Cyber threats continue to become more advanced, and the United States Department of Defense (DoD) faces the continual challenge of ensuring its workforce can keep pace. Government agencies, including the DoD, face increasingly sophisticated, state-sponsored cyber threats that leverage stealth access and more increasingly, AI. These threats create the risk of data compromise, operational downtime, and overwhelmed cyber defenses if workforce readiness does not keep pace.
To address these issues, the DoD is redefining how it measures cyber workforce readiness by shifting to a new directive, DoD 8140. This transition moves from the agency’s former certification-based compliance program to the 8140 model, which requires demonstrated role-specific proficiency and emphasizes continuous skill development and real-world capability as essential to mission readiness.
For years, cyber roles were organized into narrow domains such as network defense, endpoint security, or security information, and event management (SIEM) operations. That model worked when threats were more compartmentalized. Today, adversaries operate across domains, exploiting the seams between systems, teams, and technologies. As a result, defenders who lack visibility into cloud environments, identity systems, or modern development pipelines are operating with critical blind spots.
At the same time, a byproduct of the DoD’s modernization efforts could be broadening the attack surface. Cloud migration, DevSecOps pipelines, and AI–powered capabilities that enable attackers to scale and rapidly launch cyberattacks are introducing new vulnerabilities faster than traditional training models can keep up. And when workforce development is tied to static certification cycles or periodic training events while AI develops and deploys at a seemingly breakneck pace, teams – by design – will fall behind.
Tying Qualification to Demonstrated Proficiency in a Specific Role
Private partnerships are supporting this workforce transformation with the DoD to deliver an integrated readiness solution in support of the DoD’s shift to the 8140 directive. Under the previous model, if an individual held the right credential, they were considered compliant, whether or not the qualification was for the latest system patch or an outdated, years-old version. Under 8140 and the DoD Cyber Workforce Framework (DCWF), qualification is now tied to demonstrated, role-specific proficiency.
This shift moves away from periodic, event-based learning toward continuous, role-aligned skill development. As such, training must be targeted, current, and measurable, with a clear connection to real-world performance and applicability.
This represents a significant operational shift. The legacy model of requiring personnel to earn certifications and tracking completion in spreadsheets was relatively rigid. The new model requires understanding role requirements, identifying skill gaps, prescribing targeted learning, and tracking progress in a way that is current and auditable.
The Visibility Gap is Undermining Cyber Readiness
One of the most pressing concerns for the DoD and other government organizations beyond the skills gap is a visibility gap. Recent research found 77% of IT teams report lacking adequate visibility across their environments, underscoring how system complexity and disconnected tools can obscure critical operational effectiveness.
Many agencies lack a clear, real-time understanding of where their workforce stands against defined role requirements. Instead, workforce data is often fragmented across disconnected systems, including training platforms, compliance tools, and spreadsheets. The result is an unintegrated and often outdated picture of readiness.
Without accurate visibility, leaders are forced to rely on lagging indicators. They can track completed training or certifications, but not whether personnel are prepared to meet current threats. Closing this gap requires connecting three critical elements: assessment, learning, and validation. To make informed decisions about readiness and risk, agencies need a continuous view of workforce proficiency aligned to specific roles, paired with targeted learning and real-time validation of progress.
Closing the visibility gap is only the first step. Sustaining cyber readiness requires anticipating how emerging technologies will reshape both threats and the skills required to defend against them. AI is already accelerating detection and response while enabling more sophisticated attacks. At the same time, cloud-native architectures, software supply chain risks, and the long-term implications of quantum computing are introducing new vulnerabilities. Government leaders must remain focused on skill visibility to effectively combat emerging threats. These challenges cut across systems, roles, and teams, and the implication is clear: building a cyber workforce ready for future threats requires both cross-domain understanding and the ability to identify awareness gaps.
Building a Workforce Ready for the Mission
The true measure of cyber readiness lies in the ability to build, apply, and maintain critical skills over time to remain responsive to evolving threats. For the DoD, the stakes are high. In an environment where threats evolve rapidly and adversaries adapt quickly, workforce readiness is a mission-critical capability.
Agencies that embrace continuous, role-based development and invest in the systems and culture that support it will be well-positioned to meet the challenges ahead. Ultimately, success will depend on whether teams can translate skill development into real-world capability at the speed the mission demands.
The author, Tony Holmes, is Director, Public Sector Presales Solution Consulting at Pluralsight,