Setting: The Distant Present

An acute crisis ends. A chronic one just stops being news.

The fever broke, and the headlines moved on. The mass layoffs of 2022 and 2023 thinned to a steadier drip, the quarterly bloodletting stopped leading the news, and the assumption took hold that the worst was behind. The headline numbers have since done their best to confirm it. The economy added 172,000 jobs in May, more than double what forecasters expected, with the two months before it revised upward, and unemployment held at 4.3 percent, where it has sat for the better part of a year. A person reading only the top line would conclude the patient had recovered.

The patient has not recovered. It has stabilized, which is not the same thing. The top-line market is creating jobs again. What has not come back is the movement underneath it, the turnover that lets a person change jobs or land a first one. Long COVID is the name for an aftermath in which the acute crisis passes, the ordinary chart can read as reassuring, and a low, persistent dysfunction settles in that routine measures often miss. The labor market cyber workers occupy has that quality. The surface reads as health. The layer that carries people from one job to the next does not.

Turnover is where the trouble shows. The unemployment rate has held steady, but the churn beneath it has not recovered. Gross hiring, the rate at which employers bring people on, has stayed weak for more than a year, at levels the country normally sees only in a downturn. Quits have held near two percent, down from the three percent peak of the Great Resignation, because a person quits only when there is somewhere to go. Layoffs have sat near record lows the whole time. Economists call the pattern low-hire, low-fire: employers are not letting people go, and they are not taking anyone on. The result is steady if you have a job and very hard to escape if you have lost one. The clearest sign is at the exit. The share of the unemployed who have been out of work for six months or longer has climbed past 27 percent, up from about 20 percent a year ago. Few people are being pushed out. The ones already out are staying out.

That national calm is least reliable for the people most likely to be reading this. Cybersecurity is not a sector. Its workers sit across the whole economy, as much inside banks and hospitals and government as inside technology firms, and the headline numbers blend them into a single figure. The closest available proxy is the information sector, which holds much of technology, and it has not been calm. Its layoff rate has risen over the past year from 1.3 to 2.4 percent, the largest increase of any sector and close to five times the average rise across the economy. The technology labor market that sets much of cyber's pay, mobility, and expectations has been cut harder than the country it sits inside. A cyber professional who feels less secure than the headlines promise has read them correctly. The headlines are averages, and they are not weighted toward people like them.

The national story is mostly about movement, about people who hold jobs and are not leaving them. Cyber's version of the problem is about getting in, and getting back in. The field has not stopped declaring a shortage, sized by the additional people organizations say they need to defend themselves rather than by a tally of open jobs. That claim sits beside a hiring market that has gone quiet. Security postings in the United States, though still above their pre-pandemic level, run about 36 percent below their 2022 peak. Only about one cybersecurity employer in six is hiring at the entry level, and demand for junior people has fallen by roughly eight percent in two years. A field that says it is short of people is, at the same time, declining to hire.

The contradiction shrinks once the shortage stops being read as a simple head count. Part of it is budget. Part of it is specialization, a scramble for narrow skills, in AI governance and cloud security, that barely appeared on a job description five years ago. And part of it is older still: the field's habit of treating a prior job as the only trustworthy proof that a person can do the work. Employers appear to be covering much of the gap by stretching the teams they have and leaning on outside help where budgets allow, rather than opening the door to anyone new.

This is a failure of what James Scott called legibility, the ability of a system in charge to read what it must act on, the way a state reads a society or an employer reads a workforce. A market that cannot read capability is what the failure looks like once the cheap money is gone. It does not explain why hiring slowed across the economy; rates and caution and uncertainty did that. It explains how the slowdown lands inside cyber. When hiring was a low-stakes bet in a hot market, an employer could be wrong cheaply, and the usual proxies were good enough to wave a candidate through. Now every hire is a costly bet in an uncertain economy, and an employer who cannot measure capability does the rational thing with a wager he cannot read: he refuses it, or he demands so much proof of the past that only someone who has already held the identical job can supply it. The slowdown is general. The way it punishes entrants, career-changers, and anyone without exact prior-role evidence is sharper in a field that never built a way to see capability directly.

The slowdown bites hardest at the entrance. When experienced people lose their jobs, many apply downward to survive, and the effect on the bottom rung is predictable: they take the openings newcomers were counting on, and the newcomers are pushed off the ladder. The result is a queue at the entrance that no stack of certifications can clear. The shortage at the top and the glut at the bottom are the same blindness seen from two ends. An employer who cannot read capability falls back on the safest signal available, someone who has already done the exact job, and so the field declines to make anyone it has not already made.

And the longer a person is out, the harder the door becomes to reopen. The clearest evidence for the mechanism comes from another market and an earlier downturn. Researchers sent thousands of otherwise identical resumes to real openings, varying only how long the applicant had been unemployed. Callbacks fell sharply with the length of the gap, most of the drop arriving within the first eight months. When employers cannot observe what a candidate can do, they read the gap itself as a signal and act on it. Past a certain length, the absence becomes its own explanation, taken as proof of a flaw no record shows. The study watched early-career applicants, the population a field fills its entry rung with when it fills it with career-changers. For them, time out of work is the part of the competence problem that compounds.

The other change has stopped being argued about at all. The return to the office, fought bitterly two years ago, is now the unremarkable condition of most corporate work, defended by no one and rescinded by no one, the clawback hardened into the furniture.

None of this is a demand problem the field can wait out. A loosening of budgets may bring some openings back, and the May figures may yet be the first of them. It will not, on its own, reopen the entrance or solve the older problem, because money was never the only thing in the way. The field never built a reliable way to tell who is good, and a careful market has stopped forgiving the lack. The shortage will go on being declared, and the door will go on being harder than it should be, until capability can be shown without a prior job to vouch for it.

A field that cannot count the competence of its own people tends to carry the same blind spot toward its own risk. It counts what is easy to count, and what is easy to count is rarely what matters most.

Skill:Signal:Trust is the daily newsletter of Aramis, which assesses cybersecurity candidates against the NIST NICE Framework, an attempt to measure capability where the field has learned to settle for proxies.

Source notes

The May 2026 jobs report: U.S. Bureau of Labor Statistics, Employment Situation for May 2026 (released June 5, 2026), for 172,000 payrolls added, unemployment steady at 4.3 percent, and combined upward revisions of about 93,000 to March and April. Contemporaneous economist surveys, including the Dow Jones consensus, put expectations near 80,000. The share of unemployed workers out of work 27 weeks or longer rose to about 27.5 percent, up from about 20.4 percent a year earlier, per Indeed Hiring Lab's analysis of the May BLS release.

The "low-hire, low-fire" labor market: BLS Job Openings and Labor Turnover Survey through April 2026, as analyzed by Indeed Hiring Lab, KPMG, CNBC, and others. A layoff rate near 1.1 percent has held for well over a year (close to a record low); a quits rate near 2 percent, down from the 3 percent peak of late 2021; and a gross hires rate that has stayed weak by historical standards even as net payroll growth resumed. Job openings fell through 2025 to multi-year lows before rebounding in April 2026 to roughly 7.6 million, the highest since May 2024, even as hiring stayed soft, which is why the argument here rests on hiring and turnover rather than openings.

The technology exception: Indeed Hiring Lab's March 2026 JOLTS analysis, for the information sector's layoff rate rising over the past year from 1.3 to 2.4 percent (an increase of about 1.1 points) against a US average that rose from 1.0 to 1.2 percent (about 0.2 points), which is the basis for the "close to five times the average rise" comparison, and the largest such increase of any sector. The information sector is an imperfect proxy for cybersecurity, whose workers are spread across many industries.

Legibility: the concept of legibility, a system's capacity to read and so act on what it governs, is from James C. Scott, Seeing Like a State (Yale University Press, 1998). Its application to hiring, where an employer who cannot read capability falls back on proxies, is adapted here, as it was in Monday's edition.

Security postings and wages: Indeed Hiring Lab's security-postings and security-wage tracking, for US security postings running about 36 percent below their 2022 peak while still above pre-pandemic, and for security wage growth easing from about 12 percent above pre-pandemic in early 2022 to about 2 percent.

Entry-level conditions: cyber graduate-employment data indicating that only about 17 percent of cybersecurity employers were recruiting at the entry level and that demand for junior candidates had fallen roughly 8 percent in two years.

Negative duration dependence: Kory Kroft, Fabian Lange, and Matthew Notowidigdo, "Duration Dependence and Labor Market Conditions," Quarterly Journal of Economics (2013), and NBER Working Paper 18387. The authors sent roughly 12,000 fictitious resumes to about 3,000 real job postings across the 100 largest US metropolitan areas, varying the length of the applicant's unemployment spell; callbacks fell sharply with that length, most of the decline within the first eight months. The study was set in an earlier downturn and centered on early-career applicants to sales, clerical, and administrative roles rather than cybersecurity; it is used here for its mechanism, that employers read an unemployment spell as a signal of unobserved productivity, not for a magnitude transferable to the present cyber market.