South Africa’s cybersecurity challenges are growing more complex as the country struggles to fill the roles needed to address them. A 2024 CSIR national survey found that 63% of cybersecurity positions in South African organisations were partially or fully unfilled. The survey also found that more than a third of applicants had less than 25% of the qualifications required for the positions they applied for, while only 4% had 75% to 100% of the required qualifications.
The shortage of cybersecurity specialists is therefore not simply about the number of people entering the field. It is also about whether they have the combination of technical knowledge and practical capability that the workplace increasingly demands.
This requirement is becoming more important as AI reshapes the threat landscape with increasingly legitimate messaging and more sophisticated methods of breaching security measures. Cybersecurity professionals need to stay ahead of the curve when it comes to understanding how AI-enabled attacks work as well as how AI-supported technologies can be used to identify and respond to them.
This requires more than familiarity with cybersecurity tools. While professionals need subject mastery, they also need analytical thinking, curiosity, problem-solving skills, and the ability to understand how technology interacts with systems, people, and business priorities.
In practice, a cybersecurity professional must be able to distinguish a genuine threat from a false alarm, assess which systems are most exposed, and decide when to escalate an incident. These decisions require technical knowledge, judgement, and experience. Without opportunities to practise them, graduates may understand cybersecurity principles but struggle to apply them when an organisation needs a response.
Employers are already highlighting this broader skills requirement. 2025 research by the South African Graduate Employers Association found that, alongside increasing demand for technically literate graduates, employers continue to identify resilience, communication skills, and a willingness to keep learning as important attributes.
For cybersecurity in particular, the ability to keep learning is critical. The technologies being protected are changing, the methods used to attack them are evolving, and the skills required to defend them cannot remain static. A qualification provides an important foundation, but it cannot be the endpoint of professional development.
This is where closer collaboration between tertiary institutions and industry becomes essential. Work-integrated learning, internships, supervised projects, and mentorships can give students exposure to the realities of cybersecurity operations before they enter full-time employment.
The relationship should work in both directions. Industry can communicate the technologies, capabilities, and workplace behaviours it needs, while tertiary institutions can use this insight to continually refine curricula and learning activities. And this practical learning does not necessarily mean putting students into live organisational environments. Virtual laboratories, controlled testing environments, and simulated cyber incidents can allow them to practise without exposing real systems to risk.
Industry-aligned micro credentials provide another layer of specialisation alongside formal qualifications, helping students and working professionals keep pace as technologies evolve.
The goal should ultimately be a more continuous relationship between education and employment, rather than a handover that happens on graduation day. Employers need access to emerging talent and a stronger pipeline of relevant skills. Institutions need current insight into what the industry requires. Students need opportunities to test and develop their knowledge in realistic contexts.
AI is raising the stakes, but it is also clarifying the direction of the solution. South Africa needs cybersecurity professionals who can understand technology, interrogate problems, make sound decisions under pressure, and continue learning as the threat landscape changes.
Strengthening the connection between tertiary education and industry will be critical to developing these capabilities. Preparing the next generation of cyber defenders means more than equipping them with the knowledge to understand the threat. They also need the practical experience and adaptability to respond to whatever comes next.
