I don’t know about this particular statistic, but what is often done in these studies is to survey organisations to ask how many of these staff they want or need, or how many vacant ‘positions’ they have.
The numbers don’t always reflect how many positions they actually have the budget for, or whether they’re willing to pay a realistic rate.
Arguably, if they were willing to pay market rates there couldn’t be any vacancies, because supply and demand.
I rarely see the concept of "supply and demand" used properly.
In introductory economics, it's just two lines crossing somewhere. In reality though, companies still have to make a buck, so there is a definite limit on how much a company can pay a "security professional" and still be profitable.
And worse, if we are talking about a labor shortage across an industry or country, price doesn't really come into it at all. Price is only a competitive factor, it doesn't create or destroy individual developers. If one employer "scoops" an employee for a higher price, the shortage moves to where he just left.
Sucking in talent from other industries or countries also has its limits. And on top of all of that there seems to be some anti-competitive effects preventing wage-wars.
The numbers don’t always reflect how many positions they actually have the budget for, or whether they’re willing to pay a realistic rate.
Arguably, if they were willing to pay market rates there couldn’t be any vacancies, because supply and demand.