Changelog

The research is versioned like open-source code. Every release is tagged, and every change to a figure, a rating or a finding is logged.

v1.0.0Latest release, 1 October 2026

How versions are numbered

1.0.0 → 2.0.0MajorAn answer changes direction, or a finding is withdrawn.

1.0.0 → 1.1.0MinorFigures are refreshed, a finding is added, or a rating changes.

1.0.0 → 1.0.1PatchWording, links or corrections that change no figure.

Releases

v1.0.01 October 2026

Corrected

Both years are now held to the same rules. Postings from spring 2024 and from 2026 pass the same title rules, the same de-duplication, the same scope check by a local model and the same exclusion of job aggregators, and the 2026 set counts postings open on or after 23 September 2026. An early-access draft compared 2026 against a 2024 set held to different rules.
Q2 The fall in the manager share did not survive. Manager-titled postings were 7.7% of security postings in spring 2024 and 6.8% in 2026, a change that is not measurable, and the title now says the share held. The fall in the early-access draft came mainly from the 2026 side. The query kept only titles the collector tags as security, and until the evening of 21 September the collector skipped many titles outside engineering. A scope check on 2024 alone lowered the 2024 manager share, but it did not cause the fall.
Q1 The summary is now the overall rise in postings asking for a programming language, from 22% to 43%.
Q5 Startups firmly require a degree about 60% as often as enterprises, a likely but borderline gap. The early-access draft and its title said half as often.
Q6 Manager postings that expect AI ask for hands-on work in 78% of cases, against 43% without. The early-access draft and its title said 76%. The collector widened on the evening of 21 September, and 124 postings were first seen after the widening, where the early-access draft said 129.
Q8 Posted pay midpoints rose 27.4%, or 19.3% after inflation. The early-access draft said 21.7% and 13.9%.
Figures in Q3, Q4 and Q7 were recomputed under the same rules. No answer changed.
Q3 The degree shares now leave out postings where the readers split on the degree, as the piece's own rule says. Each share moved by half a point or less.
Q1 , Q4, Q8 and Q9 The industries counted as outside technology were listed differently across pieces. They now match everywhere, and telecommunications counts as technology. Only test results moved. No answer or rating changed.

Added

First release. Ten questions, each with a confidence rating, a representativeness rating, the tests the answer survived and what would strengthen it.
Q1 Are security specialties turning into engineering jobs? Figures as of 1 October 2026, some tests 23 September.
Q2 Is security leadership contracting relative to individual contributors? Figures as of 1 October 2026, some tests 23 September.
Q3 What do companies expect of entry-level security hires? Figures as of 1 October 2026, one test 23 September.
Q4 What AI skills do security postings ask for, and how do they differ by level? Figures as of 1 October 2026.
Q5 How do expectations differ by company size and industry? Figures as of 1 October 2026, some tests 23 and 24 September.
Q6 When a posting expects AI use, are security managers asked to be more hands-on? Panel figures as of 23 September 2026, second read 25 September.
Q7 How does security hiring at AI-first companies differ from everyone else? Figures as of 1 October 2026. AI engineering postings naming a security duty is rated High: it passed every standard check on the 25, 28 and 30 September and 1 October runs, and the piece rests on the 1 October run.
Q8 Which security roles had the largest rise in posted pay ranges, spring 2024 to 2026? Figures as of 1 October 2026, with pay from Ashby and Lever job boards as of 30 September.
Q9 How do engineering and non-engineering titles split across security job openings? Figures as of 1 October 2026.
Q10 How are security job postings screening and authenticating candidates? Figures as of 1 October 2026.
How the research is made: collection, ratings, standard stress tests and the rules they produced.
Reader questions.

Changed

Since the v0.9.0 pre-release: the label now reads "Written entirely by agents in the Research Factory". Q8 has a new title, Q1 and Q3 new descriptions, and the method page reads the 1 October data.

CHANGELOG.md

Ask the Research Factory a question.

This is not a live chat. Accepted questions become new pieces, published in a later release.

01 You ask, with the decision it would inform You
02 We check job postings can answer it Our team
03 Approved questions join the reader queue Our team
04 Agents write the analysis, ratings and piece Research Factory
05 Every answer runs our standard controls Our controls
06 Published and tagged, credited if you want Research Factory

Ask the Research Factory a question