Table of Contents
- Skills shortage or organisation?
- Specialists and daily rates
- The limits of productivity
- What this means for your career
- Conclusion
Who would you hire? An expert with 25 years of professional experience – or someone with five years of experience and extensive AI expertise?
This was the question recruitment consultant Frank Rechsteiner put to the audience at it-sa Expo&Congress in Nuremberg. By his count, around 80 hands went up in favour of the second candidate.
Not a representative poll, but a telling snapshot of the mood: Is AI changing the value of professional experience? Or did his keynote have a certain nudging effect on the audience?
That was precisely the subject of his keynote on the Career Stage in Knowledge Forum D: AI is rewriting the rules of the labour market, he argued, and seniority needs to be reassessed because younger candidates can now deliver comparable results with the help of AI.
See the session Cybersecurity Job Market 2027 – AI Is Rewriting the Rules.
Rechsteiner then joined experts from IT security, academia, software development and recruitment for a discussion on the implications for the labour market. The full line-up is listed in the session Cybersecurity Workforce 2027 – Skills Shortage or AI Transformation?.
Skills shortage – or an organisational problem?
Rechsteiner's thesis was provocative: “We don't have a skills shortage. We have a productivity problem.” According to Bitkom, the number of vacant IT positions in Germany has indeed fallen from 149,000 in 2023 to 79,000 in 2026.
However, these figures alone do not establish whether AI is responsible. The weak economy and subdued investment are also likely to have played a role. Furthermore, the figures cover the entire IT labour market, not cybersecurity specifically.
For Rechsteiner, the real problem lies elsewhere anyway: companies are focusing too much on AI models and too little on their organisational structures. His experience, including in the US, has shown him that leadership, processes and collaboration need to change first. Only then should companies consider which technology is right for them.
His thought experiment: What if ten employees could deliver the output of 100 with the help of AI? That would not necessarily mean companies had to cut jobs. They could also retrain their employees for new tasks and achieve substantial growth.
However, this productivity-driven optimism met with reservations during the subsequent discussion. Education and expertise remain essential – because who will oversee AI if no one invests in understanding the fundamentals anymore?
Udo Schneider, Governance, Risk & Compliance Lead Europe at Trend Micro, warned of a development that can easily be overlooked in debates about efficiency: if AI takes over routine tasks, newcomers may lose their entry point into more demanding work.
(Editor's note: Which routine tasks AI actually takes on in the Security Operations Centre – and where its limits lie – is explored in the session AI Meets the SOC: How Artificial Intelligence Is Transforming Cyber Defense at it-sa Expo&Congress 2026.)
This is particularly problematic in IT security. Anyone expected to assess complex incidents and take responsibility for decisions later in their career must first gain hands-on experience themselves.
If these learning opportunities are automated away, where will the next generation of experts come from? Schneider summed it up: “I think we're currently destroying our own talent pipeline.”
(Editor's note: Read also the interview AI Is Changing the Balance of Power in Cybersecurity, in which Schneider assesses the role of AI in cyber defence more broadly.)
Prof. Dr Jens Kohler from Worms University of Applied Sciences is familiar with this problem from his teaching. His students are allowed to use AI for programming assignments. But if their programmes work without their authors understanding what is happening under the hood, little has been gained.
Kohler observes something similar with academic dissertations. AI-generated texts often seem interchangeable. He would rather see students produce original work, even if it contains mistakes.
After all, specialist knowledge, critical thinking and the ability to evaluate results do not develop simply by having ready-made solutions delivered to you.
Marco Thomas offered a practical perspective. The young software developer, who completed his master's degree this year, says that at IT security company genua he primarily uses AI to explain complex technical concepts and relationships.
When it comes to actual software development, however, he relies on his own understanding of the systems. Simply adopting an AI-generated solution only to discover a bug months later is not a viable approach for him.
So the issue is not just which tasks AI could potentially take over. It is also about which tasks people must continue to master themselves in order to assess AI-generated results reliably. How many people with that level of expertise will ultimately be needed? That remains the intriguing question.
For more on how AI is reshaping both attack and defence, see the topic page Artificial Intelligence & IT Security.
Specialists remain in demand – and can command high daily rates
Benjamin Walker, Managing Director of recruitment agency Nemensis, which places IT and cybersecurity freelancers among others, is also observing changes in the labour market. Demand for traditional programming tasks is declining in Germany's project market.
Cybersecurity specialists and experts in particularly sought-after technologies, on the other hand, remain in high demand. Professionals with deep niche expertise, especially when combined with technologies closely associated with AI, can command high fees.
In response to a question from the audience, Walker cited daily rates of €1,500 to €2,000 or more for certain specialisations. These are not general market rates, however. Fees depend heavily on the technology in question and the specific level of demand.
He also noted another difference compared with previous years: many project enquiries no longer explicitly mention AI skills at all. Familiarity with the relevant tools is increasingly taken for granted.
Walker urged the panel to embrace the transformation. Companies that categorically refuse to use AI must expect their competitors to take advantage of its potential. For freelancers, the key is to specialise and apply their skills across a range of different projects.
Greater productivity – but at what cost?
The discussion was not just about future jobs, but also about the limits of productivity. Kohler questioned whether ever-smaller teams could really continue delivering ever-greater output over the long term.
What happens if a system fails or a cyberattack occurs? Who absorbs the additional workload? An organisation geared towards maximum efficiency could also become more vulnerable as a result.
Rechsteiner reiterated his position that AI should not simply accelerate existing processes. Companies need to fundamentally rethink how they organise work. Managers should spend less time monitoring employees and focus more on results, trust and their teams' capabilities.
Schneider, meanwhile, criticised what he sees as excessive caution towards new technologies. In Germany in particular, AI projects are sometimes rejected prematurely, without their potential being seriously examined.
Legal and security-related constraints must, of course, be respected. But not every objection necessarily represents a genuine obstacle.
The balancing act became clear: failing to use AI can become a competitive risk. But using it uncritically can be just as risky.
What does this mean for your own career?
The closing Q&A addressed a practical question: what should early-career professionals and experienced specialists do now to remain in demand in the labour market?
Schneider advised people to focus on subjects they are genuinely interested in. Only then will they have the motivation to acquire even complex specialist knowledge. Walker recommended developing a clear specialisation while remaining willing to apply one's skills across different projects.
Thomas emphasised a different point: what matters is not mastering a particular programming language, but being able to solve problems. This requires specialist knowledge and an understanding of the value and benefits one's own work creates.
Older employees were also part of the discussion. One visitor asked how long-serving employees could be introduced to AI and whether there were any KPIs for measuring this. In his response, Rechsteiner once again argued that willingness to learn should not depend on age. He had had positive experiences with employees over 55 or 60.
When it comes to job hunting, the panellists also recommended making one's skills visible and maintaining personal contacts. Kohler pointed out that interesting positions are not always publicly advertised.
Rechsteiner advised applicants to focus less on presenting themselves through a conventional CV and more on demonstrating the tangible value they can bring to a company.
How AI is changing the application process from the other side is shown in the article Beating 261 competitors: landing a new job with a false identity.
Want to exchange ideas with cybersecurity professionals about career paths, qualifications and the use of AI? The it-sa 365 Community connects you all year round with experts from IT security, academia and recruitment – through profile search, matchmaking and direct contact. Become a user!
Professional experience or AI skills? Both.
The final discussion made one thing clear: human expertise remains essential when automated results are wrong, systems fail or decisions have to be made under time pressure.
Simply resting on seniority and knowledge acquired in the past will no longer be enough. Those who know how to work with AI are likely to come out on top – although only time will tell whether such assurances were merely an attempt to allay concerns.
