The Cybersecurity Market: Demand Exceeds Supply

In a dynamic business environment, cybersecurity is becoming one of the main management priorities. The reliability of digital infrastructure depends on it, and incidents can quickly disrupt operations and cause significant financial losses. The need for qualified specialists is also growing, but the supply cannot keep up with the pace dictated by the market. Experts emphasize that this gap can only be narrowed by training specialists who are capable of solving real technological and business challenges.

Prof. Dr. Dalius Mažeika, Dean of the Faculty of Fundamental Sciences at VILNIUS TECH, says that cybersecurity is now a strategic element of state and business management, and the lack of cybersecurity competencies is considered a national security gap.

“Digital services and infrastructure are the foundation of the modern economy. Critical infrastructure sectors—energy, finance, healthcare, transport—operate on digital platforms, so a successful cyberattack can paralyze state functions faster than a traditional military threat. All this means that cybersecurity competencies are becoming a matter of national security,” he says.

According to the speaker, countries that lack qualified specialists and a mature cyber defense infrastructure are strategically vulnerable to both economic and political pressure.

“We see a clear trend—NATO, the EU, and individual governments treat cyber capabilities in parallel with military capabilities, allocating corresponding budgets to them. And for businesses, cybersecurity is an investment in business continuity and reputation,” the Dean reviews.

Specialists Are Needed Worldwide

Prof. Dr. Nikolajus Goranin, Head of the Department of Information Systems at VILNIUS TECH, says that labor market indicators also signal the importance of cybersecurity. The latest comprehensive public study conducted in 2023, “The Need for ICT Specialists and Labor Market Forecast in Lithuania,” shows that in that year, information and communication technology (ICT) companies had employed 1,378 cybersecurity specialists, and by the end of 2025, it was planned to hire at least 1,720 more.

“This number exceeds the total number of specialists trained by all Lithuanian higher education institutions over 5 years combined. The report emphasizes the need for cybersecurity competencies, which rank fifth in the top ten competencies. This study also showed that the total number of ICT specialists is still below the EU average. It is projected that by 2030, the EU will need a total of 20 million specialists, while currently, only 9.3 million specialists work in the sector,” calculates N. Goranin.

According to him, the recently enacted DORA and NIS2 directives in Europe have had a significant impact on the demand for specialists, requiring companies falling under their regulation to have Chief Information Security Officers (CISOs) and Security Operations Centers (SOCs). Companies that previously paid little attention to cybersecurity are now forced to either hire specialists or purchase these services from third parties.

“In any case, the demand for CISO and SOC specialists in the market is growing. This is confirmed by the university’s social partners, and similar trends prevail throughout Europe and the world. Nevertheless, the unstable economic and political situation is slowing the pace of sector growth and investment,” the professor shares.

Value-Creating Competencies

As the demand for specialists grows, it also becomes clearer what specific competencies the market expects from them.

“In Lithuania, there is currently the greatest shortage of SOC specialists, as well as security managers at various levels. Our social partners identify the ability to manage cybersecurity incidents, expertise in security technologies, and an understanding of the legal and managerial aspects of security assurance as critical competencies,” says N. Goranin.

The dynamics of competencies, according to the speaker, are changing on a global scale.

“According to a report by ISC2, a non-profit organization that trains cybersecurity specialists, artificial intelligence competencies rank first—which were not even mentioned in the European Union Agency for Cybersecurity’s (ENISA) Cybersecurity Skills Framework in 2022. This is followed by competencies in cloud computing security, risk and security management, software security, and GRC (Governance, Risk Management, and Compliance),” the professor notes.

Goranin says that in response to international needs, which will certainly reach Lithuania in the near future, VILNIUS TECH adjusts its study programs annually. This is done by introducing new courses, consistently updating the curriculum, and linking it to the real needs of the sector. For example, since 2022, the Master’s program “Information and IT Security” has included the course “Ethical, Legal, and Human Aspects of Information Security,” which, together with the long-standing course “Information Security Management,” develops security management and GRC competencies. Starting in 2025, the same study program will also feature the course “Applications of Artificial Intelligence in Information Security Technologies.”

“Students also learn about virtual infrastructure and cloud computing security, and SOC competencies can be acquired not only in the Master’s program but also in the security specialization of the Bachelor’s program ‘Information Technology’,” the speaker lists a few examples.

Adapting to the Market

He emphasizes that cybersecurity competencies are developed in several study programs. The broadest spectrum of knowledge is provided by the Master’s program “Information and IT Security” at the VILNIUS TECH Faculty of Fundamental Sciences—it fosters a systemic approach to information security issues, from their prevention to resolution and impact management.

“The studies combine technological, legal, and managerial competencies: from network security, cryptography, or cloud computing to security management, legal aspects, and the fundamentals of scientific research. The program is conducted in Lithuanian and English, and more than half of its foreign graduates stay to work in Lithuania’s IT security sector,” says N. Goranin.

This year, an MBA-type program, “Cybersecurity Management,” emphasizing security management aspects and aimed at experienced specialists, was also introduced. “Bachelor’s level cybersecurity competencies are strengthened in the ‘Information Technology’ and ‘Cybersecurity and Communication Technologies’ programs, which focus on the practical application of technology,” the professor explains.

According to him, VILNIUS TECH updates its curriculum on several levels: new programs are created, existing courses are updated, and final thesis topics are linked to current market and scientific challenges. This ensures that the competencies students acquire meet the real needs of the sector.

Goranin says that students also gain real cybersecurity practice while still studying.

“Students gain practical experience through hands-on assignments integrated into all courses. For example, master’s students in the oldest and most comprehensive program, ‘Information and IT Security’ at the Faculty of Fundamental Sciences, participate in ‘Capture the Flag’ type exercises while studying Ethical Hacking. While studying IT security methods, cloud computing, network security, and similar courses, students get to test various IT security technologies,” the speaker illustrates.

Science, Practice, and Real Solutions

Lectures for VILNIUS TECH students are given not only by practitioner-lecturers but also by business representatives, and the quality and practical value of the studies are enhanced by the university’s Digital Defence Competence Centre. Its director, Vitalijus Gurčinas, explains that the center’s activities are based on scientific research, practical training, and collaboration with business and the public sector. Work here involves cybersecurity technologies, the application of artificial intelligence, digital forensics, threat analysis, and security operations research. The center’s value lies in its ability to turn scientific research into real solutions, and its goal is not only to generate knowledge but also to transform it into tangible solutions that help organizations strengthen their resilience to cyber threats.

“A single project cannot fully represent the center’s activities, as it operates in a multidisciplinary manner and integrates cybersecurity into various areas of the university’s activities and research fields. Today, cybersecurity is not a distant or isolated field—it is an essential component of solutions, technologies, organizations, and society as a whole. The center’s activities include both mission-driven technological and engineering projects and broader societal challenges, including current efforts to combat disinformation and misinformation, which are becoming increasingly important areas of research and societal impact,” states V. Gurčinas.

Students also actively participate in the center’s activities. They get involved in incident simulations, digital forensics investigations, cybersecurity events, and scientific projects. Initiatives like the Google.org cybersecurity seminars provide students with the opportunity to work on real-life situations and strengthen their practical skills.

“By participating in these activities, students gain practical experience, develop analytical and problem-solving skills, and become better prepared for their careers,” says the center’s head.

Mažeika believes that universities play a crucial role in strengthening the country’s level of cyber resilience by training highly qualified specialists and conducting research that becomes the basis for practical application in business and state institutions.

“By collaborating with companies and international partners, universities create an ecosystem for knowledge transfer and innovation,” the Dean emphasizes.

It is also important that the competencies of the Digital Defence Competence Centre are valued internationally—foreign students come to VILNIUS TECH for intensive cybersecurity courses.

Mažeika points out that Lithuania already holds a strong position in the international context—the country is among the leaders in global cybersecurity rankings and actively participates in EU and NATO initiatives. The biggest challenge, in his opinion, remains the shortage of specialists, so the main focus must be on their training and strengthening their competencies.

“Today, cybersecurity competencies are becoming not just a professional but a strategic necessity. The collaboration between universities, business, and the state in this area allows not only to respond to growing threats but also to increase the country’s long-term resilience,” says the professor.