Constructing the Cyber Workforce Gap

Published open access in the Journal of Cybersecurity Education, Research and Practice, 2026(1), Article 41. https://doi.org/10.62915/2472-2707.1340

Abstract

Cyber workforce-gap figures steer federal strategy, industry advocacy, and the growth of educational programs. Rather than estimating the U.S. gap, this review examines how the estimates are made: through job-posting analytics, survey-based estimation, and federal accounting, each of which must assume its way from instrument to labor market. A census of this journal’s complete run illustrates what those figures underwrite in one venue: of 176 items published across eleven years, 51 invoke a labor-market workforce claim, 46 treat it as settled fact, and only one, an editorial, interrogates it. Meanwhile, the producers and auditors of those figures have diverged. Between September 2025 and March 2026, the GAO found the federal government’s own workforce data unreliable, ISC2 declined to publish its global gap estimate, and SANS reweighted its framing from headcount to skills, while CyberSeek, the instrument with the largest policy footprint, left standing the rising count it had released in June 2025. An advertisement and a vacancy are different measurement objects, a flow and a stock, and the discourse’s headline claims require the second while the instruments count the first. Transferring the two-decade STEM-shortage critique, the review advances the hypothesis that the gap is better understood as distributional and hiring-process phenomena than as a stock deficit of workers, names the threat in measurement terms as consequential validity, and offers the Workforce-Claim Diagnostic Framework (WCDF), a typology of construction patterns paired with a four-part evidentiary standard, so workforce claims can be vetted before they become curricula and policy.