The Cybersecurity Hiring Gap: What a Small Business Can Do Instead of Waiting for a Hire

Updated October 2026 to our current guidance. The original reporting date is unchanged.

The question usually shows up after a form does. A bigger customer sends a security questionnaire, or the insurer’s renewal asks about two-step sign-in and backups, and someone says, “Should we hire a security person?”

It is a sensible question. You have IT handled, updates run, and it has mostly worked. Now somebody wants proof, and a dedicated hire sounds like the way to get it.

Then you try to hire.

The numbers

ISC2’s 2024 Cybersecurity Workforce Study put the worldwide gap at about 4.8 million unfilled security roles. KORE1’s 2026 staffing data has security salaries rising 7 to 10 percent a year. A 20-person machine shop is competing for the same people as banks, defense contractors, and the big tech companies, and those employers can pay more and offer more.

So the search takes months, and the person you hire may get a better offer a year later.

Why training your own is slow

Hiring someone bright and training them is a reasonable plan with two catches. It takes years to build real depth in security. And once someone has that depth, other employers notice. In my experience, plenty of small businesses have trained a good person only to lose them to a bigger paycheck.

None of that makes training a bad idea. It just means it can’t be the whole plan for this year.

What the job actually covers in a smaller business

Here is the part that changes the math. A 10–50 person business rarely needs a full-time security specialist. It needs a short list of things done reliably, and somebody accountable for each:

• Knowing what is installed on every computer, and whether it is current
• Getting security updates in on a schedule, including for programs Windows Update doesn’t touch
• Backups that have been restored at least once, so you know they work
• Two-step sign-in on email, remote access, and anything holding money or customer data
• Someone watching for problems, and a plan for the day something goes wrong
• Records that show all of the above when a customer or insurer asks

That list is about keeping the business running and being able to prove it. Most of it is routine work.

Realistic options

Use an outside provider

A managed IT or security provider gives you a team’s depth without a hire. Ask exactly what is included, especially whether third-party programs are updated and how fast, and ask for the records they keep. You want those records in your hands when the questionnaire arrives.

Combine an outside provider with someone inside

Pick a technically minded employee and pair them with an outside provider. The provider brings the depth; your employee handles the day-to-day and learns on the job. You get coverage now and build knowledge over time.

Automate the routine

Plenty of the list can run on its own: automatic updates where they exist, email filtering, scheduled backups, and two-step sign-in prompts. Automation needs someone to check that it is still working, so it lowers the workload without removing the need for a person.

A five-step plan you can start this week

1. Write down what you actually need. Use the list above. Mark which items are done, which are half done, and which nobody owns.
2. Find out where your computers stand. This is the one most people skip, so here is how to do it. Before you look, guess how many programs are on one of your computers and write it down. Then count.

Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.

If more programs need updating than you guessed, that is common. Windows Update never touches third-party software, and in most offices nobody was asked to watch the rest. You don’t have to be able to do this. We’ll do it with you.
3. Compare the real costs. Put a full-time salary, benefits, tools, and training next to quotes from two or three outside providers, for the same list of work.
4. Do the quick wins now. Turn on two-step sign-in company-wide, test a restore from backup, and turn on automatic updates everywhere they exist.
5. Pick a path and commit. An outside provider, a combination, or building your own team. Any of them beats waiting for the perfect candidate.

If you run the scan and never speak to us again, that’s a fine outcome.

The short version

A hard-to-fill job doesn’t have to leave a gap in the meantime. Most of what a smaller business needs is a known list of routine work, done on a schedule, with records. Count what is on your computers, decide who owns each item, and you will have an answer ready the next time someone asks you to prove it.