The number is still on the slide. The organization that produced it last published it in October 2024, and dropped it entirely the following year, and almost nobody quoting it has noticed.
Its publisher quietly retired the metric in December 2025. The figure has outlived the study that produced it.
This is the fact that decides the score, and it has been public since December 2025.
On December 4, 2025, ISC2 published its 2025 Cybersecurity Workforce Study, based on a record 16,029 respondents. It contains no global workforce gap estimate. ISC2 says respondents in both 2024 and 2025 consistently ranked specific skills needs above headcount, and that recognizing and addressing skills shortages now matters more than adding people. The share reporting critical or significant skills needs rose from 44% in 2024 to 59% in 2025.
So the organization that produced 4.8 million looked at a larger sample the following year and chose not to publish a gap figure at all. The only body that ever calculated the metric has retired it.
A claim whose publisher has stopped standing behind it is, under our replication component, a top-band case. That single fact is what puts this edition in the Unsupported band, scoring the top band on both Replication and Drift.
Even in 2024 it was not measuring what people think it measured.
The 2024 study reported 5.5 million people working in cybersecurity worldwide and a gap of 4.8 million. The gap was not derived from postings, requisitions, or vacancies. It came from asking practitioners and decision-makers how many cybersecurity people their organization needed compared with how many it had, layered onto workforce baselines from the OECD and the Bureau of Labor Statistics.
That is a legitimate measurement of perceived need, and it tells you something real about pressure and risk appetite. No budget ever existed behind 4.8 million positions.
ISC2's own write-up of those figures is unusually candid about their precision. It describes the 0.1% workforce change as negligible given the tolerances of survey figures, and then says plainly that treating the numbers as exact takes a bit of artistic license. We are quoting that caveat because most people who cite the 4.8 million never see it, and because our own first draft of this edition leaned on the same figures without it.
The obvious argument here is a bad one, and it is worth showing why.
The tempting move is to point out that the gap grew 19% in a year while the workforce grew 0.1%, and to call that a ratio. It is not a meaningful one. The gap is a residual and the workforce is a stock, and the growth rate of a residual divided by the growth rate of a stock produces a number with no interpretation. It is also arithmetically 190, not 19, which is a good sign that anyone reaching for it has not checked it.
The source does the honest version in absolute terms: net intake of roughly 5,500 people against a stated need that rose by close to a million. Stated as absolutes, it is still a striking result, and it still points to sentiment rather than scarcity. It just does not need dressing up.
We are including this because a publication that scores other people's reasoning should show its own discarded arguments, not only the ones that survived.
There is a figure built on observed employer behavior. It has a date, and the date matters.
CyberSeek, funded through the National Initiative for Cybersecurity Education at NIST, counts cybersecurity job listings employers actually posted. In its June 2025 update it recorded 514,359 US listings over the preceding twelve months, up by nearly 57,000 or about 12%, with roughly 74 workers available for every 100 openings.
That figure is now over a year old and the live heat map has moved since. Anyone putting it in a deck should take the current number from the source rather than from this edition, and should date it on the slide. We are stating that explicitly because an undated statistic pointed in a direction newer data may contradict is the precise failure this publication exists to name, and we came close to committing it here.
The two numbers were never in conflict, and they were never replications of each other either. Perceived need and posted listings are different objects measured by different methods. That is why the replication component scores on whether anyone reproduced the finding, not on whether some other number exists.
Strip the retired headline and there is research underneath worth reading.
The skills finding is the strong one and it is almost entirely absent from how the study gets cited. Fifty-nine percent reporting critical or significant skills needs, up from forty-four, is a specific, actionable, well-sampled result from 16,029 people.
The retention picture also holds. A workforce that is roughly flat because intake and departure are close to balanced reframes the problem from recruiting to keeping people, which a leader can act on this quarter without hiring anyone.
Both of those survive scrutiny. Neither of them needs 4.8 million.
We are telling you in advance what evidence would move this score.
A gap figure derived from posted requisitions rather than surveyed intent, or the publisher resuming the metric with a stated method, would move this well down the scale.
Five components, twenty points each. Higher means more hype risk.
The 2026 edition of this study, expected around December 2026, will again contain no global workforce gap estimate, and the 4.8 million figure will still be in circulation as though it did.
July 26, 2026. Source quality lowered from 15 to 13. The 15 to 17 band is for research with no disclosed methodology, and the 2024 study disclosed its own. Total moved from 81 to 79 and the verdict from Unsupported to Overstated, at the top of that band. The withdrawal of the metric is still scored at the top band on both Replication and Drift, where it belongs.
July 26, 2026. Three fixes after review. The lede said the metric had been dropped nineteen months ago, which matched no date on the page; it was last published October 23, 2024 and omitted from the December 4, 2025 study. One sentence still argued for the pre-correction verdict and has been rewritten. Sample and method moved from 12 to 15, because the rubric puts a modeled estimate presented as a measurement at 15 to 17 and that is what the gap figure is. Total moved from 79 to 82, which returns the verdict to Unsupported.
July 26, 2026. A second sentence still described the pre-correction verdict, saying this edition sat at the top of the Overstated band. The verdict is Unsupported at 82. Corrected. This is the second time residue from that rescore survived a pass, which is the argument for logging changes rather than trusting a reread.
July 26, 2026. Sourcing corrected against our own verification rule. The 4.8 million gap, the 5.5 million workforce and the 0.1% growth figure were cited to an ISC2 commentary article rather than to the 2024 study where they originate. The study is now linked as the primary and the commentary is labelled secondary, which is where the artistic-licence quotation actually comes from. No score changed.
The Hype Index, Edition 002, July 28, 2026. “There are 4.8 million unfilled cybersecurity jobs worldwide.” scored 82/100, Unsupported. Primary source: 2025 ISC2 Cybersecurity Workforce Study, ISC2, December 4, 2025. Scored by Mark Lynd. https://thehypeindex.com/edition/002-48-million-unfilled-cybersecurity-jobs/
| No. | Claim | Verdict | Index | Call resolves |
|---|---|---|---|---|
| 003 | Security keys stop 100% of phishing. July 30, 2026 scheduled |
Overstated | 61● | January 2027 |
| 002 | There are 4.8 million unfilled cybersecurity jobs worldwide. July 28, 2026 scheduled |
Unsupported | 82● | January 2027 |
| 001 | 95% of enterprise AI pilots fail. July 21, 2026 |
Overstated | 69● | July 2027 |
Tuesday and Thursday at 1:00 PM Central. Every call is dated and graded in public, including the ones we get wrong.
One email, one scored claim, no pitch. We never sell or share your address. Subscriber figure taken live from our mail provider and last checked July 26, 2026; most of it carried over from the two publications that merged into this one.