The cybersecurity workforce gap runs into the hundreds of thousands of unfilled positions, and traditional hiring alone isn’t closing it fast enough. Crowdsourced security research offers a different model: instead of hiring a fixed internal team, organizations tap into a distributed network of independent researchers as needed. It’s not a complete substitute for in-house talent, but as a workforce strategy, it addresses a specific part of the shortage that conventional hiring struggles with.
Can Crowdsourced Security Testing Solve the Cybersecurity Skills Shortage?
Not entirely, and it’s worth being upfront about that rather than overselling the model. Crowdsourced research works well for surge capacity, specialized skill sets an organization doesn’t need full-time, and testing that benefits from diverse perspectives rather than one internal team’s fixed approach. It doesn’t replace the need for dedicated internal security staff who understand an organization’s specific environment over time.
Synack’s red team and penetration testing services illustrate how this access-based model works in practice: a vetted network of researchers, paired with platform tooling, gives organizations testing capacity they can draw on without carrying the full cost of building that capability internally from scratch. It’s a workforce access strategy as much as a testing product, which matters most given the scale of the hiring gap.
Join The European Business Briefing
New subscribers this quarter are entered into a draw to win a Rolex Submariner. Join 40,000+ founders, investors and executives who read EBM every day.
SubscribeThis kind of model helps most with access. A traditional hiring process competes for a narrow pool of specialized talent in a tight labor market and often takes months to fill a single role. A crowdsourced model instead draws from a much larger pool of vetted researchers across multiple organizations, shifting the constraint from “can we hire this specific skill set” to “can we access it when we need it.”
How Large Is the Actual Workforce Gap?
ISC2’s 2025 Cybersecurity Workforce Study provides the most current sizing of this gap, tracking the difference between the number of cybersecurity professionals organizations need and the number currently employed across the industry. The study has become the standard annual reference for this figure precisely because it surveys practitioners directly rather than relying on job posting counts, which tend to overstate real demand.
That gap isn’t evenly distributed either. Specialized roles, including offensive security and penetration testing specifically, tend to face tighter competition than generalist security positions, since the skill takes years to develop and the pool of qualified candidates is smaller to begin with.
Where Does This Talent Pressure Show Up Most in Hiring?
The pressure isn’t limited to cybersecurity roles specifically. It’s part of a broader shift in how employers approach hiring during a talent crunch, and looking at that wider pattern helps explain why crowdsourcing has gained traction as an alternative.
European Business Magazine’s coverage of employers becoming more open to hiring inexperienced coders documents this exact dynamic in the adjacent software development field, where employers facing similar hiring pressure are loosening experience requirements rather than waiting for the ideal candidate to appear. Cybersecurity faces a version of the same pressure, though the specialized, high-stakes nature of the work makes “hire someone less experienced and train them up” a slower and riskier path than it is in general software development.
That contrast is instructive. Where software teams can often lower the experience bar and absorb the ramp-up cost, security teams working with sensitive systems have less room to do the same, which is part of why an access-based model like crowdsourcing has become a more attractive lever than simply loosening hiring criteria.
What Are the Honest Limits of a Crowdsourced Model?
A few limitations are worth naming plainly, since a workforce model that claims to solve the shortage outright wouldn’t hold up to scrutiny:
- Crowdsourced researchers don’t build the same institutional knowledge of an organization’s environment that a long-tenured internal employee accumulates
- Coordination and vetting still require internal staff, so the model reduces hiring pressure without eliminating the need for a security function altogether
- Not every organization’s compliance or risk posture is comfortable with external researchers accessing sensitive systems, even vetted ones
- Quality and consistency depend on how the network is managed, which varies meaningfully between providers
None of these limitations make the model ineffective. They define where it fits best: filling capacity and specialized skill gaps rather than replacing the core internal team an organization still needs.
What’s the Realistic Way to Weigh This Against Traditional Hiring?
For organizations weighing this against traditional hiring, the realistic approach is treating it as a complement rather than a replacement, using external capacity to close specific gaps while still investing in the internal team that carries institutional knowledge forward over time.
That balance looks different depending on organization size and risk tolerance, but the core logic holds broadly: crowdsourcing widens access to specialized skills during a genuine shortage, while the harder-to-replace parts of a security function- the people who know a specific environment deeply- still need to be built and retained internally.
FAQ
Can crowdsourced security testing solve the cybersecurity skills shortage?
Not entirely on its own. It helps close specific gaps around surge capacity and specialized skills, but organizations still need internal security staff who understand their own environment. It’s best understood as a complement to hiring, not a full replacement.
How big is the cybersecurity workforce gap?
Industry surveys put the gap in the hundreds of thousands of unfilled positions globally, based on the difference between the workforce organizations say they need and the number of professionals currently employed in the field.
What are the risks of relying on crowdsourced security researchers?
The main tradeoffs are limited institutional knowledge of a specific environment, ongoing internal coordination needs, and compliance concerns around external access to sensitive systems, along with variation in quality depending on how the researcher network is managed.
Why is crowdsourcing gaining traction now specifically?
The scale of the workforce gap has made traditional hiring alone insufficient for many organizations, and a distributed, on-demand model offers a way to access specialized skills without competing directly in a tight labor market for full-time hires.
