The McKinsey Global Institute's new report, "Workforce in Motion: Skills and Pathways to Future Jobs in the United States," is not a cybersecurity study. It never uses the word "SOC." But read it as a cybersecurity leader and it describes, in remarkable detail, the operating environment your program will have to defend for the next decade: millions of people changing roles, nearly every job being rewritten around AI, and hiring gates that keep qualified people out.
Published on September 29, the 82-page report models U.S. labor demand from 2025 to 2035. Its headline is cautiously optimistic. Its implications for security teams, and the vendors who sell to them, are sharper than they first appear.
McKinsey's base case says automation could absorb about 54% of current U.S. work hours by 2035. But that does not translate one-for-one into job losses. The authors estimate that roughly 60% of that impact gets offset by less overwork, productivity-driven demand, new AI-related tasks, and organizational barriers to displacement. Net result: labor demand falls by about 21% of work hours, equivalent to roughly 36 million jobs, while growth across the economy creates demand for about 41 million.
The harder part is the movement in between.
11 million workers may need to switch occupations entirely (ranging from 6 million to 16 million, depending on how fast automation lands).
That requires about 770,000 cross-occupational moves per year, roughly 3.6 times the historical, non-COVID average of 215,000. The pandemic briefly hit similar levels. The difference is that this would last a decade, not two or three years.
More than 70% of workers could see more than 15% of their task time reallocated, even if they never change jobs.
Only one in seven transitioning workers has a "direct pathway" to a growing job. About 41% face a "winding" path; 45% face an "unpaved" one.
The decline is concentrated. More than three-quarters of displaced workers come from office and administrative support, retail and sales, and transportation and logistics. Customer service representatives top McKinsey's list of the five occupations accounting for a third of transitions.
Here is the finding security leaders should sit with. McKinsey projects automation could take on 70% of the hours currently worked in technology and analytics occupations, second only to office and admin at roughly 80%. Yet the same group is projected to grow by about 800,000 jobs, or 16%, through 2035.
That is the report's central argument in miniature: high automation exposure does not equal job loss. In knowledge-heavy fields, AI changes the work more than it eliminates the worker.
The report also flags how that plays out unevenly. Demand for software developers fell sharply from its 2022 peak, partly from pandemic overhiring and partly from AI automating development tasks. Since early 2025, postings have climbed about 15%, but the gaps are in senior and AI-oriented roles. Anyone who has watched Tier 1 SOC triage get absorbed by automation will recognize the pattern: the top of the ladder gets more valuable while the bottom rungs thin out.
Cybersecurity's own data point the same way. The 2025 ISC2 Cybersecurity Workforce Study, based on more than 16,000 professionals, found that 95% of respondents report at least one skills gap on their teams, and 59% call those gaps critical or significant, up from 44% a year earlier. For the first time, ISC2 declined to publish a global workforce gap number, saying respondents now prioritize specific skills over raw headcount. AI topped the list of needed skills at 41%, followed by cloud security at 36%. Meanwhile, CyberSeek, the NIST- and CompTIA-backed tracker, counted 514,359 U.S. cybersecurity job listings over its latest 12-month reporting period, a 12% increase over the prior period.
Put together: the field is growing, but what it is short on is capability not bodies.
McKinsey wrote the report about labor markets. Translated into security terms, several of its findings land directly on the CISO's desk.
Workforce churn is an identity problem. Hundreds of thousands of people moving between occupations every year, plus most of the remaining workforce having their jobs reshaped, means relentless joiner-mover-leaver activity. Every role change is an opportunity for privilege creep, orphaned accounts, and access nobody remembers granting. Internal mobility, which McKinsey urges companies to build into workforce planning, is good for retention and bad for least privilege unless identity governance keeps pace.
The most disrupted roles sit on the social engineering front line. Customer service reps and office assistants are the occupations most exposed to automation. They are also the help desk and front-office staff attackers impersonate and pressure. As those teams shrink, get reorganized, or hand routine work to AI agents, security teams need to reexamine verification procedures, escalation paths, and who (or what) has authority to reset a password.
"Supervising AI" is now a control. McKinsey's reinvention data show freed-up time flowing into reviewing AI outputs, handling exceptions, quality assurance, and overseeing intelligent systems. Its insurance underwriter example has humans shifting from gathering data to judging AI-generated recommendations. In security terms, that human review layer is a safeguard, and it only works if the people doing it are trained to catch a hallucination, a poisoned input, or an agent acting outside its scope.
New roles are coming that you will have to secure or staff. McKinsey estimates AI could create 500,000 to 2 million jobs in occupations that barely exist today, including agent engineering, workflow design, AI governance, human oversight, and evaluation. The technology economy's physical backbone (data centers, networking, cooling, grid connections) is projected to add about 2 million FTEs. That is more operational technology, more third parties, and more physical infrastructure in scope.
Burnout is a risk factor. The report notes growing jobs demand more judgment and decision-making, raising cognitive load, and cites McKinsey Health Institute research arguing employers, not individuals, must manage it. Security teams already know what an exhausted analyst misses.
The report sorts skills into three buckets. Essential skills (problem solving, communication, detail orientation) appear in more than 75% of occupations and widen your options. Enabling skills (decision making, critical thinking, innovation) cluster in higher-paying roles. Empowering skills help workers keep adapting, and demand for them is surging. Between 2022 and 2026, employer demand for AI fluency rose about 11-fold, adaptability about fivefold, and curiosity, resilience, and willingness to learn roughly threefold.
For practitioners, three takeaways stand out.
AI fluency is table stakes, not a differentiator. McKinsey warns against building a workforce that can use today's tools but cannot adapt to the next wave. The professionals who thrive will pair AI fluency with the judgment to validate what the tools produce.
Entry-level paths are narrowing. If automation keeps eating routine triage and ticket work, the traditional on-ramp into security gets harder. Juniors should aim to own the oversight and exception-handling work that automation creates, rather than the tasks it replaces.
Your skills are more portable than your title. McKinsey's data show more than 90% of tech and analytics workers can work remotely, and the average distance between workers and their employer's worksite grew more than 70% from 2019 to 2024. Cyber talent has unusual geographic mobility. ISC2's data suggest the mood is cautiously upbeat: 73% of respondents expect AI to create more specialized cyber skills, and acting CEO Debra Taylor said many professionals see AI as an opportunity for career advancement.
For vendors, the report contains both a market signal and a caution.
The signal: Security buyers face growing skill demands with a talent pipeline that cannot expand fast enough. Products that encode expertise, cut alert noise, and let smaller teams operate at a higher level answer a real need. So do tools that make AI oversight practical, govern agent permissions, and keep identity hygiene intact through constant role change. Training, cyber range, and skills-assessment providers are also well positioned, since McKinsey's prescription leans heavily on structured learning, modular and stackable credentials, and skills-based hiring.
The caution: McKinsey's data undercut the "replace your analysts" pitch. Automation adoption and headcount reduction are, in the report's framing, fundamentally different things. Its auditing example is instructive: one study found auditor employment rose 4.3% after AI adoption, as firms used productivity gains to expand capacity and quality. Security has a nearly bottomless backlog of unmet demand, which is exactly the condition where that kind of rebound applies. Vendors who sell capacity, coverage, and better decisions will likely find a more receptive CISO than those selling layoffs.
The report's most pointed finding for the security industry may be about hiring. About 85% of growing jobs require a credential or certification, and McKinsey identifies credentials as one of the largest barriers to mobility.
But there is a crucial distinction. Legally-required credentials need policy change to fix. Employer-preferred credentials can be changed by companies themselves. In McKinsey's breakdown of growing occupations, technology and analytics sits at the extreme: credentials are only rarely required by law, but employers prefer them almost universally, and the training time attached runs more than two years on average.
In other words, much of the gatekeeping in tech hiring is a choice. Security knows this story well: entry-level postings that demand a degree, multiple certifications, and three years of experience. McKinsey's remedies—resetting degree requirements, using skills assessments, recognizing prior experience, building apprenticeships—are the same ones workforce advocates have pushed in cyber for years. The report adds a sobering frame: with 11 million workers in motion, many from customer-facing and operational roles with transferable skills, the cost of keeping that wall up is growing.
McKinsey closes by arguing that the organizations realizing AI's potential will be the ones that move talent as effectively as they deploy technology. For security, that cuts two ways. The reallocation is a workforce challenge, with skills gaps, burnout, and a narrowing entry pipeline. It is also an attack surface, with churn, reorganized front lines, and new AI oversight roles that become controls whether anyone designs them that way or not.
The CISOs who come out ahead will treat both as part of the same problem.