What the White House cyber summit’s training pledges left for agencies to fix

The week

On August 25, 2021, President Biden met at the White House with executives from technology, finance, insurance, energy and education companies and from educational institutions to discuss cybersecurity. Participants announced commitments. Microsoft said it would invest $20 billion over five years in security and make $150 million in technical services available to federal, state and local governments, along with expanded training partnerships. Google said it would invest $10 billion over five years in areas including zero trust and software supply chain security, and help 100,000 Americans earn industry-recognized digital skills certificates. IBM said it would train 150,000 people in cybersecurity skills over three years. Other companies and educational groups announced training and education programs. The administration said NIST would work with industry on a framework for technology supply chain security and that its industrial control systems initiative would expand.

The training pledges were real, and some were large. They answered a widely acknowledged shortage of cybersecurity workers. For a state agency, a county or a city, though, the shortage was never one problem. It had three parts, each with different owners and different fixes: supply, whether enough people with the right skills exist; access, whether the agency can hire them; and retention, whether it can keep them once hired. Corporate pledges worked on the first. The second and third were where most agencies lost candidates, and both sat inside government.

Supply: training fills the pipeline, slowly

Expanding the pool of people with security skills is necessary. Certificates, apprenticeships, community college programs and university partnerships all add to it, and the summit commitments joined many state and university programs launched around the same time.

The limits are timing and level. Training produces entry-level candidates. What most agencies lacked in 2021 were experienced people: engineers who could secure cloud tenants, incident responders, identity specialists, and people who understood the control systems in water and transit agencies. Those roles take years of practice on top of any course. Supply programs pay off over a decade. They do not fill a senior vacancy this budget year.

Agencies can still shape supply locally. Paid internships with the state university, apprenticeship slots that rotate through the security team, and partnerships with community colleges in the agency’s own region build a pipeline of people who already know public sector systems and are more likely to stay nearby. The measure that matters is the number of qualified applicants per posting, tracked over time, not the number of people trained nationally.

Access: hiring rules written for another labor market

The second part is whether an agency can hire people who are available. Public hiring processes often take months. Job classifications in many civil service systems predate cloud security and identity engineering, so agencies squeeze those roles into general IT titles whose pay bands do not match the market. Minimum qualifications often require a specific degree or years in a narrowly defined role, which screens out strong candidates from the military, help desks or self-taught backgrounds. Positions needing background checks or clearances add more months, during which candidates take other offers.

Fixes exist and cost little money, but they sit outside the IT department. Skills-based qualifications and practical assessments replace degree requirements. Security-specific job classifications with their own pay ranges replace borrowed IT titles. Pre-approved pay flexibilities, such as hiring above the band minimum for hard-to-fill roles, shorten negotiation. Conditional offers that start onboarding while a background check runs keep candidates warm. The federal government moved in this direction when the Department of Homeland Security launched a new Cybersecurity Talent Management System in November 2021, with market-based pay and skills assessment for its own hiring. Most state and local agencies had nothing comparable.

Because these levers belong to civil service commissions, human resources departments and budget offices, the chief information security officer needs a sponsor there. The useful measures are time from posting to accepted offer, offer acceptance rate, and the share of candidates screened out by formal qualifications rather than skills.

Retention: keeping people the market wants

The third part is retention. Agencies offer mission, stability, pensions and often better hours. They usually cannot match private pay for experienced security staff, and people trained by agencies are attractive to contractors and private employers, sometimes the agency’s own vendors.

Pay is only one driver. People leave security teams that are too small for the work, where two analysts carry every alert, every audit response and every night of on-call. They leave when tools are outdated and when there is no path upward without moving into management. Agencies can address these directly. Automating routine work, such as patch reporting and alert triage, frees time for engineering. Retention bonuses or certification pay tied to service commitments help at the margin. A technical career ladder lets an engineer advance without supervising anyone. Hybrid or remote work, where security rules allow it, widens the area from which an agency can recruit and keep staff.

Partners extend small teams without replacing them. Shared services from the state, regional security operations centers and contracted around-the-clock monitoring take the most draining work off a small in-house team. That model works only if the agency keeps enough in-house expertise to direct providers, read their reports critically and decide what to do. Retention of that core group is what keeps outsourcing safe. Exit interviews, read by someone outside the security team, show which of these drivers matter in a given agency. A turnover rate tracked for security roles separately from IT as a whole shows whether the fixes are working.

The three parts need separate measures because they fail separately. An agency tracking only total vacancies cannot tell whether it lacks applicants, loses them in hiring, or loses them after two years. Each answer points to a different office and a different fix.

With hindsight

From 2026, the summit’s training pledges look useful but small against the problem. Many programs launched and some reached large numbers of learners, yet demand for experienced security staff kept outrunning supply. In July 2023 the White House published a National Cyber Workforce and Education Strategy that emphasized skills-based hiring, and many federal and state employers have since removed degree requirements for technical roles. The access and retention levers did move in places, most visibly through skills-based hiring. In 2025 the federal workforce was cut sharply, and public reporting described large staff losses at CISA, reducing the support available to state and local agencies just as many were relying on it. That has made the in-house core described above more important. Agencies that measured supply, access and retention separately have been better able to see where their own losses occurred.