Educational institutions face a critical challenge in preparing students for the cybersecurity workforce, particularly those offering dedicated cybersecurity programs or aspiring to achieve recognition as centers of academic excellence (Marquardson and Gomillion, 2018). The growing demand for qualified professionals in this dynamic field has prompted institutions to continually adapt curricula to equip students with relevant technical and professional skills.

A notable trend in cybersecurity education is the interdisciplinary integration of cybersecurity competencies across multiple academic and professional domains. This approach reflects the pervasive nature of cybersecurity challenges and emphasizes the need for individuals from diverse backgrounds to acquire foundational knowledge in cybersecurity. As McDuffie and Piotrowski (2014) note, essential cybersecurity skills span information technology, risk management, criminal justice, computer science, ethics, and policy development. Zorz (2018) further highlights the importance of technical expertise in programming languages, system architecture, administration, and certifications, while McGettrick (2013) underscores the relevance of soft skills, including effective communication.

The diversity of students’ prior knowledge and professional experience presents additional challenges for curriculum design. Students entering cybersecurity programs often have varied IT and professional backgrounds, necessitating curriculum structures that provide foundational knowledge while supporting advanced learning and development. Evaluating the alignment between program content and industry needs is therefore essential to ensure graduates are prepared for the evolving demands of the workforce. Consequently, the study does not only describe current practice but also structures it analytically through the ECSF-based Cybersecurity Curriculum Alignment (ECCA). Framework and a taxonomy of program types.

Existing frameworks, such as the European Cybersecurity Skills Framework (ECSF) and the NICE Framework, provide structured approaches to identifying skills required for specific cybersecurity roles (Petersen et al., 2020; ENISA, 2024). This study adopts the ECSF due to its relevance in the European context, using it to analyze Swedish cybersecurity programs and assess their effectiveness in fostering essential competencies. Additionally, perspectives from program coordinators were collected to identify challenges, opportunities, and evaluation practices, offering insights into the alignment between educational programs and workforce requirements. This research contributes to understanding and enhancing cybersecurity education in Swedish universities, ensuring graduates are equipped for diverse roles in a rapidly evolving field.

This study investigates how curriculum content prepares students for effective roles in cybersecurity. By examining what is taught in Swedish cybersecurity programs, it aims to identify the key knowledge, skills, and competencies essential for success in the field. The central research question is:

The research evaluates the effectiveness of current curricula in addressing the evolving demands of the cybersecurity landscape, providing insights to guide future improvements in education.

The study focuses only on Swedish universities offering cybersecurity master’s programs. Vocational schools, corporate training programs, and bachelor-level programs were excluded. Only compulsory courses were included because elective courses differ between students and cannot guarantee consistent role preparation. The analysis is also limited by the availability of publicly accessible information.

In cybersecurity, frameworks provide foundational structures that guide education, training, and workforce development. They establish a shared understanding of professional role profiles, including relevant skills and competencies. Competencies combine knowledge, technical skills, and human dispositions, representing an individual’s ability to perform tasks at varying proficiency levels (Parrish et al., 2018). Within educational contexts, frameworks are used to define learning outcomes, providing a common language that facilitates communication of tasks, expectations, and qualifications across academic and professional environments.

The NICE framework provides detailed structures for defining cybersecurity work roles, including the associated knowledge, skills, and abilities (KSAs) required to perform them. Knowledge refers to information applied directly to tasks, skills denote observable competence, and abilities indicate the capacity to apply knowledge and skills effectively to produce tangible outcomes (Newhouse et al., 2017). Tasks are defined as specific activities that, combined with other tasks, fulfill responsibilities within a specialized role. The framework is widely used in education to design curricula that align with professional requirements, with particular emphasis on knowledge areas essential for each role.

The CSEC2017 Joint Task Force (JTF) resulted from collaborative efforts by ACM, IEEE, AIS SIGSEC, and IFIP WG 11.8. It provides guidance for cybersecurity programs to integrate theoretical knowledge with practical skill development. The framework organizes content into Knowledge Areas (KAs) and Knowledge Units (KUs), representing thematic groupings of topics necessary for each area. This structure enables educators to ensure that curricula comprehensively cover both foundational and applied cybersecurity knowledge (CSEC2017 Joint Task Force, 2017).

The European commission report aims to harmonize cybersecurity terminology and definitions across the EU. While it does not specify required knowledge or skills, it provides a coherent taxonomy of cybersecurity domains and subdomains, supporting consistent communication and categorization of competencies across educational and professional contexts (Fovino et al., 2019).

CyBOK consolidates widely acknowledged cybersecurity knowledge from textbooks, research, and standards into a unified framework. It defines knowledge areas to provide a shared vocabulary, goals, and approaches to cybersecurity education. By mapping curriculum topics and learning outcomes to these knowledge areas, CyBOK enables comparisons across programs and serves as a foundational guide for designing comprehensive curricula (Rashid et al., 2021; Hallett et al., 2018).

The ECSF defines twelve role profiles for cybersecurity professionals commonly employed in European organizations. Each profile includes key skills, knowledge, and competencies, offering a standardized language for curriculum development and program alignment. The framework supports higher education, vocational training, and other educational initiatives by guiding course learning outcomes, enabling joint programs, and promoting student mobility. ECSF emphasizes knowledge requirements for each role, assisting universities in designing programs that prepare graduates for specific professional responsibilities while aligning education with labor market needs (Di Franco and Grammatopoulcs, 2022). In the Swedish context, European skills frameworks are relevant because universities operate within the European Higher Education Area and are expected to support mobility and comparability of qualifications. Coordinators in our study described using ECSF and related European documents as informal reference points when discussing program revisions, even when they are not formally mandated. ECSF is therefore treated not as a rigid template, but as a flexible guide that can be interpreted and adapted to local institutional regulations, degree structures and pedagogical traditions.

For each program, only compulsory courses were included in the mapping, because elective courses, project courses and theses differ between students and cannot guarantee consistent role preparation. Course titles and detailed learning outcomes in the official syllabi were compared with the knowledge units in the European Cybersecurity Education and Professional Training Minimum Reference Curriculum. When a course title exactly matched a curriculum item (for example “Network and Applications Security”), it was assigned to the corresponding role or roles in the European Cybersecurity Skills Framework. For courses that were not explicitly listed, the first author read the course description and learning outcomes and coded the course to the role whose knowledge units best reflected the main focus of the course. For instance, a course emphasizing network architecture, secure configuration and administration was mapped to the Cybersecurity Architect and Cybersecurity Implementer roles.

The study focused exclusively on academic programs offered by Swedish universities, excluding vocational or private institutions. Emphasis was placed on Master’s degree programs (60–120 credits) explicitly addressing cybersecurity, information security, or network security. Programs were identified using the official Swedish university admissions portals (Universityadmissions.se, 2025; Antagning.se, 2024) for the Autumn 2024 semester. To ensure relevance, search terms included “Cybersecurity,” “Information Security,” and “Network Security,” alongside their Swedish equivalents. Systematic exclusion of duplicate programs, non-relevant offerings, and programs with both Swedish and English versions resulted in a refined sample of twelve Master’s programs offered at 11 Swedish universities, comprising 91 compulsory courses.

To complement document analysis, semi-structured interviews were conducted with program coordinators responsible for the selected cybersecurity programs. This qualitative method was chosen for its ability to capture nuanced perspectives and in-depth insights into curriculum design, course content, and graduate preparedness (Barriball and While, 1994). Interviews were conducted via Zoom, allowing flexibility for participants across different locations while maintaining the benefits of face-to-face interaction. Participants received a summary of the ECSF prior to interviews to provide context, but were not informed of the specific interview questions to ensure unbiased responses. Seven coordinators participated, representing a mix of cybersecurity and information security programs, providing rich, context-specific data. The interviewees included program directors and course coordinators with backgrounds in computer science, information systems and information security, and with several years of experience in curriculum development. To reduce the risk of social desirability bias, interviews were conducted by a researcher who was not directly involved in the programs under study, and participants were assured that their institutions and programs would not be identifiable in the reporting. During analysis, contrasting views were noted and retained rather than forced into a single consensus narrative, and interpretations were discussed among the author team to check for alternative readings of the data.

The interviews were structured following a five-step guide, encompassing preparation, leveraging existing knowledge, developing and piloting the interview guide, and finalizing questions (Kallio et al., 2016). Questions focused on four main areas: program design and frameworks, role relevance and essential skills, assessment and evaluation, and success factors and challenges. This structure allowed participants to reflect on curriculum alignment with ECSF roles, industry needs, and the effectiveness of their programs in developing key professional competencies.

Interview recordings were transcribed verbatim to facilitate in-depth qualitative analysis (Kvale, 2007). Data analysis employed descriptive and pattern coding techniques, identifying recurring themes and patterns across interviews. Attribute coding was also used to contextualize responses based on participant roles and institutional characteristics (Wholey et al., 2010). This iterative approach ensured that emerging insights were continuously refined and integrated, enhancing the reliability and validity of the findings.

All interview transcripts were imported into qualitative analysis software (NVivo) and coded by the first author. An initial codebook was developed deductively from the interview guide (program design and frameworks, role relevance and skills, assessment and evaluation, success factors and challenges) and was then refined inductively as new themes emerged in the data. To enhance consistency, previously coded transcripts were revisited whenever new codes were added or definitions were adjusted. Descriptive codes captured what coordinators reported, while pattern codes grouped related statements into higher-level themes on, for example, curriculum change processes or collaboration with industry.

The combination of document analysis and semi-structured interviews strengthened the study’s validity by triangulating multiple data sources (Denzin and Lincoln, 2005). Framework-based mapping provided a structured and consistent evaluation of curricula, while interviews allowed for exploration of participant perceptions and experiences. Reflexivity, neutral descriptors, and pattern matching were applied to minimize bias and ensure credible interpretations (Johnson, 1997).

As introduced previously, the European Cybersecurity Skills Framework (ECSF) defines twelve roles in the cybersecurity domain, each requiring a distinct set of knowledge and competencies. These roles are designed to cover the diverse range of responsibilities and challenges encountered by cybersecurity professionals in contemporary organizations. The twelve roles are:

These roles reflect the increasing complexity and interconnectedness of modern digital systems. The ECSF framework serves as a benchmark for defining the competencies needed to fill these roles and provides a reference point for evaluating cybersecurity education programs.

CyberSec4Europe has conducted a comprehensive review of cybersecurity educational and training initiatives across Europe (European Cyber Security Organization, 2023). This initiative curates a wide range of programs and contributes to the development of the European Cybersecurity Education and Professional Training Minimum Reference Curriculum. By leveraging this framework, the study aimed to assess the alignment of Swedish university programs with the knowledge requirements associated with each ECSF role.

To align university courses with ECSF-defined knowledge areas, the study employed a mapping approach based on the European Cybersecurity Education and Professional Training Minimum Reference Curriculum (European Cyber Security Organization, 2023). Table 1 summarizes how each course corresponds to the ECSF roles. It is important to note that the Minimum Reference Curriculum emphasizes foundational knowledge and skills required for each role. These courses provide essential preparation but do not guarantee mastery or readiness for independent professional practice. For instance, a course in “Cybersecurity Principles” may contribute to the competencies needed for a CISO but is not sufficient on its own to fully prepare a graduate for this role.

Table 1 illustrates these alignments with several concrete examples. Courses such as “Network and Applications Security” and “Vulnerability Assessment and Threat Management” address technical content on secure network configuration, attack techniques and incident handling, and are therefore mapped mainly to the Penetration Tester, Cyber Threat Intelligence Specialist, Digital Forensics Investigator and Cyber Incident Responder roles. In contrast, courses like “Information and Cybersecurity Management” and “Cybersecurity and Digital Era Leadership” focus on governance, risk management, regulatory compliance and strategic decision-making, which align more closely with roles such as Chief Information Security Officer, Cyber Legal, Policy and Compliance Officer and Cybersecurity Risk Manager. This combination shows how different types of curriculum content support distinct clusters of ECSF roles.

Graduates are assumed to be ready for junior-level roles, such as trainee positions, where practical experience complements theoretical knowledge (European Cyber Security Organization, 2023). Elective courses, project-based learning, and thesis work were excluded from the mapping due to their variability across students, focusing the assessment solely on core program components.

The mapping demonstrates that while foundational courses are covered across multiple universities, specialized topics such as AI security, cloud security, and machine learning security appear less frequently. This disparity highlights potential gaps in preparing students for emerging cybersecurity challenges, and suggests that curricula could be strengthened by expanding dedicated content on AI security, machine learning security and cloud security beyond the small number of courses currently identified. This course to role mapping forms the curriculum level of the ECCA Framework and provides the empirical basis for distinguishing different types of Swedish cybersecurity related master’s programs in the taxonomy presented later in the article.

Figure 1 illustrates the frequency of courses offered by universities, while Figure 2 summarizes the number of roles each university addresses. The data indicate that certain emerging topics, including AI, machine learning, and cloud cybersecurity, are underrepresented, suggesting areas for curriculum development.

Interviews with program coordinators provide qualitative insights into the design, implementation, and evaluation of cybersecurity programs in Sweden. Respondents were divided into two categories: coordinators from cybersecurity-focused programs and those from information security programs. Findings are organized into four thematic areas: Program Design and Framework, Role Relevance and Essential Skills, Assessment and Evaluation, and Success Factors and Challenges.

Responses revealed variations in the adoption of frameworks such as ECSF, CSEC2017, and CyBok. Some coordinators integrate frameworks extensively, while others adapt existing courses or develop new ones to address identified gaps. Coordinators highlighted that ECSF serves as guidance for professional roles rather than academic program design. Many emphasized that universities should focus on foundational knowledge and research competencies, leaving role-specific vocational training for post-graduation or industry programs. Within the ECCA Framework these interview insights correspond to the program design and institutional conditions levels, showing how local choices and constraints shape ECSF alignment in practice.

Coordinators noted the importance of aligning programs with industry demands. Technical programs emphasize skills for Penetration Testers and Digital Forensics Investigators, while managerial or human-centric programs focus on CISOs and Risk Managers. Internship opportunities remain limited, and industry requests for trainees with broad skill sets underscore the value of versatile graduates.

Universities employ metrics such as graduate employment rates, student feedback, and industry input to evaluate program effectiveness. Initiatives like Cybercampus Sweden aim to consolidate resources, promote cross-university collaboration, and enhance research and education in cybersecurity. While frequent minor updates occur, comprehensive curriculum redesigns are less common due to resource constraints and the complexity of implementation.

Key factors for program success include responsiveness to industry developments, balanced theoretical and practical training, and inclusive learning practices. Challenges include recruiting qualified faculty, rapidly evolving technologies, and the resource-intensive nature of implementing new courses. Coordinators stressed the importance of developing both technical and soft skills, including communication and management competencies, to prepare graduates for diverse professional roles.

The results indicate that Swedish universities provide foundational knowledge for all ECSF roles, but specialized courses are unevenly distributed. Interview findings highlight the tension between academic priorities and industry needs, with practical constraints affecting program design and update frequency. Emerging areas such as AI, machine learning, and cloud security are less represented, suggesting potential directions for curriculum enhancement. Overall, the integration of course mapping with interview insights provides a comprehensive view of Sweden’s cybersecurity education landscape, highlighting strengths, gaps, and opportunities for continuous improvement.

In summary, the main empirical findings are: (1) all twelve ECSF roles are covered across the Swedish programs, but the depth and specialization of coverage vary substantially between institutions; (2) technical roles such as Penetration Tester, Digital Forensics Investigator and Cybersecurity Architect are strongly represented in some programs, while managerial and policy-oriented roles are more visible in others; (3) emerging domains such as artificial intelligence security, machine learning security and cloud security are only marginally addressed in compulsory courses; and (4) structural constraints on staffing, time and internal processes limit the pace at which programs can respond to new competence needs.

This study include the small sample size of seven interviewees and the evolving nature of university programs, which may affect the generalizability of the findings. Time constraints and participants’ availability further limited the breadth of data collection. Future research could expand to survey all Swedish universities offering cybersecurity programs, employ longitudinal designs to track curriculum evolution, and investigate standardized methods for assessing program effectiveness. Future work should focus on comparative analyses of different educational frameworks, examining their strengths, limitations, and applicability within Sweden. Research into systematic evaluation methodologies for cybersecurity programs could support curriculum enhancement and ensure alignment with both industry demands and societal needs.

To sum up, the study demonstrates that while Swedish universities offer broad coverage of cybersecurity roles aligned with the European Cybersecurity Skills Framework (ECSF), gaps remain, particularly in specialized areas such as AI, cloud technologies, and machine learning security. Universities exhibit varied approaches to program design, reflecting both strengths in adaptability and challenges in ensuring consistency. Internship opportunities remain limited, potentially hindering students’ practical exposure. Success factors include staying abreast of industry trends, integrating practical skills, and fostering inclusivity, while challenges include rapid technological change, recruitment of qualified staff, and resource constraints. Initiatives like Cybercampus Sweden highlight opportunities for collaboration and innovation, emphasizing the need for continued dialog between academia, industry, and policymakers to ensure that cybersecurity education remains effective, relevant, and responsive to evolving challenges.