Training closes the cybersecurity skills gap when it is tied to defined work roles, delivered to the people you already employ, and practised on real systems. Hiring alone cannot fill every opening. Define what each role must do, teach it in small steps, test the skill, and give people time to use it.
What is the gap, really?
Headlines count unfilled jobs. For one organization, the gap is narrower: the distance between the tasks your systems need done and what your people can do today. Writing that down is the first step, and it is cheaper than a recruiting campaign.
NIST maintains the NICE Framework, a common vocabulary for describing cybersecurity work. Using it, or a similar role list, lets you say "we need someone who can triage vulnerability findings and write a fix" and not "we need a security person." Specific roles lead to specific training.
Who should be trained?
Developers, platform engineers, IT administrators and analysts all do security work, whatever their title. A constructed example: a company has two security staff and sixty engineers. Hiring four more security people would be slow and expensive. Teaching twenty engineers to read dependency findings, write safe input handling, and review infrastructure code for exposed storage changes more of the real outcomes.
That does not make dedicated specialists unnecessary. It means the specialists spend time on the hard problems because routine ones are handled where code is written.
What makes training work?
Practice beats lectures. A short session explaining injection followed by a hands-on exercise where the learner fixes a vulnerable function in a sandbox lasts longer than an hour of slides.
Timing matters. Training delivered when someone first meets a topic, such as the week they join the payments team, is retained better than an annual marathon.
Relevance matters too. A developer working in Python gains more from examples in Python than from generic advice, and a finance team gains more from invoice fraud scenarios than from malware trivia.
Assess skills, not attendance. A completion certificate shows someone clicked through. A scenario they must solve shows whether they can do the task. Measure outcomes you care about: time to fix a finding, share of pull requests passing security checks on first review, phishing reports per month.
What about people entering the field?
Lower the barrier with structure. Apprenticeship-style paths pair a newcomer with a mentor on real tickets. Rotations let IT staff try detection work or application security for a quarter. Clear written role descriptions let career changers see what skills to build.
Hiring can include exercises that reflect the job, such as reading a log excerpt and explaining what happened, instead of trivia questions.
How do you keep skills current?
Threats and tools change, so build a rhythm: a monthly session on a recent incident, a quarterly exercise where a team handles a simulated event, and a yearly review of the role list. Capture lessons from real incidents as short internal write-ups. They teach better than generic material because they happened on your systems.
How to check or apply this
- List ten security tasks your organization needs done and who does each today.
- Map those tasks to roles, using the NICE Framework or an internal list.
- Find tasks with no owner or one overworked owner.
- Choose one gap and train existing staff with a hands-on module, in their language and tools.
- Test the skill with a scenario, and record the result.
- Give protected time, a mentor, and a real task to apply it within a month.
- Review outcomes quarterly and adjust.
Where does Safeguard fit?
Safeguard's findings come with context and fix suggestions inside the places developers already work, such as the IDE and pull requests, which turns each finding into a small lesson. It does not replace a training program.
Quick check
Is annual compliance training enough?
Rarely. It satisfies a checkbox. Skills grow from regular, role-specific practice, ideally on the systems and languages people use every day.
Can you close the gap by hiring alone?
Seldom. Hiring helps, but many of the needed tasks sit with existing engineers and administrators, so training them often yields faster results.
Sources
- NIST, NICE Framework Resource Center
- NIST, National Initiative for Cybersecurity Education
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 18 October 2026.
