Breaking News
Tracy
Tracy
Nov 13 2026
6Global cybersecurity company Kaspersky has found that Asia-Pacific's cybersecurity training investments are failing to keep pace with the region's rapidly evolving threat landscape.
According to the latest global study conducted by Kaspersky’s Internal Research Center, despite 81% of APAC organizations increasing their IT security budgets, 42% still report significantly understaffed cybersecurity teams and nearly half of hiring managers say the gap between certifications and practical skills remains their single biggest challenge.
Moreover, the global IT training market was worth $82.4 billion in 2025, and yet as much as 70% of workers say they lack the skills needed to do their jobs. In APAC, the biggest hard skills shortfalls in the region are in systems programming (62%), framework knowledge (61%) and network technologies (46%), while soft skills gaps center on analytical thinking (48%), problem-solving (43%) and teamwork (41%). The industry isn’t undertrained, it is trained, systematically, expensively, and at scale.
The certification gap is real, and costly
The cybersecurity training market is not short of product. Certifications, online courses, bootcamps, vendor programs and university degrees compete for the attention of security professionals at every stage of their careers.
In APAC, nearly half of hiring managers (49.2%) cite the discrepancy between certifications and practical skills as their single biggest hiring challenge, which means that for roughly one in two employers in the region, the credential is a hiring filter rather than a reliable performance predictor.
The consequences show up in onboarding. Kaspersky research found that 71.4% of APAC hiring managers say it takes three to nine months to bring an entry-level hire to the point where they can handle tasks independently, with 42.3% saying three to six months and a further 29.1% saying six to nine months, even after hiring certified candidates. The credential is clearing the interview, but it is not producing day-one capability.
The retention problem compounds this further. Among APAC cybersecurity professionals, 62.7% cite lack of growth opportunities as a reason they would consider leaving their current organization, while 51% flag limited opportunity to work with the latest tools and technologies. The region is not just struggling to hire — it is struggling to keep the talent it has already invested in developing.
Even if certifications better reflected practical skills, there would still be a second, compounding failure – the knowledge they certify decays faster than curricula can update. In APAC, 48.1% of organizations report that people tend to forget what they learned about information security if there is no practical implementation, while a further 48.1% say there is a lack of courses covering new and challenging cybersecurity spheres. And 38.1% say the training programs available are too theoretical and offer limited practical application. Fixed curricula reviewed on annual cycles and delivered through passive instruction simply cannot keep pace with a threat environment that updates continuously.
What should trainings look like to close the gap?
Closing the gap requires organizations to ask harder questions, not just whether staff have been trained but whether they have been trained in the right discipline, using formats that match the pace of threat evolution, toward skills that will still be relevant in 18 months, and sufficiently grounded in practice to produce day-one capability.
It also requires evaluation frameworks rigorous enough to distinguish genuine competence from completed coursework, and professionals themselves need to invest the time in knowing which direction they are developing toward before committing to the path.
The good news is that both the organizational intent and the personal commitment are already there. A new global survey by Kaspersky found that 78% of APAC organizations plan to enhance their IT security function in the coming year, above the global average of 75%, with Vietnam (89%), Indonesia (85%) and Malaysia (82%) leading the charge. At the individual level, 44% of APAC cybersecurity professionals say they are willing to pay for upskilling courses out of their own pocket. These are not passive learners waiting to be told what to do. They are professionals who want to grow, but who need a clearer map of where to direct that investment.
Kaspersky’s Cyber Pathways addresses this gap directly. It is a career orientation tool designed to help security professionals and those entering the field identify which InfoSec specialization aligns with their aptitudes and interests, before they begin building toward it.
In a region where the intent to invest is strong but the structure to support it is still catching up, knowing which direction to head is not a trivial question, and getting it wrong is expensive for both the individual and the employer. Projects like Kaspersky's Cyber Pathways can help professionals and organizations get it right.
