US security postings fell 26.4%, and the 268.3% AI Security Engineer rise starts from 654 postings

The 268.3 per cent starts from 654 postings, and the 26.4 per cent fall is 84,424

The CyberSN jobs report page, with data pulled on 7 October 2026, prints one row for the AI Security Engineer role: 2,409 US postings from January to September 2026, "+268.3%" against the same months of 2025. The visible text of the page does not print the 2025 count. The data the page loads for its own role explorer does, and the arithmetic agrees with it: 654 postings in January to September 2025 (2,409 divided by 3.683 is about 654, derived). The rise is therefore 1,755 postings (derived). Over the same nine months the page's headline total fell by 84,424 postings, from 320,210 to 235,786, which is the "Down 26.4%" in its opening line.

That is the opening fact, and it has limits. It states a scale: a role whose postings rose fast, counted in the low thousands inside a market counted in the hundreds of thousands. It does not establish how many employers posted the 2,409, how many people were hired, what the roles pay, or anything about the UK. The report says so in its first caveat: "Every number here counts job postings: what employers asked for, not jobs or people." CyberSN is a recruiting and workforce-intelligence company, and the page closes by inviting the reader to book a discovery call, so it sells the service its data points towards.

Play the chart below, or use its buttons. It redraws numbers already in this briefing and adds no new reporting; any percentage it adds is this site's own arithmetic and is marked derived. It shows each month of 2026 against 2025, the four years of the same months, the 84,424 fall beside the rises in AI Security Engineer and Cyber Data Scientist, and, behind its buttons, that role by month and the AI terms share.

SecurityWeek's article against the report page

SecurityWeek's article, published at 7:00 AM Eastern on 18 October 2026, relays the report. Every figure in it that was checked against the report page matched, from the 235,786 and the 320,210 to the percentages for the roles it lists (factcheck.md has the line-by-line list). The differences are in wording and in what the article leaves out. A secondary report follows the primary, so where the two differ this briefing follows the page.

SecurityWeek's article of 18 October 2026 against the CyberSN report page read the same day. Quotations are exact. Derived means this briefing's arithmetic.

SecurityWeek	The CyberSN page	Reading
Headline: "AI Security Engineer Demand Soars"	A table row: 2,409 postings, "+268.3%", against the same months of 2025. No sentence about the role in the page text read.	"Soars" is the headline's word. The page counts postings. The rise is 1,755 postings (derived).
"AI Security Engineer demand has increased by 268.3%" over last year	January to September 2026 against January to September 2025.	Nine months against nine months, not a year. The article does not say so.
"two specific AI and data roles": the other is Cyber Data Scientist, up 203.5%	Cyber Data Scientist sits in Research: 1,493 postings, "+203.5%".	The 2025 base is 492 postings (page data), after one month in each year was replaced by its median.
Just under 15% of postings reference AI, "comparable" to 15.1%	"14.6% of postings mention AI or machine learning terms", "About level with 15.1%". The table shows -0.5 points.	Agrees. It is half a point down, and the count of such postings fell about 29 per cent (derived).
Momentum "peaking at 20.0% in September 2026"	"September's 20.0% was the highest of any month since January 2025."	Agrees. It beats August 2025 (19.5%) by 0.4 points, and February 2026 was 10.6% (both derived from page data).
The functions that most reference AI: Research, Offense, GRC and Plan	The same table shows falls: Sales down 14.2 points, Product Security down 4.2, Defense down 1.6, Response down 1.4.	The article lists only the risers. Six functions rose and four fell (derived count).
"Leading the loss of roles": seven roles, from Cyber Insider Threat Analyst to the CISO area	Ranked by percentage fall. The seven lost 14,485 postings together (derived).	That is 17.2 per cent of the 84,424 fall (derived). Security Engineer, Security Analyst and DevSecOps lost 40,783 between them, 48.3 per cent.
CISO "including CSO, BSO and ISO"	"Information Security Officer title, Chief and Business included".	The report's method sentence does not name a CSO title. The article's list is wider than the query as written.
The report is a "'what' not 'why' report"	Not in the page text read.	It may come from the PDF edition, which was not read. The page does offer one untested why: leadership postings "move with how boards are treating cyber accountability".

The article is careful in its body: it says it is "difficult to draw specific employment potential indications" from the figures. The gap this briefing measures is between that sentence and the headline. The report page says in its own advice that volume "means more open doors, not better ones", and that external posting data "shows you the weather", while the picture of a company's own workforce is what CyberSN sells.

The 26.4 per cent is measured against the highest of four Januarys to Septembers

The report's own heading for the total is "The lowest January to September in four years", and that is accurate. What the percentage hides is how high the comparison year was.

US core cybersecurity postings, January to September of each year, as printed on the CyberSN report page (data pulled 7 October 2026). Changes are derived.

Year	Postings	Change on the year before	2026 against it
2023	273,498	not shown	2026 is 13.8% lower
2024	244,911	down 10.5%	2026 is 3.7% lower
2025	320,210	up 30.7%	2026 is 26.4% lower (the report's figure)
2026	235,786	down 26.4%	not applicable

2025 added 75,299 postings on 2024 (derived), and 2026 gave back all of them and 9,125 more (derived). The report states the base effect itself for one series, the CISO area: "2025 was the high", and 2,832 postings in 2026 compare with 2,808 in 2024. The same page does not do so for the AI roles, and the visible text prints no 2025 count for either. None of this makes the fall unreal. Eight of the nine months were below 2025, and 36 of the 41 role series that make up the total fell (derived from the page data). It makes the size of the percentage depend on the year chosen.

Core postings by month, 2026 against 2025, as printed on the CyberSN report page. Changes are derived.

Month	2026	2025	Change
January	27,784	35,459	down 21.6%
February	27,069	38,465	down 29.6%
March	23,717	35,980	down 34.1%
April	22,619	35,935	down 37.1%
May	25,793	34,964	down 26.2%
June	29,929	30,570	down 2.1%
July	22,480	38,744	down 42.0%
August	28,766	42,647	down 32.5%
September	27,951	27,582	up 1.3%

Two reading notes on that table. September 2026 is the only month above 2025, by 369 postings (derived). And the nine monthly figures do not add up to the headline totals: they sum to 236,108 and 320,346, which are 322 and 136 above 235,786 and 320,210 (derived). The report's method note explains it: a month more than five times the median of the series' previous six months is "shown on the trend at its raw value but replaced by the median inside every total and percentage". Two Cyber Data Scientist months were replaced, May 2026 (379 posted, 57 used) and April 2025 (164 posted, 28 used), and the differences are exactly 322 and 136 (derived). Counted on the monthly figures the fall is 26.3 per cent (derived), so the headline is not sensitive to it.

The report also projects a full-year 2026 of 288,911 to 325,540 postings and calls it "a seasonal pace estimate, not a prediction of any event". The range reproduces from its own totals (derived): applying each earlier year's share of postings that arrived by September (77.4 per cent in 2023, 72.4 per cent in 2024, 81.6 per cent in 2025) to 235,786 gives 304,642, 325,539 and 288,910. The spread is wide because the October to December share of a year's postings has run from 18.4 per cent (2025) to 27.6 per cent (2024) (derived).

What 268.3 per cent and 203.5 per cent are made of

The page's role explorer data lists, for each role, the January to September count for 2026 and for 2025, and the monthly counts back to January 2023. The totals reconcile exactly: the 41 role series that are added into the total sum to 235,786 for 2026 and 320,210 for 2025 (derived). That reconciliation is the check that this data is the report's data.

Role series, January to September, from the CyberSN report page (2026 counts, percentages) and its embedded role data (2025 counts). The added column is derived.

Series	2025	2026	Added
AI Security Engineer (within Security Engineer)	654	2,409	1,755 (+268.3%)
Cyber Data Scientist (Research)	492	1,493	1,001 (+203.5%)
Security Engineer, the broader series	65,098	44,083	down 21,015 (-32.3%)
All 41 added series	320,210	235,786	down 84,424 (-26.4%)

The AI Security Engineer series. The report says three series, AI Security Engineer, Site Resiliency Engineer and SOC Analyst, "overlap broader queries and are shown within their function for orientation without being added to totals". The page files the role under Defense and marks it "within Security Engineer". Whether every one of the 2,409 is also counted in Security Engineer's 44,083 is not stated; the wording suggests it, and if so the rest of Security Engineer fell 35.3 per cent (derived, inference). As a share of Security Engineer, the AI series went from 1.0 per cent to 5.5 per cent (derived). Its monthly counts, from the page data, were 64, 55, 60, 53, 44, 57, 84, 177 and 60 from January to September 2025, and 128, 364, 99, 136, 343, 307, 359, 301 and 372 in 2026. The average month rose from 73 to 268 postings (derived), a real and sustained step up, and the series is lumpy: 364 in February 2026, 99 in March. The report's own advice on reading data is that "A single month that doubled is usually a large employer's batch posting or an indexing artifact." How many employers stand behind the 2,409 is not stated.

Cyber Data Scientist. The 2025 base is 492 and the 2026 count 1,493, and both are after the anomaly rule: counted raw, the months sum to 628 and 1,815, a rise of 189.0 per cent (derived). The 2026 monthly counts were 51, 63, 38, 139, 379, 47, 184, 247 and 667. September alone is 667 of the 1,493 (44.7 per cent, derived), and July to September 73.5 per cent (derived), so most of the rise arrived in the last three months. In the page data, 88 per cent of the role's postings mention one of the six AI terms, against 76.5 per cent for the AI Security Engineer series.

Against the whole. Five of the 41 added series grew: Cybersecurity / Privacy Attorney by 2,024, Cyber Data Scientist by 1,001, Cryptography / PKI Professional by 463, Data Loss Prevention Engineer by 88 and Vulnerability / Threat Management Analyst by 2, a total of 3,578 postings (derived). The other 36 lost 88,002 together, which nets to the 84,424 fall (derived). Counting the AI Security Engineer rise as well, if it sits inside Security Engineer, all growth anywhere is 5,333 postings, 6.3 per cent of the fall (derived, inference). Even counting both AI and data rises in full, 2,756 postings, is 3.3 per cent of the fall (derived).

Where the fall sits: the roles that lost the most postings, January to September 2025 to 2026, from the CyberSN page and its role data. Derived columns.

Role	2025	2026	Lost (share of the 84,424)
Security Engineer	65,098	44,083	21,015 (24.9%)
Security Analyst	34,685	24,095	10,590 (12.5%)
DevSecOps	33,495	24,317	9,178 (10.9%)
Security Architect	19,976	14,967	5,009 (5.9%)
Cyber Risk Analyst	8,317	4,031	4,286 (5.1%)

The roles that lead a ranking by percentage fall, such as Cyber Insider Threat Analyst (down 55.6 per cent) and Cyber Risk Analyst (down 51.5 per cent), are a small part of the postings. The fall in postings is mostly in three large, broad roles. The report's per-role table does not say why.

How a posting becomes an AI Security Engineer

The report's opening says it "reads every posting through the CyberSN Taxonomy, so demand is counted by the work being asked for, not by the title on the listing". Its method note says something narrower: "Each series is a title query", and eleven of the 41 core queries also require cyber or privacy terms in the job description. The report does not reconcile the two statements. For this role the title forms are listed on CyberSN's own role page: AI/ML Security Engineer, Machine Learning Security Engineer, ML Security Engineer, GenAI Security Engineer, LLM Security Engineer, AI Application Security Engineer and AI Red Team Engineer. The query itself, the full title list, and how a posting that matches two series is handled are not published on the pages read.

The role page defines the work: protecting AI and machine-learning systems, "securing models, training data, and the AI supply chain" and testing them for weaknesses such as prompt injection and data poisoning. It says the role differs from a Security Engineer. The report counts it inside Security Engineer. The page data gives one measure of how well the title and the work line up: 76.5 per cent of the series' postings mention one of the six AI terms, down 6.5 points on 2025 (83.0 per cent, derived). So about 566 of the 2,409 (23.5 per cent, derived) mention none of the six terms in the description. The report does not search the bare letters AI, so some of those may use only that. The point is limited: it suggests the series follows titles, which is what the method note says, and is not a count of AI security work.

The series is also not fixed across editions. The report says that earlier CyberSN figures "were produced with an earlier method, so this edition's numbers supersede rather than extend them". The size of the restatement can be measured on CyberSN's own earlier posts (derived). In June 2025 CyberSN gave 64,300 Security Engineer postings for 2024; the role data in this edition gives 62,993, which is 2.0 per cent lower. Across ten roles listed in that post the 2024 figures are 1.1 to 5.2 per cent lower in this edition. CyberSN's mid-year report of October 2024 counted 179,472 postings from January to July 2024; this edition's monthly data sums to 174,237 for the same months, 2.9 per cent lower. The report does not say how much of this is method and how much is later de-duplication, and a percentage built on a restated base is not comparable with one in an earlier edition.

Stated and not stated: the record, line by line

"Not stated" means not found on the pages read, which are listed in the sources. It does not mean the information does not exist, and the PDF edition was not read.

What the CyberSN report page and the pages around it state, and what they do not. Read on 18 October 2026.

The question	Stated	Not stated
Whose postings?	JobSpikr, United States only, "the job board and Fortune 500 datasets", duplicates "excluded at the source". Data pulled 7 October 2026.	How many boards or employers sit behind those datasets, and what share of all US postings they cover. JobSpikr's own site (spelt JobsPikr) says 100+ countries and 70K+ sources worldwide, not the US subset.
Jobs or people?	"Postings, not people": what employers asked for.	Hires, filled roles, time to fill, pay, and the number of employers behind any series.
The 2025 base?	The 2026 count and the percentage on the page. The role data the page loads holds 654 and 492.	The 2025 counts in the page text. Whether the on-screen role card shows them was not checked.
How a posting is classed?	A taxonomy of 45 roles; "Each series is a title query"; three series overlap broader ones.	The queries and title lists, how a double match is resolved, and why CyberSN's taxonomy page, read the same day, says 51 roles.
Anomalies?	Months over five times the six-month median are replaced by the median in totals. Three are listed, none an AI Security Engineer month.	How many employers lie behind the lumpy months that fall under the threshold, such as 364 then 99 postings in February and March 2026.
AI terms?	Six terms searched in the description; bare AI not searched; LLM can mean a law degree.	Whether a mention is a requirement or boilerplate, and the employer count behind it.
Earlier editions?	The edition's numbers "supersede rather than extend them", it says of earlier ones.	A bridge from earlier published totals. Measured here: 2024 figures 1.1 to 5.2 per cent lower for ten roles (derived).
Why it moved?	Counts only. One untested line on boards and cyber accountability.	Any cause for the fall, or for the rise in the AI roles.
The UK?	"United States only".	Any UK figure, for any period.

AI and machine-learning terms: about level, with the count down

The report's wording is measured: 14.6 per cent of postings mention AI or machine learning terms, "About level with 15.1%" a year earlier, "but rising through the year". The table gives the change as down 0.5 points. Because the total fell 26.4 per cent and the share held, the count of postings that mention the terms fell too. From the monthly shares and the monthly totals, about 34,500 postings in 2026 against about 48,300 in 2025, a fall of about 29 per cent (derived, and 28.3 to 29.3 per cent on the rounded shares alone). A share is a fair measure of mix and a poor measure of volume.

The monthly series runs from 12.8 per cent in January 2025 to 19.5 per cent in August 2025, 10.6 per cent in February 2026 and 20.0 per cent in September 2026 (page data). The September figure is the highest of the 21 months, and it clears August 2025 by 0.4 of a point (derived). The rise through 2026 is real in the figures, since September is 9.3 points above February (derived). It is also noisy, because August 2025 reached 19.5 per cent and September 2025 fell back to 15.0 per cent. Across the ten functions the AI-mention share rose in six and fell in four, and the largest movements are in small functions: Research 32.7 per cent (up 11.7 points) and Sales 9.5 per cent (down 14.2 points).

A keyword count has a known limit, and the report states one: "LLM" can name a Master of Laws degree that some Legal postings ask for, so that function's share may run high. The mention of a term in a description is not a requirement to build or secure an AI system.

The UK: a different source, a different year, and no AI security job series

CyberSN's data is US only, and nothing in it can be read as a UK figure. The UK government's own series is separate. Cyber security skills in the UK labour market 2026 was published on 29 September 2026. It was commissioned by the cyber security team of the former Department for Science, Innovation and Technology, which the page says moved to the Department for Digital, Culture, Media and Sport in July 2026. It covers calendar 2025, not 2026, and takes its job postings from the Lightcast database.

CyberSN (US) and the UK government report, side by side. The two cannot be added or compared point for point.

Measure	CyberSN, United States	DSIT with Lightcast, United Kingdom
Period read	January to September 2026, data pulled 7 October 2026	Calendar year 2025
Headline	235,786 postings, down 26.4% on the same months of 2025	34,932 core cyber postings, up 7% on 32,671 in 2024, which had fallen 33% from 48,492 in 2023. All cyber roles 66,964, up 10%
What counts	JobSpikr job board and Fortune 500 datasets, deduplicated, title queries under CyberSN's taxonomy	Online postings in Lightcast. Core roles are those "where some aspect of cyber security is the main job function"
AI measure	14.6% of postings mention six listed terms	AI skills requested in 9% of core postings (3,153 of 34,932), up from 4%
AI security roles	An AI Security Engineer series of 2,409 postings	No AI security job series found in the postings chapter. DSIT cites its sectoral report: staff in firms offering AI security up 51%, 9,740 across 66 firms to 14,718 across 111 (the same report prints 14,720 in its workforce chapter)
2026 for the UK	Not covered	Not covered: the postings end in December 2025

The two do not contradict each other, because they do not overlap in period or definition. The UK report says demand "may have begun to recover from the lows observed in 2024", and that the 2025 rise "may represent market stabilisation rather than a return to the levels of high demand experienced in the early 2020s". It puts core postings 51 per cent below 2022. CyberSN's US full-year count rose 16.0 per cent in 2025 (derived), and its count to September 2026 is the lowest in four years. Neither source has UK postings for 2026, so no UK 2026 trend can be read from either. DSIT's staff count for AI security firms measures employment in firms, not postings and not a job title, and the sectoral report behind it was not read. In its workforce chapter the same report says it has dropped its earlier estimate of a UK workforce gap because such an estimate "inevitably makes various assumptions".

The government's Code of Practice for the Cyber Security of AI, published on 31 January 2025, is voluntary and sets duties by organisational role (Developers, System Operators and Data Custodians), not by job title. Its provision 1.1.1 says: "AI security training shall be tailored to the specific roles and responsibilities of staff members." Its threat-modelling provision names attacks such as data poisoning, model inversion and membership inference. The Code names no job called AI Security Engineer. A UK employer deciding whether it needs one can start from those duties rather than from a US posting count. This site's briefing on the same DSIT report covers its survey on confidence in basic cyber skills, which is a different chapter from the postings read here.

Three labels doing the work of evidence

Labels in the story, where each appears and what the record shows.

The label	Where it appears	What the record shows
"Demand"	SecurityWeek's headline and body; the report's own line "demand is counted by the work being asked for".	A count of postings, by CyberSN's definition "what employers asked for, not jobs or people". Nothing on hires, budgets or filled roles.
"AI Security Engineer"	A role name in the table, with a role page defining the work.	A title query (the method note), with seven title forms on the role page, counted within Security Engineer. 76.5% of its postings mention one of the six AI terms (page data).
"Workforce Intelligence"	CyberSN's product name, on the report page.	The page says "External posting data shows you the weather". CyberSN sells the reading of a client's own workforce, which the page says external data cannot show.

Method is separate from accusation. A taxonomy, a deduplicated feed and a monthly anomaly rule are careful choices, and the report states its caveats on the page, including the one that changes how the headline should be read. The gap is between the report's own wording, "postings, not people", and the way a share-ready headline turns postings into "demand" and a small base into "soars".

What to do, in the order worth doing

These are steps for reading a postings report and for a hiring or planning decision that rests on one. They are not career, pay or financial advice.

What could not be verified

• The PDF edition. The full report is behind a form and was not requested. Anything it says beyond the page, such as the "what, not why" framing in SecurityWeek, is not confirmed here.
• The on-screen role card. The 2025 bases (654 and 492) were read from the data the page loads, not from a rendered card, because no browser was used.
• Employers. The number of employers behind any series, and whether agencies or re-posts are collapsed beyond "duplicate listings excluded at the source", is not stated.
• JobSpikr's coverage. Its own site gives a worldwide figure and not the US job board and Fortune 500 subset.
• UK 2026. Neither source has UK postings for 2026. DSIT's sectoral report, cited for AI security firms, was not read.
• Time-stamped. Sources were read between 12:34 and 12:54 BST on 18 October 2026. The report page says its data was pulled on 7 October and could be updated; a page's wording or a new edition could change within hours.

The question that exposes the gap

A headline says demand for an AI security role soars. What was the count a year earlier, how many employers posted the roles, and would the 2,409 change if postings were counted by the work and not by the title?

Key facts