Bridging the Gaps in the Cybersecurity Talent Pipeline

Cybersecurity attacks are evolving at rapid speed, and the U.S. lacks sufficient professionals to address them. Research firm Cybersecurity Ventures estimates that there are nearly 500,000 cybersecurity vacancies in the United States in 2025, including IT technicians and security analysts, leaving the country vulnerable to ransomware, data breaches, and IT disruptions.

Virginia is leading efforts to address the country’s talent gap. The Commonwealth has the second-largest cyber workforce in the U.S., with demand continuing to grow. Between September 2023 and August 2024, Virginia employers sought to fill 51,005 cybersecurity jobs, and that number is only expected to rise, according to CyberSeek.

To meet the demand, Virginia is scaling up a broad array of initiatives to develop and expand its cybersecurity workforce. Through a combination of government-funded internships, apprenticeships, and university and nonprofit-led workforce development programs, the Commonwealth is strategically investing in cultivating the next generation of cybersecurity professionals to meet regional and national security needs, ensuring that no Virginian is left behind.

“The Virginia Information Technologies Agency team thwarts over 106 million cyberattack attempts each year. That’s 3.36 attacks every second,” said Chief Information Officer of the Commonwealth Robert Osmond, referring to a state agency that protects Virginia’s cybersecurity. “We must have great talent dedicated to keeping us safe in today’s cyber risk environment.”

Filling Critical Roles 

Addressing the cybersecurity talent gap is critical to Virginia’s economy. In 2023, the U.S. cybersecurity market was valued at $67.69 billion and is projected to grow to $135.34 billion by 2030, according to Grand View Research. Cyber risks are top of mind for companies because they can be costly to resolve, according to the Allianz Risk Barometer, and federal contracts are awarded to firms with strong cybersecurity measures.

Mitigating potential threats to the Commonwealth’s public and private sectors requires a steady pipeline of skilled professionals, particularly as AI and machine learning continue to gain prominence. Job training programs are the key to building that.

Workforce development is a key component of the Commonwealth Cyber Initiative (CCI), a state-funded program that invests in fostering Virginia’s cyber talent. Nearly 50 higher education institutions, in partnership with companies and local governments, participate in CCI, offering internships, apprenticeships, and hands-on learning experiences to hundreds of students annually across the Commonwealth.

In 2023 alone, CCI supported 863 jobs, adding $97 million to Virginia’s GDP. Between 2020 and 2024, CCI awarded 36 proposals for experiential learning programs totaling $3.9 million. One such program is “Cyber Startups,” which places students in Northern Virginia-based tech startups as paid interns. CCI covers the costs, enabling startups to offer students valuable professional exposure without straining their limited resources. Another program is “Cyber as a Service,” where students deliver penetration testing, cyber risk analysis, and other security services to small businesses, nonprofits, and local governments around their universities.

CCI also runs project-based learning programs. Paid micro-internships are offered to college students during the school year. For 8–10 hours a week, students work with companies on cybersecurity case studies. One Microsoft-sponsored project involved students learning how to assess digital vulnerabilities using a Flipper Zero hardware exploration device. Additional projects from GuidePoint Security and PBS are planned for 2025.

“We have placed such a high value on entry-level job seekers having some kind of experience,” said Sarah Hayes, CCI’s director of workforce development. “Opportunities that provide that experience are incredibly impactful and need to be scaled.”

Internships Foster Cyber Talent 

Outside of CCI, Virginia’s universities are bolstering efforts to help students secure entry-level cybersecurity roles. Old Dominion University (ODU), for example, aims to ensure that all students complete an internship before graduation. Through its internship coordinator, ODU’s School of Cybersecurity helps connect and prepare students for internships in the federal government, private industry, and local companies. In the last two years, 260 cybersecurity students have completed internships.

To expand its offerings, ODU has partnered with employers to create in-house internships. Collaborations include a partnership with the National Security Agency, providing students 12-week summer internships at the agency, and a partnership with the Virginia Space Grant Consortium to subsidize internships offered in the surrounding area. The university also operates the Cybersecurity Clinic, a 15-week semester-long program where students evaluate cyber risks for small businesses, nonprofits, and local governments based in Coastal Virginia.

“Our school has been growing rapidly,” said Daniel Takabi, professor and director of ODU’s School of Cybersecurity and CCI’s Coastal Virginia Node director. Undergrad enrollment in the department, he added, was close to 1,400 as of fall 2024, with an overall enrollment of roughly 1,650 students. “You can imagine we need a lot of internships to support our students.”

However, not everyone has the resources to pursue a bachelor’s or master’s degree. As salaries stagnate and inflation rises, residents may be feeling the squeeze, especially those from lower-income communities and families.

For those unable to pursue traditional degrees, Virginia’s community colleges offer affordable alternatives. Community colleges including Blue Ridge near Harrisonburg, Germanna near Fredericksburg, and Virginia Western in Roanoke provide short cybersecurity certificate programs designed for entry-level roles. Others like Northern Virginia Community College offer two-year associate degrees taught by expert faculty that explore a broader range of security topics.

The Cyber Bytes Foundation in Stafford County offers numerous training programs for students to obtain industry-recognized cybersecurity certifications. Its outreach programs engage children as young as 6 in cybersecurity and other STEM fields.

Alternative Pathways

Beyond schools, nonprofits are stepping in to bring cybersecurity training to their communities. For example, the Cyber Bytes Foundation in Stafford County provides a more affordable, flexible alternative to traditional degree programs, breaking down barriers to entry in the sector.

“College is not for everybody, and we’re able to give people a path into cyber that does not include higher institutes of education,” said Nancy Pattillo, the foundation’s director of operations. “It’s creating more opportunities, and we make sure we go into underserved and underrepresented communities.”

The Cyber Bytes Academy, part of the Cyber Bytes Foundation, offers courses leading to industry-recognized certifications like CompTIA A+ for IT support. The academy also provides cybersecurity boot camps and employee training services for businesses, ensuring community members can upskill, stay competitive, and be employable by companies in the area. As of January 2025, more than 3,000 students have received training and education.

Cyber Bytes engages youth through its Cyber Titans programs, which introduce children as young as 6 to STEM and cybersecurity via hands-on projects. Its summer camps allow teens ages 13 to 18 to explore technology by building drones, 3D printers, and computers, fostering early interest in STEM careers.

Virginia’s wide array of workforce development programs demonstrates the Commonwealth’s commitment to leading the nation in cybersecurity. These initiatives not only address the widening talent gap, but also ensure a robust pipeline of skilled professionals for the future.

As Osmond said, “Growing the cyber workforce with students and young professionals will help Virginia attract new companies and investments and continue to stay at the forefront of innovation in cybersecurity.”