393,000 short and NIS2 live: European cyber is the tightest contract market of 2026

ISC2's 2025 Cybersecurity Workforce Study put the global talent gap at 4.8 million practitioners — with Europe alone short around 393,000. In the same window, NIS2 obligations became enforceable across most EU member states and DORA went live for European financial services. The regulation arrived; the people didn't.

The contract market re-priced within a quarter. Interim CISOs and Security Architects now band €1,050–1,500/day across the Nordics, Benelux and DACH (AddanEx + TalentUp, 2026). Cloud Security Architects with real AWS or Azure depth are landing €820–1,120/day in the same regions.

The single tightest fill of 2026 is a GRC contractor who can actually operationalise NIS2 and DORA rather than write PowerPoints about them. Median time-to-shortlist in our data is 19 days — versus 11 for a Cloud Engineer of equivalent seniority. That gap is the market telling you where the scarcity really is.

The buyer mistake we see most is opening a permanent CISO search when the business needs a 9-month interim to build the control environment, followed by a permanent operator to run it. Those are two different hires, in two different orders. Treat them that way and the market rewards you.

For the rest of 2026, expect continued rate pressure at the top — especially for contractors who can point at delivered NIS2 or DORA programmes inside regulated European clients. There aren't many of them. There won't be more for a while.