A Longitudinal Review on the State of Cybersecurity 2022-2025: Workforce, Governance, Risk, and Operational Maturity, and findings from ISACA Global Surveys

Aim: This study examines the structural evolution of the cybersecurity profession between 2022 and 2025, a period marked by fiscal constraint, workforce ageing, and escalating operational and threat complexity. Methods: The study adopts a longitudinal qualitative synthesis methodology, integrating four consecutive annual survey cycles into a unified analytical dataset. The reports incorporate responses from approximately 10,000 cybersecurity professionals worldwide. Rather than treating each survey as an isolated snapshot, the analysis evaluates directional trends over time. Organizational effectiveness is examined through reported measures of workforce adequacy, board-level prioritization, engagement in risk management practices, confidence in cybersecurity budgets, and perceived operational strain. Results: Across the review period, a persistent majority of organizations report cybersecurity understaffing, with minimal measurable improvement. Board-level prioritization remains largely unchanged, reported by slightly more than half of respondents. Notably, confidence in cybersecurity budget allocation declines sharply after 2023, reflecting tightening financial conditions. Although the adoption of automation and AI-enabled tools increases steadily, these technological advancements do not meaningfully reduce workload intensity, operational stress, or perceived burnout among practitioners. The findings indicate that structural workforce limitations and governance capacity constraints increasingly define cybersecurity maturity more than incremental technical enhancements. Conclusion: The period from 2022 to 2025 represents a structural inflection point for the cybersecurity profession. Recommendation: Organizations should prioritize sustainable workforce development strategies, strengthen governance integration at the board level, and align budget planning with long-term risk exposure.