Cyber hires take six months to ramp up, survey finds

What the survey found

New cybersecurity hires take far longer to become fully productive than their employers want. In a survey of 202 North American security and IT leaders, 57% said a new hire takes six months to reach full productivity. About two in three said three months would be acceptable, so most teams live with a gap of at least a quarter between the plan and the result.

The same leaders worry about what happens to skills over that time. 39% named skills decay as a significant concern, rising to 60% at companies with more than 50,000 employees. The drag is not mainly about tools: general IT knowledge (55%) and security processes (50%) were rated the biggest causes of delay.

Where the figures come from

The numbers come from the 2026 Micro-Training Survey Report, published on 29 September by the training firm SkillBit with CyberBay and Bellini Capital. HR Dive reported the findings under the headline that long onboarding can cause skill decay. SecureWorld's write-up adds the breakdown of delay causes and notes that more than 88% of respondents work at organisations with over 1,000 staff.

Read the survey with its source in mind. A company that sells short, frequent training guided the questions, and its recommended fix is short, frequent training. The figures are what leaders reported, not measured ramp-up times, but the pattern is consistent enough to plan around.

What it does and does not say about the wait before day one

The survey measures the time from a hire's start to full productivity. It does not measure the gap between an accepted offer and the first day, so it cannot tell you how many skills a candidate loses while waiting for a start date. That question is still worth asking, because the clock in this survey only starts on day one.

What it does show is a long window in which a seat is filled on the organisation chart but the work is not yet covered. For a security team under pressure, every week added before the start or during ramp-up extends that window. A slow hiring process and a slow first quarter stack on top of each other.

Why it matters for security roles

Security work changes quickly, which is why leaders link slow onboarding to decay. A person who spends months learning internal systems may find that the threats and tools they trained on have moved on. The report's answer is ongoing practice: 71% of leaders said they would rather run weekly 20-minute sessions than 30 to 40 hours of training once or twice a year.

Hiring makes the problem harder to fix. 70% of organisations said they have few or no roles for candidates with under two years of experience, so most teams compete for the same experienced people. When those hires then take six months to settle, the shortage feels even sharper.

One step to take with your agency

Since the main causes of delay are general IT knowledge and security processes, make them part of the brief. Ask your agency to test candidates on those fundamentals, not only on familiarity with the tools your team happens to use. A hire who already understands networking basics and incident procedures has less ground to cover after the start.

Then agree a short pre-start plan with the agency and the candidate:

• Fix the start date as soon as the offer is accepted and keep the notice period in view.
• Send access requests, hardware and accounts through before day one so the first week is not spent waiting.
• Share a written outline of your main systems and incident processes that the new hire can read in advance.
• Set a check-in at the end of month three against the three-month target most leaders consider acceptable.

None of this removes the learning curve. It does mean the six-month figure is a warning you can act on before the hire begins, rather than a surprise in the second quarter of the job.