Swedish universities struggle to teach AI security as cyber skills gap widens
A study of 12 master's programs across Sweden found that while universities cover all major cybersecurity roles, they're unevenly preparing students for emerging threats like AI and cloud attacks. The gap could leave European employers scrambling for talent as cyber threats grow more sophisticated.
Originaltitel: Aligning cybersecurity higher education with European skills frameworks: insights from master’s programs in Sweden
Introduction Cybersecurity education is expanding rapidly, yet universities face challenges in aligning curricula with evolving labour market needs and emerging domains such as artificial intelligence security and cloud security. This study examines how Swedish master’s programmes align with the European Cybersecurity Skills Framework and how European skills frameworks are translated into curriculum practice. Methods A mixed-methods design combined document analysis of 91 compulsory courses across 12 master’s programmes at 11 Swedish universities (Autumn 2024 intake) with semi-structured interviews with seven programme coordinators. Courses were mapped to European Cybersecurity Skills Framework role profiles using course titles, learning outcomes and the European Cybersecurity Education and Professional Training Minimum Reference Curriculum, and findings were interpreted through the European Cybersecurity Skills Framework based Cybersecurity Curriculum Alignment framework. Results Across the national set of programmes, all European Cybersecurity Skills Framework roles are covered, but depth and specialization vary substantially between programmes. Technical roles are strongly represented in some programmes, whereas others emphasise governance, risk and compliance roles. Emerging areas such as artificial intelligence security, machine learning security and cloud security are only marginally addressed in compulsory curricula, and programme coordinators report constraints related to staffing, time and slow institutional change processes. Discussion The findings suggest that national alignment to a European skills framework cannot be assessed only by counting covered roles, but must also consider programme design logics, curriculum content depth and institutional conditions for change. Stronger use of the European Cybersecurity Skills Framework in curriculum planning, clearer role oriented learning outcomes, increased industry collaboration and more structured practice based elements could improve graduates’ readiness for cybersecurity careers.