe bottleneck at entry level. In 2024, 65% of core cyber job postings required mid-level experience, while entry-level opportunities fell to just 17%.
It also points to a “leaky bucket” dynamic, in which trained public sector staff continually exit to better-paid private sector roles because of rigid pay constraints, recycling the shortage rather than solving it.
James Morris, founder of The CSBR, said: “No-one wants a scenario in which the Cyber Security and Resilience Bill becomes a paper tiger. Unless policy makers systematically connect our fragmented training programs and create viable entry routes for new talent, regulations will overwhelm the very sectors they are meant to protect. We could easily end up with compliance ‘contestation’ instead of genuine resilience.”
Recommendations
The CSBR calls on policy makers to urgently pursue four interventions: publishing a national cyber capability framework distinguishing baseline, practitioner and specialist capability, drawing on international examples such as Singapore’s Skills Framework; strengthening pathways into and progression within work, particularly at transition points from education into employment; embedding leadership and shared responsibility more systematically into mainstream governance and management practice, building on the Cyber Governance Code of Practice; and using procurement, customer standards and light-touch support to raise baseline capability across SMEs and supply chains.
Morris said: “The country already has many of the right ingredients: stronger official attention, useful governance tools, visible pipeline programmes and a growing recognition that cyber is a leadership issue as well as a technical one. The task now is to join these elements up more clearly, strengthen pathways and progression, and ensure that capability is built across the economy rather than concentrated in too few places.”
Justin Madgwick, global chief executive of recruitment company RGH, which sponsored the report, said: “The CSBR report rightly highlights that the UK’s cyber challenge is not simply a shortage of people; it’s a shortage of visibility into capability, potential and workforce readiness.
“Organisations often know who holds cyber qualifications, but they have far less insight into the behavioural, cognitive and transferable skills that determine whether someone can succeed, adapt and progress in increasingly complex cyber environments.
He added: “The recommendations outlined by The CSBR provide an important framework for doing exactly that, and we welcome the focus on building sustainable capability rather than simply increasing compliance.”
Image credit: Thapana_Studio – Shutterstock
Read next: Trenchless sewer laid beneath Italian railway and river
Are you a building professional? Sign up for a FREE MEMBERSHIP to upload news stories, post job vacancies, and connect with colleagues on our secure social feed.
