Nearly every security team says it’s short on skills. What has changed is where the shortages sit: in the same two areas attackers are moving fastest.
Barracuda’s Cybersecurity Skills Gap Report 2026, released Oct. 21, surveyed 2,000 mid- to senior-level IT and security decision-makers at organizations with 100 to 2,000 employees in the U.S., Europe, Australia, India and Japan. Ninety-four percent report skills gaps. The most common involve AI-related risks (68%), such as responding to AI-generated, highly targeted phishing, and advanced identity and phishing threats (67%), including business email compromise, OAuth abuse and multifactor authentication bypass.
That’s the midmarket many MSPs serve. Read with a service catalog in hand, the report is a list of work those customers will have trouble staffing on their own.
Demand is outrunning capacity
Half of respondents say security is expected to support new and expanding digital operations without additional resources. Forty percent say business expectations exceed their team’s skills and tooling, and 35% say expectations exceed staffing capacity. Overall, 67% say their security teams are under pressure and struggling to scale, and 32% say they can only secure the business reactively.
The report describes a loop most MSPs will recognize from onboarding calls. More systems and identities need protecting, visibility is fragmented across tools, the team spends its days on incidents, and the time left for prevention and training keeps shrinking.
Respondents don’t think more headcount alone breaks that loop. Asked what would help most, they put better visibility across identity, email, applications, networks, data, cloud and endpoints first (33%), followed closely by AI-assisted detection and investigation tools they can trust (32%). That’s an argument for selling outcomes rather than hours: consolidated visibility, managed detection and a response the customer doesn’t have to staff at 2 a.m.
AI is thinning the bench
The report’s most uncomfortable finding is about people. Seventy-nine percent say AI is already affecting security roles or headcount, and 56% report workforce reductions linked to AI, split evenly between entry-level and more senior roles.
Yet the gaps respondents describe are mostly ones AI doesn’t close on its own. Thirty-five percent lack expertise in incident response speed and decision-making under pressure. Thirty-two percent struggle to translate technical risk into business impact. And 38% say they lack the skills to secure and govern the AI tools their own business uses, a figure that rises to almost half among senior IT leaders.
Barracuda warns that cutting entry-level roles without new development paths could deepen the advanced skills shortage, because those roles are where future investigators and incident leaders learn the job. MSPs should take that warning personally. Many run the same pipeline, from help desk to Tier 1 SOC analyst to incident lead. If AI absorbs the Tier 1 work, junior technicians need another way to build judgment: shadowing live incidents, running tabletop exercises and reviewing why an AI-generated recommendation was accepted or overruled.
Siroui Mushegian, Barracuda’s CIO, made the same point in the announcement: “We must nurture these critical skills in the next generation of cybersecurity professionals, building new development pathways and opportunities for hands-on experience.”
Humans still make the call
The survey also shows how organizations want people and AI to share incident response. Sixty-nine percent use a shared model in which AI helps process information, investigate and recommend, while people keep responsibility for context, judgment and final decisions. For 41%, AI recommends and people decide. For another 28%, human responders lead the investigation with AI support.
A shared model only works with written rules. The report recommends spelling out what AI may recommend, what it may do automatically, when a person must approve an action and who stays accountable. Managed Services Journal looked at that question in “When security agents agree, who approves the response?” For an MSP, those answers belong in the service agreement, not just the runbook.
Where MSPs fit
Map the findings to services customers will need help with:
- AI security and governance. The 38% who can’t govern the AI tools their business uses need an inventory, a usage policy and ongoing monitoring. Managed Services Journal covered how to add AI governance to a vCISO service.
- Identity and email threat response. The 67% gap in identity and phishing skills covers exactly the attacks that slip past filters: business email compromise, malicious OAuth grants and MFA bypass. Detection is only half the service; containment and account recovery are the other half.
- Readiness across the incident lifecycle. When asked which activities are hardest to staff, respondents spread their answers across detection, response, continuity, recovery and governance. Tabletop exercises, recovery testing and post-incident reviews fill gaps an internal team rarely has time for.
- Translating risk for leadership. The 32% who struggle to explain technical risk in business terms are describing the quarterly business review an MSP or vCISO should already be running.
Barracuda’s report concludes that the security function of the future will depend on combining AI-enabled scale with human judgment, broad visibility and clear accountability. Few organizations with 100 to 2,000 employees can build all of that alone. That’s the opening for MSPs, provided they’ve solved the same problem inside their own shops first.
