Germany is facing one of the largest IT skills gaps in its history. According to Bitkom, 109,000 IT positions remain unfilled across the country, and by 2040, the shortfall could reach 663,000 professionals if current trends continue. QCG funding for cybersecurity training sits at the centre of this crisis: demand for qualified cybersecurity professionals is rising faster than companies can hire them, and the QCG funding program attempts to decrease this gap.
The good news is that Germany has a powerful funding mechanism designed for exactly this situation. The Qualifizierungschancengesetz (QCG), or Qualification Opportunities Act, allows employers to get substantial government support for employee upskilling, including professional cybersecurity Weiterbildung programs. In some cases, funding can reach 100% of course costs.
This guide explains how QCG funding works in 2026, what makes a cybersecurity training eligible, how much you can expect to receive, and how a structured program like the Cybersteps Cybersecurity Weiterbildung fits this framework.
The Numbers Behind the Skills Gap
Before diving into how QCG works, it helps to understand the scale of the problem it is designed to solve. The latest Bitkom research paints a clear picture:
- 109,000 IT positions are currently unfilled in Germany.
- By 2040, up to 663,000 IT professionals could be missing from the German labour market.
- 35% of German companies are already training staff from other fields to fill digital roles.
- Only 5.6% of all QCG-funded training between May 2025 and April 2026 went to IT and Informatik, despite IT being the fastest-growing skills need in Germany.
- 67,788 employees started QCG-funded vocational training in the 12 months from May 2025 to April 2026, showing the program operates at meaningful scale.
The gap between cybersecurity demand and QCG uptake in IT is striking. It means most organisations that could benefit from subsidised cybersecurity training are not using the funding available to them. For employers and individuals who do take the step, that creates a significant competitive advantage.
What Is the QCG and Who Is It For?
The Qualifizierungschancengesetz has been in effect since 1 January 2019 and was significantly expanded on 1 April 2024 with the introduction of Qualifizierungsgeld. It is administered through Germany’s Federal Employment Agency (Agentur für Arbeit) and is designed to help employees and employers adapt to structural change driven by digitisation, automation, and evolving job requirements.
The law has two main routes for support:
- Individual funding: Individual employee funding, covering training course costs and wage costs during the training period, for employees in an existing employment relationship.
- Qualifizierungsgeld: Qualifizierungsgeld, a wage-replacement benefit introduced in April 2024, for companies where structural change is affecting a significant share of the workforce.
For most individuals and employers exploring cybersecurity upskilling, individual funding is the most immediately relevant route. Qualifizierungsgeld is covered in a separate section below for employers dealing with large-scale structural change.
A Quick Eligibility Test: Two Questions That Matter
The Agentur für Arbeit uses a number of criteria to assess QCG eligibility. According to Bitkom’s guidance for companies navigating this process, two practical questions help determine whether a training measure is likely to be fundable:
Question 1: Could the skills gained be applied at a different employer?
Question 2: Could the business continue operating if the employee did not complete this training?
If the answer to both questions is yes, the training is likely to meet the transferable-skills requirement. Cybersecurity qualifications score clearly on both counts: a certified SOC Analyst or CompTIA Security+ holder can work at any employer, and businesses can generally continue operating without having individual employees complete the training right now.
That said, QCG is classified as Ermessensleistung, a discretionary benefit rather than a legal entitlement. The Agentur für Arbeit makes the final determination in each case. Starting the conversation early with your local office is strongly recommended.
How Much Can QCG Fund for Cybersecurity Training?
Funding covers two components: the training course costs and a wage subsidy for the hours the employee is in training rather than working. The rates depend on company size.
| Company Size | Course Cost Subsidy | Wage Cost Subsidy |
|---|---|---|
| Under 50 employees | Up to 100% | Up to 75% |
| 50 to 499 employees | Up to 50% | Up to 50% |
| 500+ employees | Up to 25% | Up to 25% |
These are the baseline rates. Higher support applies in specific situations:
- Employees without a recognised vocational qualification, training towards one may qualify for up to 100% wage cost coverage regardless of company size.
- An additional 5 percentage points apply where a qualifying works agreement or collective agreement (Tarifvertrag or Betriebsvereinbarung) is in place.
- Employees over 45 or with a severe disability may qualify for higher course cost coverage even at larger employers.
- There is a wage cap: the maximum assessable gross salary for subsidy calculations is €101,400 per year (the 2026 Beitragsbemessungsgrenze).
What Does That Look Like in Practice?
To make the numbers concrete, here are three illustrative calculation examples based on Bitkom’s analysis of real-world QCG scenarios:
| Scenario | Company Size | Employees Trained | Estimated Subsidy |
|---|---|---|---|
| Small company, 1 employee, €50,000 salary, 4-month course at €8,338 | Under 50 | 1 | Up to €15,839 |
| Mid-size company, 250 employees, 6 employees upskilling | 50-499 | 6 | Up to €76,892 |
| Large company, structural change, 40 employees | 500+ | 40 | Up to €247,374 |
These figures are estimates and depend on individual circumstances, salary levels, course costs, and training duration. The Bitkom Qualifizierungsrechner tool can be used to model scenarios before applying. For a 3-12-month program like the Cybersteps Cybersecurity Weiterbildung, the subsidy amounts for small and mid-size employers can be substantial, sometimes exceeding the total course fee.
What Makes a Cybersecurity Training Eligible for QCG?
Not every course qualifies. The core requirements that apply under QCG are:
- Minimum duration: The training totals more than 120 hours. It does not need to be completed in one continuous block.
- AZAV-certified provider: The training provider holds AZAV certification (Akkreditierungs- und Zulassungsverordnung Arbeitsförderung), the standard accreditation for labour-market training providers in Germany. A June 2025 advisory update from the AZAV certification bodies confirmed that digital and online formats are explicitly eligible under this framework.
- Transferable skills: The training builds transferable occupational skills relevant beyond a single employer. Short internal refreshers or company-specific tool training are generally not eligible.
- Two-year training gap: The employee must not have participated in a QCG-funded training measure in the previous two years.
- Qualification gap: The employee’s last completed vocational qualification must generally be at least two years in the past.
Cybersecurity training is one of the clearest fits for these criteria. It is forward-looking, builds broadly applicable technical skills, and directly addresses one of the most significant digital transformation challenges facing German organisations today. You can use the mein NOW platform to verify whether a specific course is AZAV-certified before applying.
The key variable for any given situation is confirming that the specific provider and course hold the relevant AZAV approval. This should be confirmed with the Agentur für Arbeit and the training provider before submitting an application.
Why Cybersecurity Is One of the Strongest Cases for QCG Funding
Germany faces a persistent and growing shortage of cybersecurity professionals. It is not a future risk; it is a present reality. With 109,000 unfilled IT positions nationally and a trajectory pointing towards a deficit of 663,000 IT professionals by 2040, cybersecurity is not a nice-to-have investment; it is a structural necessity.
What makes cybersecurity particularly well-suited to QCG is that it involves exactly the kind of upskilling the law was designed for: building new, in-demand, transferable capabilities in a field reshaped by technology. It is not adaptation to a minor procedural change. It is a substantive career shift or professional deepening that extends well beyond what any single employer can provide internally.
The fact that only 5.6% of QCG-funded training currently goes to IT and Informatik (Bitkom analysis, 2025-2026) is not because cybersecurity does not qualify; it is because most organisations have not yet built the internal knowledge to navigate the application process. That knowledge gap is something this guide and the Agentur für Arbeit can help close.
Common cybersecurity roles that QCG-funded training can prepare candidates for include:
- SOC Analyst (Security Operations Center)
- Cybersecurity Analyst
- Cloud Security Engineer
- Penetration Tester / Ethical Hacker
- GRC Analyst (Governance, Risk and Compliance)
- Cybersecurity Consultant
- IT Security Administrator
Each requires specific technical knowledge that cannot be acquired through short on-the-job adaptation. They represent exactly the kind of future-relevant occupational upskilling that the QCG is designed to fund.
How to Apply for QCG Funding for Cybersecurity Training Programs
The QCG application is managed through the Agentur für Arbeit. According to Bitkom’s analysis of the application process, the typical timeline from first contact to funding approval is 4 to 8 weeks. Starting early, before selecting a course start date, is essential.
Step 1: Identify the training need
Define what cybersecurity skills are needed and who needs them. For an individual career changer, this means identifying the target role and the specific skills gap. For an employer, it means mapping how job requirements are changing to a concrete training need.
Step 2: Contact the Agentur für Arbeit early
Reach out to your local Agentur für Arbeit before committing to a course. The employer helpline is 0800 4 555520 (toll-free). They will advise on eligibility, the right funding route, and the documents required. The application must be approved before training begins.
Step 3: Confirm AZAV status with Cybersteps
Ask Cybersteps to confirm the AZAV approval status of the specific course for your situation. The Agentur für Arbeit will need to approve the training measure before it starts. For multiple employees, a group application (Sammelantrag) is possible, which can reduce the administrative effort per person.
Step 4: Submit the application before training starts
Application forms typically take 30 to 60 minutes to complete. Once submitted, budget 4 to 8 weeks for processing. Approval must be in place before the training begins. Starting the process at least two months before the intended course start date reduces the risk of delays.
Step 5: Keep records during training
Attendance and scheduling records are typically required during and after training. Make sure these are maintained accurately throughout the Cybersteps program, including during the internship phase.
Qualifizierungsgeld: The Route for Large-Scale Workforce Change
Qualifizierungsgeld was introduced in April 2024 as a separate mechanism for employers facing structural transformation that affects a significant share of the workforce. It is worth knowing about, but also important to understand how rarely it is currently used.
Qualifizierungsgeld applies when:
- At least 20% of employees need training due to structural change, or
- At least 10% in companies with fewer than 250 employees.
Rather than subsidising course costs and wages directly, Qualifizierungsgeld pays a wage-replacement benefit to employees during training: 60% of the net pay difference, or 67% for employees with at least one child. Employers finance the training costs themselves, and a works agreement or collective agreement documenting the structural change is typically required.
Despite being in effect since April 2024, Qualifizierungsgeld remains dramatically underused. Bitkom data shows that only 140 employees across all of Germany benefited from Qualifizierungsgeld in 2025, compared to the tens of thousands who could theoretically qualify. For companies genuinely undergoing digital transformation at scale, this represents an untapped opportunity.
For cybersecurity specifically, this route is relevant for organisations shifting towards cloud operations, security operations centres, or compliance-driven roles where multiple employees need to retrain at the same time. Applications should be submitted no later than three months before training begins.
State-Level Funding: Additional Support on Top of QCG
QCG is a federal program, but many German states (Bundesländer) operate their own supplemental funding schemes for employee training. These can significantly increase the total subsidy when stacked on top of federal QCG support.
The following state programs were active in 2025-2026 based on Bitkom’s analysis. Programs and terms can change, so confirm current status with your state’s employment authority or Wirtschaftsförderung.
| State (Bundesland) | Program | Additional Subsidy |
|---|---|---|
| Baden-Württemberg | WeGebAU supplement | Up to 45% |
| Bayern | BayBFG supplement | Up to 40% |
| Berlin | Transfer BONUS | Top-up for structural change |
| Brandenburg | State supplement | Up to 50-60% |
| Bremen | State supplement | Up to 70% |
| Hamburg | Qualifizierungsoffensive | Up to 40% |
| Nordrhein-Westfalen | Bildungscheck 2.0 | Up to 50% |
| Sachsen-Anhalt | State supplement | Up to 90% |
Some of these state programs require a separate application submitted to a different authority from the Agentur für Arbeit. Asking your local business development agency (Wirtschaftsförderung) or the Agentur für Arbeit whether a state supplement applies to your situation is worthwhile before finalising your funding plan.
The combination of federal QCG and a relevant state supplement can, in some Bundesländer, approach full cost coverage for a cybersecurity Weiterbildung even for mid-size employers.
Frequently Asked Questions
Who can apply for QCG funding?
Employees in an existing employment relationship subject to social insurance contributions can be supported under QCG. The employer applies and coordinates with the Agentur für Arbeit. Self-employed individuals and civil servants are generally not eligible through this route. If you are currently unemployed, a Bildungsgutschein is likely the more relevant funding option. You can explore that route at
How long does the QCG application process take?
Based on Bitkom’s analysis of real applications, the typical timeline from first contact with the Agentur für Arbeit to funding approval is 4 to 8 weeks. Applications take roughly 30 to 60 minutes to complete. The Agentur für Arbeit must approve the application before training begins, so starting at least two months before the intended course start date is strongly recommended. For Qualifizierungsgeld applications, the official guidance is to apply at least three months before training begins.
How much of the training cost can actually be funded?
For small employers with fewer than 50 employees, the QCG can cover up to 100% of course costs and up to 75% of wage costs during training. In practice, Bitkom calculation examples show that a small employer sending one employee on a professional upskilling program at a course cost of approximately €8,300 could receive a combined subsidy of up to €15,800, depending on salary level and training duration. For mid-size employers, subsidies across groups of employees can reach tens of thousands of euros.
Does QCG cover online or remote training?
Yes. A June 2025 advisory update from AZAV certification bodies confirmed that digital and online formats are explicitly eligible. The training format (remote, blended, or in-person) does not affect QCG eligibility, provided the provider is AZAV-certified and the course meets the other requirements. The Cybersteps program is delivered fully remotely, making it accessible across Germany regardless of location.
What if I am not currently employed?
If you are unemployed or registered with the Agentur für Arbeit, a Bildungsgutschein (training voucher) is the more relevant funding route. This is separate from QCG and is designed specifically for people not in an employment relationship. You can learn more about how the Bildungsgutschein applies to cybersecurity training in Germany here.
What certifications does the Cybersteps program include?
The Cybersteps program includes preparation and exam vouchers for CompTIA Tech+, CompTIA Security+, Microsoft Azure Fundamentals (AZ-900), Microsoft SC-900, and the IHK Cyber Security Advisor qualification. In the specialisation module, students also earn one additional certification depending on their chosen path, such as CompTIA Project+, HTB CPTS, BSI IT-Grundschutz Practitioner, or Microsoft SC-200.
Is the Cybersteps cybersecurity program eligible for QCG funding?
Cybersteps offers a 3-12-month live-class curriculum plus a 2-month internship, well above the 120-hour minimum that QCG requires. The remote delivery format is explicitly eligible under a June 2025 advisory update to the AZAV framework. To confirm eligibility for your specific situation, contact the Agentur für Arbeit and ask Cybersteps to confirm the AZAV approval status of the course. Eligibility also depends on your employment situation and your employer’s willingness to submit an application.
The Bottom Line
Germany has a growing IT skills gap, a government funding mechanism designed to close it, and a cybersecurity training sector that barely uses the funding currently available. That gap is an opportunity.
The Qualifizierungschancengesetz is one of the most practical tools available for funding professional cybersecurity training in 2026. For small employers, it can make a full professional-grade program essentially cost-neutral. For larger organisations, it meaningfully reduces the barrier to upskilling employees in one of the most in-demand technical areas in the country. And for individual professionals in employment who want to build cybersecurity expertise, QCG offers a route to do it with their employer’s support and government co-funding.
Cybersecurity training is a strong fit for what QCG was designed to fund: future-relevant, transferable, in-demand skills that go beyond anything a company can build internally through short on-the-job training. A structured program like the Cybersteps Cybersecurity Weiterbildung, with 3-12 months of live instruction, six internationally recognised certifications including the IHK Cyber Security Advisor, extensive hands-on labs, and a real internship, is exactly what the program is built for.
The next step is straightforward. Contact the Agentur für Arbeit to confirm your eligibility, start the application process early, and reach out to Cybersteps to ask about AZAV approval status and enrolment options.
To learn more about the Cybersteps Cybersecurity Weiterbildung
If you are not currently employed, explore funding through a Bildungsgutschein
Ready to Build a Career in Cybersecurity?
