The number is still on the slide. The organization that produced it last published it in October 2024, and dropped it entirely the following year, and almost nobody quoting it has noticed.
Its publisher quietly retired the metric in December 2025. The figure has outlived the study that produced it.
This is the fact that decides the score, and it has been public since December 2025.
On December 4, 2025, ISC2 published its 2025 Cybersecurity Workforce Study, based on a record 16,029 respondents. It contains no global workforce gap estimate. ISC2 says respondents in both 2024 and 2025 consistently ranked specific skills needs above headcount, and that recognizing and addressing skills shortages now matters more than adding people. The share reporting critical or significant skills needs rose from 44% in 2024 to 59% in 2025.
So the organization that produced 4.8 million looked at a larger sample the following year and chose not to publish a gap figure at all. The only body that ever calculated the metric has retired it.
A claim whose publisher has stopped standing behind it is, under our replication component, a top-band case. That single fact is what puts this edition in the Unsupported band, scoring the top band on both Replication and Drift.
Even in 2024 it was not measuring what people think it measured.
The 2024 study reported 5.5 million people working in cybersecurity worldwide and a gap of 4.8 million. The gap was not derived from postings, requisitions, or vacancies. It came from asking practitioners and decision-makers how many cybersecurity people their organization needed compared with how many it had, layered onto workforce baselines from the OECD and the Bureau of Labor Statistics.
That is a legitimate measurement of perceived need, and it tells you something real about pressure and risk appetite. No budget ever existed behind 4.8 million positions.
ISC2's own write-up of those figures is unusually candid about their precision. It describes the 0.1% workforce change as negligible given the tolerances of survey figures, and then says plainly that treating the numbers as exact takes a bit of artistic license. We are quoting that caveat because most people who cite the 4.8 million never see it, and because our own first draft of this edition leaned on the same figures without it.
The obvious argument here is a bad one, and it is worth showing why.
The tempting move is to point out that the gap grew 19% in a year while the workforce grew 0.1%, and to call that a ratio. It is not a meaningful one. The gap is a residual and the workforce is a stock, and the growth rate of a residual divided by the growth rate of a stock produces a number with no interpretation. It is also arithmetically 190, not 19, which is a good sign that anyone reaching for it has not checked it.
The source does the honest version in absolute terms: net intake of roughly 5,500 people against a stated need that rose by close to a million. Stated as absolutes, it is still a striking result, and it still points to sentiment rather than scarcity. It just does not need dressing up.
We are including this because a publication that scores other people's reasoning should show its own discarded arguments, not only the ones that survived.
There is a figure built on observed employer behavior. It has a date, and the date matters.
CyberSeek, funded through the National Initiative for Cybersecurity Education at NIST, counts cybersecurity job listings employers actually posted. In its June 2025 update it recorded 514,359 US listings over the preceding twelve months, up by nearly 57,000 or about 12%, with roughly 74 workers available for every 100 openings.
That figure is now over a year old and the live heat map has moved since. Anyone putting it in a deck should take the current number from the source rather than from this edition, and should date it on the slide. We are stating that explicitly because an undated statistic pointed in a direction newer data may contradict is the precise failure this publication exists to name, and we came close to committing it here.
The two numbers were never in conflict, and they were never replications of each other either. Perceived need and posted listings are different objects measured by different methods. That is why the replication component scores on whether anyone reproduced the finding, not on whether some other number exists.
Strip the retired headline and there is research underneath worth reading.
The skills finding is the strong one and it is almost entirely absent from how the study gets cited. Fifty-nine percent reporting critical or significant skills needs, up from forty-four, is a specific, actionable, well-sampled result from 16,029 people.
The retention picture also holds. A workforce that is roughly flat because intake and departure are close to balanced reframes the problem from recruiting to keeping people, which a leader can act on this quarter without hiring anyone.
Both of those survive scrutiny. Neither of them needs 4.8 million.
We are telling you in advance what evidence would move this score.
A gap figure derived from posted requisitions rather than surveyed intent, or the publisher resuming the metric with a stated method, would move this well down the scale.
Five components, twenty points each. Higher means more hype risk.
The score above is the council's. Five models from five laboratories read the fetched text of the sources listed below, score the claim against the same published rubric independently, then review each other anonymised. Each edition is scored three times, because one run is a sample of size one, and the five component scores are the median of those runs.
| Model | Score | Verdict | In one line |
|---|---|---|---|
| GPT-5.6 | 85 | Unsupported | The supplied evidence does not support 4.8 million worldwide open cybersecurity positions; it supports only reported staffing-resource and skills needs measured differently. |
| Claude Opus 4.8 | 56 | Half True | The circulating 4.8 million 'unfilled jobs' figure does not appear in the provided 2025 ISC2 study, which has explicitly pivoted from headcount shortage to a skills-needs framing. |
| Grok 4.5 | 86 | Unsupported | The circulating 4.8 million unfilled-jobs figure has no supporting number in the supplied 2025 ISC2 materials, which dropped gap estimates entirely. |
| Sonar Pro | 78 | Overstated | This claim sits in the half-true/overstated zone: a real cybersecurity workforce shortage is supported, but the widely repeated 4.8 million 'unfilled jobs' figure is not substantiated by the primary evidence provided here. |
| DeepSeek | 76 | Overstated | The claim of 4.8 million unfilled cybersecurity jobs is unsupported by the provided evidence and appears to be significantly exaggerated. |
This claim sits in the half-true/overstated zone: a real cybersecurity workforce shortage is supported, but the widely repeated 4.8 million 'unfilled jobs' figure is not substantiated by the primary evidence provided here.
The 4.8 million figure comes from an earlier ISC2 gap estimate not included here, so scoring it as unsupported may reflect missing evidence rather than a genuinely baseless claim.
The 2026 edition of this study, expected around December 2026, will again contain no global workforce gap estimate, and the 4.8 million figure will still be in circulation as though it did.
July 26, 2026. Source quality lowered from 15 to 13. The 15 to 17 band is for research with no disclosed methodology, and the 2024 study disclosed its own. Total moved from 81 to 79 and the verdict from Unsupported to Overstated, at the top of that band. The withdrawal of the metric is still scored at the top band on both Replication and Drift, where it belongs.
July 26, 2026. Three fixes after review. The lede said the metric had been dropped nineteen months ago, which matched no date on the page; it was last published October 23, 2024 and omitted from the December 4, 2025 study. One sentence still argued for the pre-correction verdict and has been rewritten. Sample and method moved from 12 to 15, because the rubric puts a modeled estimate presented as a measurement at 15 to 17 and that is what the gap figure is. Total moved from 79 to 82, which returns the verdict to Unsupported.
July 26, 2026. A second sentence still described the pre-correction verdict, saying this edition sat at the top of the Overstated band. The verdict is Unsupported at 82. Corrected. This is the second time residue from that rescore survived a pass, which is the argument for logging changes rather than trusting a reread.
July 26, 2026. Sourcing corrected against our own verification rule. The 4.8 million gap, the 5.5 million workforce and the 0.1% growth figure were cited to an ISC2 commentary article rather than to the 2024 study where they originate. The study is now linked as the primary and the commentary is labelled secondary, which is where the artistic-licence quotation actually comes from. No score changed.
The Hype Index, August 4, 2026. “There are 4.8 million unfilled cybersecurity jobs worldwide.” scored 76/100, Overstated. Primary source: 2025 ISC2 Cybersecurity Workforce Study, ISC2, December 4, 2025. Scored by a council of five models, median of 3 runs, range 6; published by Mark Lynd. https://thehypeindex.com/edition/48-million-unfilled-cybersecurity-jobs/
| Claim | Verdict | Index | Call resolves |
|---|---|---|---|
| Security keys stop 100% of phishing. August 6, 2026 |
Half True | 43● | January 2027 |
| There are 4.8 million unfilled cybersecurity jobs worldwide. August 4, 2026 |
Overstated | 76● | January 2027 |
| There is a plastic spoon's worth of microplastic in your brain, and it is causing dementia. July 30, 2026 |
Half True | 53 | January 2027 |
| Superhero movies are dead. July 28, 2026 |
Half True | 50 | January 2027 |
| 95% of enterprise AI pilots fail. July 21, 2026 |
Half True | 53● | July 2027 |
Tuesday and Thursday at 1:00 PM Central. Every call is dated and graded in public, including the ones we get wrong.
One email, one scored claim, no pitch. We never sell or share your address.