Cybersecurity human resource drought
According to the National Cyber Security Association (NCA), Vietnam currently has about 56,000 cybersecurity experts, while market demand is up to 700,000 people, meaning that this sector is lacking more than 600,000 skilled workers, creating a huge job space in the coming years.
According to the global security company Kaspersky, Vietnam as well as some countries in the Asia-Pacific region (APAC) are facing a serious shortage of high-quality cybersecurity personnel. According to surveys, the rate of businesses facing a shortage of specialized information technology (IT) security personnel ranges from 34% in Singapore to 57% in Vietnam.
The shortage of cybersecurity personnel along with the explosion of AI (artificial intelligence), makes Vietnam face many risks of cyberattacks. In 2025, the whole country recorded about 552,000 cyberattacks, down 19.4% in number but increased risks with 52.3% of organizations damaged, according to NCA. According to Kaspersky, Vietnam is among the 12 countries most targeted by cyberattacks in the world.
Solving the human resource problem
The high demand for human resources for network security makes this industry a "hot" choice for many students. According to Mr. Pham Thai Son - Director of the Admissions and Communication Center of Ho Chi Minh City University of Industry and Trade, in the recent enrollment round, the school recorded 4,495 applications for the information technology industry.
In Ho Chi Minh City, there are about more than 15 formal cybersecurity personnel training institutions (usually enrolled under the name of cybersecurity or information security majors). This is not a low number, as the number of graduates each year is not small. However, it is another matter for these personnel to be able to immediately meet the job in reality.
Talking to Lao Dong Newspaper, Ms. Nguyen Thi Quynh Anh, former Marketing Director of VinCSS Network Security Services Joint Stock Company, emphasized the lack of "combat" of students when they graduate, even though businesses are lacking people, leading to a mismatch between the trained capacity and the capacity that the market needs.
An important reason is that we still often talk about "cybersecurity human resources" as if this is a unique profession. In fact, cybersecurity monitoring, cloud security, risk and compliance management, intrusion testing, digital investigation or data protection are career directions with very different requirements.
These positions can share a knowledge base, but do not have the same tasks and output standards. When schools train according to a broad framework, businesses recruit with long technology lists, and candidates accumulate disjointed certificates, all three parties are likely to fall into a situation where they talk about cybersecurity but do not have a common picture of the job," Ms. Quynh Anh shared.
In addition, the training program is difficult to keep up with the pace of technological changes and attack methods.
According to her, it would be unfair to attribute all responsibility to the school or students. Businesses cannot expect a new graduate to immediately have the level of autonomy of personnel who have been operating the system for many years.
The solution, according to this cybersecurity expert, is that there needs to be a well-designed transition mechanism between lecture halls and businesses. Students are facilitated with paid internships, business semesters, a shared cybersecurity drill environment, instructors and evaluation standards for each role.
For small and medium-sized enterprises, the solution is not necessarily that each unit must build a full network security team. Ho Chi Minh City and associations can promote shared network security monitoring centers or industry-specific network security service models, and at the same time train an internal focal point at each enterprise.
To solve the paradox of cybersecurity human resources, it is not possible to only require students to be "more combative" or schools to "teach more closely to reality". It is necessary to simultaneously change the training method, recruitment method, how to create experience and how to retain people.
The ultimate measure is not how many more graduates there are, but how many more people can take on the job, grow up in the profession and continue to contribute to the ecosystem," Ms. Quynh Anh concluded.
