On 18 March I had the privilege of taking part in the expert panel at the presentation of the Study on the cybersecurity industry in Spain 2025, produced by INCIBE and CONETIC and presented in León. I share here some reflections on what was put on the table, because the figures depict a mature, expanding sector that, at the same time, still has homework to do that is worth facing head-on.
The event brought together Félix Barrio, director general of INCIBE, and José Luis Pancorbo, president of CONETIC, alongside an analysis panel where I joined Patricia Alonso, Mª Pilar de Cos, Xabier Mitxelena and Jorge Herráez. INCIBE and CONETIC summarized the overall picture and, together, we grounded the challenges the sector faces ahead. You can read the detail in the INCIBE article that inspired this post.
A sector in expansion
The numbers explain why cybersecurity is described as one of the country’s technological engines. The study puts the sector’s revenue at €6.351 billion in 2024, spread across 3,431 companies that generate around 164,761 jobs. That is no small figure: this is an industry that already accounts for a very significant share of Spanish tech employment.
The projection is equally striking: estimated annual growth of 14.25% through 2029 and employment that could approach 282,000 jobs by the end of the decade. Since 2021, the sector’s employment has grown by more than 35%. Internationally, Spain ranks as the fourth-largest European market, with around 12% of the continent’s revenue and a growing presence beyond our borders.
As Félix Barrio summed up during the presentation, when it comes to cybersecurity “Spain has done its homework better than anyone”. It’s a good headline, but the study itself is careful to point out that there are still subjects to pass.
The challenges not to lose sight of
From the panel discussion and the report’s data, I would highlight four fronts:
- The talent gap. By far the most urgent challenge. A very high share of vacancies goes unfilled and companies expect to expand their workforces significantly. Without enough professionals, the sector’s growth suffers.
- Diversity. Only around 20% of employees are women. Broadening the talent base inevitably means attracting and retaining more women in the profession.
- Regulatory compliance. A significant share of companies still don’t know for sure whether the NIS2 directive applies to them. That uncertainty is, in itself, a business risk.
- The supply chain. Dependence on third parties widens the exposure surface: an organization’s security is, increasingly, the security of its suppliers.
Added to this is a highly fragmented business fabric —with a high proportion of micro-enterprises— and clear room for improvement in innovation. The good news is that entrepreneurship is thriving: hundreds of new companies have been created in the last five years, many of them already accounting for a notable share of the sector’s revenue.
My take
From my experience in IT operations and OT/ICS environments, the message I take away is twofold. On the one hand, Spain has a solid, competitive cybersecurity industry with international reach. On the other, growth is not guaranteed: it depends on solving the talent bottleneck, on diversity ceasing to be an outstanding subject, and on companies —especially the smaller ones— internalizing regulation and third-party risk management as part of their day-to-day, not as a mere formality.
Taking part in this panel was a great opportunity to contrast views with sector professionals and to confirm that, if we back the momentum with talent and strategy, cybersecurity will remain one of Spain’s great technological levers.
Sources and further reading
- INCIBE — Cybersecurity in Spain: new challenges and key strategies for companies
- Red Seguridad — Cybersecurity in Spain, a sector in expansion
- Autelsinsights — INCIBE and CONETIC present the conclusions of the study on the cybersecurity industry in Spain 2025
- CyberLur — CyberLur takes part in the presentation of the INCIBE and CONETIC study