European boards are backing cybersecurity in principle, but ISACA's 2026 State of Cyber report finds the organisations they run still cannot hire or hold on to the people to deliver it. The report draws on 494 European respondents among 1,888 cybersecurity professionals surveyed worldwide in May 2026.
On priorities the news is better than last year. Some 77% say their cybersecurity strategy is aligned with organisational objectives, up from 72% in 2025, 56% believe their board has prioritised cybersecurity adequately and 42% expect budgets to rise over the next 12 months.
Retention is the problem. Some 57% report difficulty holding on to skilled cybersecurity staff, up five percentage points on a year earlier. High work stress is the most common reason for leaving (52%), followed by limited promotion and development opportunities (50%) and poor financial incentives (49%). More than a quarter (26%) think roles are more stressful than five years ago because of hiring and retention pressure.
Hiring is slow too. Some 46% say an entry-level post takes three to six months to fill, and 30% say non-entry-level roles take more than six months. Incident response is the biggest training gap for staff with under three years of experience, named by 55%.
Chris Dimitriadis, ISACA's Chief Global Strategy Officer, said: "As AI infiltrates every aspect of the cybersecurity domain, so the cybersecurity profession is changing." Recognition of cybersecurity's importance, he argued, is not enough on its own, and boards need to turn their priorities into funding to attract, hire, train and upskill staff, or teams will be left overworked and unable to protect against attacks.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
