Ada Lovelace Day will bring out the figure on women in cyber security again. A less quoted number, about entry-level jobs, says more about whether that figure can change.
Of the UK cyber security job adverts that said how much experience they wanted in 2025, 16% asked for less than a year. In 2022 the figure was 25%. The government’s annual study of the cyber labour market, published by the Department for Science, Innovation and Technology (DSIT) on 29 September, also counts the adverts themselves. On that measure, demand for entry and early-stage roles is now at half the 2022 level.
Ada Lovelace Day falls on 13 October, and the same report carries the figure most people will reach for. Women make up 16% of the UK cyber security workforce, against 48% of the UK workforce as a whole, and 12% of senior roles. I wrote in August about the business case for closing tech’s gender gap and will not repeat it. My argument this time is narrower. Most efforts to change who works in cyber security aim at the point of entry, and the point of entry is shrinking.
What the 2026 report shows
DSIT’s study, carried out by Ipsos and Perspective Economics, combines an employer survey with an analysis of online job adverts. The adverts tell the clearest story. There were 34,932 adverts for core cyber security roles in 2025, up 7% on 2024. Across the longer run, between 2022 and 2025, core adverts fell by 51%.
The fall was uneven. Adverts for roles asking for less than two years’ experience fell by 53% over that period, while those asking for six to nine years fell by 23%. The report says the overall decline was “primarily driven by a reduction in entry and early-stage roles”.
One caveat matters. More than 70% of adverts do not say clearly how much experience they want, so the 16% is a share of the adverts that do. That is still a large sample of the market, but the direction deserves more weight than the exact figure.
The supply of people has not shrunk to match. Among those who graduated in cyber security in the 2022/23 academic year, 11% were unemployed, against 6% across all graduates. People interviewed for the study described the entry-level market as saturated, and one employer thought a single LinkedIn advert had brought in about 1,300 CVs in its first week. The interviews are not representative, and the report says so, but they fit the numbers.
Apprenticeships, often offered as the alternative route, are moving the same way. Starts in cyber security apprenticeships in England fell 15% in 2024/25, from 590 to 500.
Why the entry level decides representation
The workforce figures come from a survey of cyber firms with modest sample sizes, and DSIT says plainly: “We do not expect to find statistically significant differences over time in these estimates given sample size limitations.” So these figures cannot show women’s share of the workforce falling. They can show where women are better represented than they are in the workforce.
Women were 14% of cyber security undergraduates and 28% of postgraduates in 2023/24, although most postgraduates in cyber security and computer science come from outside the UK. Across all digital apprenticeships in England, women made up 40% of starts in 2024/25; the report gives no figure for cyber apprenticeships alone. Among postgraduates and digital apprentices, women are a larger share than they are of the cyber workforce, and most of those people will need a first cyber job with little or no experience behind it.
That is an inference, and I want to be clear about it. The report does not break entry-level hiring down by gender. But if the routes where women are better represented lead to the first rung, a first rung half the size it was in 2022 makes the 16% harder to move.
The same reasoning applies beyond gender. The report puts people from ethnic minorities at 19% of the cyber workforce and 9% of senior roles. Any group that is under-represented in senior roles today needs a way in that does not start at three years’ experience.
The counterpoint: fewer juniors may be a rational choice
The strongest case against my argument is that employers are acting sensibly. A junior takes time from senior staff who are already stretched. Some of the work that used to train people is being automated, and first-line triage in a security operations centre is the obvious example. One employer in the study said “so much of a SOC is being replaced with AI”. Total demand has also fallen, so a smaller entry level may simply be part of a smaller market.
DSIT has dropped the workforce gap estimate that earlier editions carried, partly because demand has fallen. I take that seriously. This year’s report gives no figure for how many cyber professionals the UK is short of, and I will not supply one.
My answer is that a smaller market still depends on a pipeline. Every senior practitioner started somewhere. An employer that hires only people with three years’ experience is relying on someone else to have trained them, and if every employer does the same, the experienced pool stops refilling. One year of data cannot prove that will happen. A trend running from 2022 to 2025 is long enough to plan for.
What an employer can do this year
The useful question for any organisation with a security function is simple: when did you last hire someone into security with less than a year’s experience, and what would it take to do it again?
In England, the cost side of that question changed this summer. Under the apprenticeship funding rules for 2026 to 2027, the government funds all training and assessment costs, up to the funding band maximum, for apprentices aged 16 to 24 at employers that do not pay the apprenticeship levy. For apprentices aged 25 and over, those employers pay 5% for new starts from 1 August 2026. Levy payers who run out of funds in their account pay 25% for apprentices aged 25 and over; for those aged 16 to 24, the government funds the training in full. For apprenticeships starting from 1 October 2026, employers that do not pay the levy can also claim a £2,000 hiring payment for an apprentice aged 16 to 24, paid in two instalments. I wrote in August about the arrival of the Growth and Skills Levy, and these are the first rule changes that affect a cyber hire directly.
Two apprenticeship standards cover cyber security roles. The Level 3 Cyber Security Technician has a maximum government funding amount of £11,000 and a typical duration of 18 months. The Level 4 Cyber Security Technologist has a maximum of £18,000 and a typical duration of 24 months. Those amounts are what the government will fund for the training. Wages are separate.
Apprenticeships are one route. Of the cyber firms in the study that had vacancies since January 2024, 65% said they had hired through non-degree routes. The adverts point the other way: in DSIT’s analysis of job adverts, 77% of employers required at least a bachelor’s degree, or equivalent, for a core cyber role, and only 12% of roles were open to applicants with GCSE, A level or foundation-level education. If a role can be done well by someone without a degree, saying so in the advert widens the field before the first CV arrives.
The other route runs inside the organisation. Service desk and infrastructure staff already know the systems a security team protects. Moving one of them into security, with a fundamentals certification as a first step and supervised work after it, creates an entry-level role without an external hire.
The case stands without a diversity programme behind it. What it takes is a decision that next year’s security hiring plan includes one role at the bottom of the ladder.
This article is commentary on published statistics and guidance, not financial or legal advice. Apprenticeship funding rules apply in England; Scotland, Wales and Northern Ireland run their own systems. Check the current rules on gov.uk before acting. Sources checked on 7 October 2026.
Sources
- DSIT, Cyber security skills in the UK labour market 2026, published 29 September 2026 (survey fieldwork 8 August to 27 October 2025; job adverts 2022 to 2025): https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2026/cyber-security-skills-in-the-uk-labour-market-2026
- DSIT, Cyber security skills in the UK labour market 2026, full report (PDF): https://assets.publishing.service.gov.uk/media/6ab66822a9c3d267bcccef1d/Cyber_security_skills_in_the_UK_labour_market_2026.pdf
- Department for Education, Apprenticeship funding rules: summary of changes (version 3, updated 3 August 2026): https://www.gov.uk/government/publications/apprenticeship-funding-rules-and-assessment-plan-guidance-2026-to-2027/apprenticeship-funding-rules-summary-of-changes-version-1
- Department for Education, Find apprenticeship training: Cyber security technologist (2021), Level 4: https://findapprenticeshiptraining.apprenticeships.education.gov.uk/courses/619
- Department for Education, Find apprenticeship training: Cyber security technician, Level 3: https://findapprenticeshiptraining.apprenticeships.education.gov.uk/courses/559
- Finding Ada, When is Ada Lovelace Day?: https://findingada.com/about/when-is-ald/