More cybersecurity talent: transitioning military personnel enter the private sector

Key data

Spanish cybersecurity companies will have access to a new flow of qualified candidates with technical training of military origin. The Resolution 420/38248/2026, published on May 12, 2026 by the General Technical Secretariat of the Ministry of Defense, formalizes the addendum extending the agreement with the National Institute of Cybersecurity of Spain (INCIBE) to continue the training and employability program in cybersecurity aimed at military personnel transitioning to the private sector.

This is not a regulation that imposes costs or sanctions. It is a talent policy measure with direct impact on the national cybersecurity ecosystem: more trained professionals, with a technical-military profile, ready to join the civil industry.

What does this regulation establish?

The addendum extends the original agreement between the Ministry of Defense and INCIBE, whose purpose is to facilitate training and employability in cybersecurity for military personnel who leave active service and seek to integrate into the private industry at the national level.

The key elements of the extended agreement are:

• Signatory entities: Ministry of Defense and National Institute of Cybersecurity of Spain (INCIBE), S.M.E., M.P., SA.
• Direct beneficiaries: Military personnel in the process of labor transition to the civil sector.
• INCIBE's role: Acts as the coordinating entity for training, designing content aligned with the real needs of the cybersecurity industry.
• Strategic objective: Leverage human capital and technical capabilities from the military sphere to strengthen Spain's cybersecurity ecosystem.
• Scope of application: National, targeting the cybersecurity industry sector in Spain.

The measure does not expressly modify any previous regulation: it is an extension that extends the validity and effects of the agreement already existing between both entities.

Economic and operational impact

This regulation does not generate direct costs for private companies nor establish new compliance obligations. Its impact is of a strategic and labor market nature:

• Greater supply of qualified talent: Cybersecurity companies can expect an increase in candidates with a technical-military profile in the market, with specific training coordinated by INCIBE.
• Training aligned to the industry: Since INCIBE designs the training content, the profile of these candidates responds to the real needs of the private sector, reducing the cost of internal adaptation.
• Strengthening the national ecosystem: Spain consolidates its commitment to a cybersecurity market with its own talent, which can reduce dependence on international profiles or those difficult to recruit.
• Opportunity for differential recruitment: Companies that activate contact channels with INCIBE or military transition programs can access these profiles before the competition.

There are no published economic amounts associated with this addendum in the available regulation.

Who does it affect?

• Cybersecurity companies: Main indirect beneficiaries, as they have access to a new flow of technical candidates with specific training.
• Technology companies with cybersecurity needs: Any organization that needs information security, threat analysis, or incident management profiles.
• Military personnel in labor transition: The direct beneficiaries of the training and employability program.
• INCIBE: As the coordinating entity, it assumes responsibility for designing and executing training content aligned with the industry.
• Ministry of Defense: As a signatory party to the agreement, it promotes the employability of its personnel in the process of leaving active service.

Practical example

A cybersecurity company based in Madrid that seeks threat analysts or incident response specialists typically faces a labor market with a shortage of technical profiles and rising salaries.

With the extension of this agreement, INCIBE continues to train military personnel—professionals with operational discipline, experience in high-demand environments and technical capabilities developed in the defense sphere—and prepares them specifically for integration into the civil cybersecurity industry at the national level.

This company could establish contact with INCIBE to learn about available profiles, participate in the program's job guidance processes, or incorporate these candidates into its selection processes, accessing qualified talent with a differential profile compared to the conventional market.

What should companies do now?

1. Identify talent needs in cybersecurity: Review whether the company has open or planned positions in areas of information security, threat analysis, incident response, or technology risk management.
2. Contact INCIBE: As the coordinating entity of the program, INCIBE is the access point to learn about available profiles and the mechanisms for incorporating candidates from the military program.
3. Activate specific recruitment channels: Consider participation in employability initiatives linked to the Defense-INCIBE program to access these profiles before the competition.
4. Evaluate the fit of the technical-military profile: Candidates from this program combine technical capabilities with experience in high-demand operational environments, which can be especially valuable in critical cybersecurity roles or defense against advanced threats.
5. Monitor program evolution: Track INCIBE and BOE publications to learn about the temporal scope of the extension and the calls associated with the agreement.