International Workshop on Authentic Cyber Security Education 2025

This report captures the insights and recommendations from the International Workshop on Authentic Cyber Security Education held at the CSE Connect Advancing Cyber Security Education Conference at Warwick University in July 2025. Its purpose is to share findings on how authenticity in learning and employability can be embedded across the five stages of the Student Education Lifecycle while addressing barriers and enablers as identified by educators, students, and industry. A key outcome of the workshop is the identification of collaborative projects as next steps to address the identified barriers and work towards implementing solutions. If you would like to contribute to these initiatives or collaborate on future discussions, please get in touch with the authors listed at the end of this report. During the workshop, we focused on the Student Education Lifecycle using examples from the NeuroUnity [6] summary report to guide participant conversations around barriers and enablers at each stage. The lifecycle stages that we used in the workshop were: 1. Recruitment, 2. Onboarding, 3. Everyday life, 4. Progression and development and finally 5. Exit into Workplace or leaving university early. Largely driven by today’s employability agenda in Higher Education, authenticity in learning, assessment and employability is usually framed in terms of activities and assessment that reflect ‘real-world’ situations. The workshop presented an opportunity for participants to engage with peers and stakeholders on these experiences, and to generate and share ideas. These factors largely reflect the ongoing dialogue we have had at International Cybersecurity Education Collaborative [ICEC]. Stakeholders included academics, students, staff responsible for student recruitment, employers and professional bodies present in the room. The workshop was ‘student centric’ and met to discuss this overarching question. How do we ensure that in supporting employability will we also meet the needs of individual students who wish to be their authentic selves, and how does that look across different cultural contexts and experiences during cyber-education into industry? This workshop allowed us to take account of a range of factors that make up authentic approaches that work for employers, students and educators, alike. Attendance and input on the day came from, NCSC, The Cyber Scheme, IASME, GCHQ, Warwick University, University of Roehampton, Sheffield Hallam University, California State University, San Bernadino [CSUSB], North Carolina Central University, Crowdstrike, Neurodiversity Global, Shift Key Cyber, some CSE Connect Accelerator students and the Canadian Centre for Cyber Security Learning Hub, plus NCyTE Mentor for their Centres of Academic Excellence and CSE Connect. This document presents our findings from the workshop and explores how the Student Education Lifecycle—from recruitment to exit—can be used to understand and improve the journey of students as they evolve into unique individuals with diverse needs and interests, ultimately entering a workforce equipped with authentic skills. It integrates recent statistics and policy insights from both the UK and the U.S., highlighting: • There has been a rise of diagnosed neurodivergence among Gen Z by 53% in the UK, and 51% in the US [1] 1 • Financial and structural pressures on universities [2] • The mismatch between cyber security education and entry-level job availability [3] • Successful inclusion and workforce development policies in the U.S. • A shared responsibility among students, educators, and industry to reduce barriers and amplify enablers The Student Education Lifecycle framework is designed to support workshops, policy development, and strategic planning, with ongoing collaboration encouraged through CSE Connect and ICEC. This report has identified three project topics for further discussion in Appendix 1.: how can universities best utilise industry engagement; how showcasing successful educators building cyber industry networks, and students setting up inclusive cyber societies can be replicated as best practise across regions; and lastly how best to engage educators to use AI for future student workplace employability, as seen in The AI Horizon project [4]. In the vein of strategic planning, recommendations made in the EMC Strategy Whitepaper [5] have been supported directly from the evidence shared during the workshop in Appendix 2., as a set of enriched, ready-to-paste bullets. The report with suggested project topics, underscores the urgency of aligning education with real-world opportunities, especially in high-growth sectors like AI and cybersecurity, where entry-level jobs remain limited despite rising demand. During the workshop, we collated feedback from each table discussion which is included in this report in bullet point format (see Section 3). Due to the nature of the lifecycle stages there were cross over conversations relating to both university and working life. There was general agreement from all involved that removal of barriers across the education lifecycle could be facilitated by. • Early exposure to cybersecurity through camps, work experience, collaborative networking events and bootcamps • Onboarding with real-world simulations, focusing on availability of support groups, and industry engagement • Hands-on learning that builds confidence and supports industry • High-retention internships and access to work experience, via academic and industry relationships, bypassing entry-level bottlenecks • Industry-aligned curriculum that prepares students for evolving roles “As educators, we help students to understand cyber security disciplines and the wider sector, reflecting and respecting their authentic self into the roles available, because they are needed and have valuable insights to offer.” Zoe Fowler, Strategic Facilitator.

The workshop commenced with two presentations to help set the scene and explain the purpose of the workshop. The first of two speakers, Dr Deanne Cranford-Wesley, Professor at North Carolina Central University and NCYTE Consultant; spoke on her teaching strategy and pedagogy for cybersecurity education which exemplifies how immersive, early engagement across the student lifecycle can remove barriers and foster industry readiness. Cranford-Wesley’s programmes exemplify how targeted interventions across the student lifecycle-, from early engagement to workplace transition, can remove barriers and foster authentic career readiness. Her bootcamps for high school teachers and summer cyber camps for students support the Recruitment phase by introducing cybersecurity early and sparking interest in underrepresented groups. During Onboarding, her university students encounter immersive learning environments, such as a forensically taped-up classroom and crime scene simulations, which build excitement and relevance from day one. In Daily Life, students benefit from experiential learning that connects theory to practice, including visits to real courtrooms to observe evidence presentation. Her Progression and Development model includes internships that result in 85% of students retaining industry roles, directly addressing the barrier of limited entry-level opportunities. Finally, her approach to Exit ensures students leave with confidence, skills, and professional exposure removing friction at the transition to employment. Our second speaker, Amy Hysell, shared her inspiring journey into cybersecurity as a non-traditional student returning to education after raising her children. She enrolled at California State University, San Bernardino (CSUSB), where she pursued a cyber degree and now serves as a partnership manager, coordinating strategic engagements across state and national levels. Her experience highlights the importance of accessible pathways for adult learners, and she actively encourages others—especially those returning to campus later in life—to pursue their educational goals. Hysell’s journey into cybersecurity illustrated how the Student Education Lifecycle can be navigated successfully by non-traditional learners when barriers are removed, and support systems are in place. Her return to education highlights the importance of flexible entry points and inclusive messaging during the Recruitment phase, enabling universities to attract adult learners. At Onboarding, her positive experience at California State University, San Bernardino (CSUSB) reflects the impact of welcoming environments and tailored support. Throughout Daily Life, Amy balanced family responsibilities with academic demands, underscoring the need for flexible scheduling and strong community-building for mature students. Her Progression and Development into a strategic leadership role shows how education can unlock meaningful career advancement, into a second career specifically for women after family. Finally, her Exit into the workplace stands as a powerful example of how non-traditional students can thrive post-graduation and contribute significantly to industry, reinforcing the value of inclusive pathways across the entire student lifecycle.

Workshop attendees were put into five groups, with each group asked to identify the barriers and enablers for a particular stage of the Student Education Lifecycle. The results from each group are summarised below. Group 1: Recruitment into University and during job searches. It was this first part of the lifecycle that highlighted the need for three project areas which are supported subsequently through enablers listed by participants, so more context around each bullet point has been given during the documenting of the first stage. The rest are documented as listed by participants. We believe using the first lifecycle stage to focus on these projects will deliver a more positive impact across the subsequent stages of the education lifecycle and into the workplace for all participants, students, educators and industry. Barriers to effective Recruitment • Inauthentic Interview Dynamics: Students who are under pressure in an interview, when introduced to a panel and given names and job titles believe they need to tailor responses based on panel members’ job titles. Additional, new information at the interview stage adds to stress factors and reduces the ability of authenticity from the student. • Confusing Website Navigation: University websites and campus maps are often unclear, even for staff as noted during this event, making access to information difficult, especially neurodivergent students, staff and industry visitors. • Stressful Assessment Activities: Time constraints and pressure during interviews hinder students’ ability to interpret questions and recall competency-based examples. This is true of both workplace and university interviews. Needing additional time and context ahead of completing activities would support research capability over memory testing under pressure. • Limited Entry-Level Opportunities: Both students and educators report difficulty finding accessible entry-level roles, contributing to frustration and disengagement. Is AI impacting the lack of such roles and what can industry and educators do, to get ahead of this. A project topic [PT1] is available to explore. • Poor Communication with Industry: Universities often invite employers without sharing agendas, and employers may lack understanding of academic content. Industry professionals in the room agreed that instead of being asked to create content and deliver a whole session to a university group alone; a better use of time would be to highlight topics areas across the curriculum and invite them to classes to be the SME and participate in the overall class. This would have two benefits; they could use their time more wisely and get an idea of how educators deliver creating a much more holistic systems approach to education. A project topic to look at implementation of this is available. [PT2] • Disconnected Business Development Teams: These teams are expected to bridge employers with academic staff, but struggle to, limiting opportunities for real-world integration into learning modules. Educators say that they have many hats to wear to deliver success for students. Educators are proactively engaging with industry and attending local cyber hub communities. This additional extra-curricular activity reduces work-life balance and impacts on wider university reach as the cyber industry engagement is linked to personalities instead of 4 the university’s centralised business development team. A project idea to see how we could get educators and internal teams to engage further was recommended by industry and educators. [PT3 ] Enablers to effective Recruitment into University and during job searches • Support for Neurodivergent Thinkers: Growing awareness and inclusive practices help neurodivergent individuals thrive, especially when supported by knowledgeable teams who create the right environment. • Reasonable Adjustments: Accommodations like extra time or advance access to interview questions improve experiences for all, not just neurodivergent students. • Student Curiosity: Demonstrated curiosity is valued by both educators and industry, signalling engagement and potential. • Timely Communication: Quick responses and clear points of contact—especially around accommodations— enhance the recruitment experience. • Strong University-Industry Relationships: Employers with established university contacts are better positioned to support students meaningfully. • Welcoming Environment: Friendly and empathetic interviewers and staff foster a sense of belonging and reduce anxiety. Group 2: Onboarding Barriers to effective Onboarding • Students as individuals feel depersonalised, treated as a single cohort. • Lack of support for personal challenges and teacher needs. • International students face employment restrictions. • Fast-paced environments trigger imposter syndrome and isolation. • Overwhelming resources, unclear certification paths, and poor social integration. • Absence of mentorship and guidance during transition from online to real-world settings. • High emotional and financial cost of pastoral care for educators. Enablers for effective Onboarding • Personalised onboarding that recognises individual needs. • Clear expectations and structured induction programs. • Supportive environments with mentors, buddies, and peer networks are engaged. • Neurodiversity-friendly practices like advanced organisers and early campus access and curriculum run throughs. This would be a great time to invite industry along to meet educators and students. • Amenities and orientation events that foster comfort and community. • Strong communication and use of student ambassadors to guide new arrivals. Group 3: Daily Life Barriers to effective Daily Life • Students lack internal communities and mentors; educators face overwhelming workloads with little support. • Poorly designed workspaces, confusing websites, and rigid study plans add stress. 5 • Neurodivergent traits, mental health challenges, and unrealistic expectations (e.g., availability 24/7) hinder wellbeing to students and educators. • Limited career guidance, unclear certification paths, and weak university-industry coordination reduce relevance and support. Enablers for effective Daily Life • Strong university communities, mentorship, and flexible working models foster inclusion. (PT4 One CSE Connect Accelerator Student is part of a university cyber society that allows students from multiple disciplines to attend and participate. We would like to map and showcase as best practise the ‘how to’ and benefits for other students, whilst CSE Connect builds a network) • Reasonable adjustments, hybrid learning, and diverse assessment types support varied needs. • Industry-aligned, project-based learning and internships enhance real-world readiness. • Resources like HR support, employability groups, and interview prep improve student outcomes. Group 4: Development and Progression Barriers to effective Development and Progression • Misalignment between curriculum and industry needs. • Lack of diversity and rigid progression paths favouring neurotypical norms. • Poor understanding of careers and skills needed for cyber industry. • Insufficient industry engagement and outdated course content. • Career advice without depth of knowledge, AI bias, and lack of support for neurodivergent students and employees. • Challenges navigating unspoken university or career rules and the evolving of job roles. Enablers of development and progression • Inclusive training for both soft and technical skills. • Open, supportive communication with academia, and workplace managers. • Structured progression planning through goal setting and clear objectives leads to a positive experience. Collaboration with Local Cyber Cluster: Working alongside local cyber clusters and managing university contacts there. Group 5: Exit Stage Barriers to effective exiting of university or work role • Poor admin processes and negative management responses during exit. • Difficulty transferring partial academic credits and delays in learning validation. 6 • Late industry engagement leads to disengagement of students and added costs for all involved especially if students leave early. • Discrimination, inflexible university procedures, and outdated faculty industry knowledge. • Misalignment with Gen Z expectations and lack of career clarity. Enablers during exit stage • Exit interviews and accelerator programs ease transitions. • Alumni success stories and early industry involvement boost motivation. • Supportive organisations and inclusive graduation events improve experiences. • Student group engagement, learning transfer options, and graduate tracking aid career pathways. • Collaboration with local cyber clusters and well-planned leaving events foster positive exits.

As Daniel Aldridge (MP) said in his foreword to the EMC Strategy Whitepaper [4], “In an era defined by rapid technological change and escalating threats, the importance of building a resilient and digitally capable workforce is fundamental to our country's future economy. Yet too often, well-intentioned efforts to develop cyber talent have remained fragmented and misaligned with the real-world needs of employers, educators, and aspiring professionals.” Our workshop has proven that when industry, educators and students come together and share their authentic experiences of the system that currently exists without judgement, opportunities to reduce barriers for all can be agreed and worked upon. ICEC and CSE Connect can use these opportunities to build out projects that will showcase best practise highlighting to their wider communities, that in supporting employability, meeting the needs of individual students as their authentic selves into a workplace that is becoming more adept at inclusive practises, and finding ways to engage industry to become willing to understand curriculum and support educators; all within the system will have a more authentic understanding of each other. Please see the following appendices for projects to get involved in and how this workshop supports the recommendations to the EMC Strategy Whitepaper.[4] Finally, thanks to Dr Deanne Cranford-Wesley and Bill Gardner for their input into this report.

Project Topics for further discussion If you would like to get involved in any of the below projects, get in touch with the authors.

• PT1 - AI in education and the impact on entry-level roles as students gain degrees. ICEC are running talks and engaging a wider audience to think about this from a systems perspective. The problem and barrier with empowering AIs promising role in education is not AI nor the student. How can we best support educators who are low on time and incentive to change out of date lesson plans.

• PT2 – Industry wants to engage with Universities – How best can industry individuals, be engaged without bearing the load of what is often a single invite due to time pressures. Universities have open days, student onboarding, early campus access events that industry could attend to meet University administration and cyber educators to be part of understanding the student lifecycle and where they could assist educators, inputting into wider curriculum as SME’s without using huge limited time resource to building and running and a presentation lecture alone.

• PT3 – University ICEC & CSE Connect Network building by showcasing best practise A. Cyber Societies run by students; what are they doing, how and why; and B. University Educators engaging local cyber industry; what they are doing and how other regions can replicate.

Appendix 2. Community Workshop report supporting the recommendations from EMC Strategy Whitepaper

PT1 – Roles, Language, and Alignment (Taxonomy)

• Fragmented role definitions slow hiring and curriculum design — context: employers, educators, and professional bodies use different taxonomies, so people talk past each other and mis-hire or mis-train. Action: Stand up a DSIT-led taskforce to co-create a UK Cyber Skills Taxonomy with employers, educators, and CIISec, BCS and UKC3; publish v1 with roles, levels, competencies, and progression routes, and schedule annual updates tied to labour-market evidence.

• Job ads over-specify, under-clarify — context: “entry level” roles often demand 3–5 years’ experience or legacy proxies (e.g., CISSP), excluding capable entrants. Action: Issue skills-based recruitment guidance mapped to the taxonomy; attach light-touch incentives (grant scoring, best-practice seals) for employers adopting skills-first job descriptions and practical assessments.

• Framework sprawl erodes trust — context: multiple static frameworks age quickly; employers revert to internal definitions. Action: Mandate taxonomy validation cycles with CISO teams and hiring managers across verticals (finance, health, defence, SMEs) so definitions reflect real roles being filled now.

PT2 – Education & Careers Pipeline (Earlier, Broader, Clearer)

• Cyber starts too late — context: careers are shaped before university, and KS3/KS4 exposure is uneven. Action: Embed baseline cyber + risk literacy from Key Stage 2, with age-appropriate modules and teacher CPD; align DfE guidance and LSIPs to the taxonomy so school → FE/HE → work pathways are explicit.

• Degrees miss real-world breadth — context: over-specialisation (e.g., everyone wants pen testing) and weak integration of risk, communication, business, ethics. Action: Require accredited courses to map modules to taxonomy competencies (technical + behavioural + governance), with interdisciplinary options (law, psychology, business) and assessed simulations (IR tabletop, board comms).

• Career changers and adult learners lack on-ramps — context: bootcamps are uneven; awareness and affordability gaps persist. Action: Fund conversion micro-credentials tied to the taxonomy’s foundational roles; create a national RPL (recognition of prior learning) rubric so veterans, IT ops, and self-taught candidates can evidence competencies without redundant training. 9

PT3 – Apprenticeships & Entry-Level (Fix the Bottleneck)

• SMEs can’t host apprentices at scale — context: levy rules, admin burden, and mentoring capacity are barriers. Action: Launch an SME Cyber Apprenticeship Support Pack (brokered mentors, shared services, stipend offsets) and regional hubs to co-host apprentices across small firms.

• “Day-one” capability isn’t defined — context: providers teach to quals; employers want demonstrable competencies. Action: Publish taxonomy-aligned Day-One Profiles per role (e.g., SOC Tier 1, GRC analyst) with concrete task checklists (log triage, playbook run, risk register update) and make them the assessment standard for apprenticeships.

• Entry roles demand mid-level credentials — context: exclusionary ads entrench inequity. Action: Create a national entry-level badge (portfolio + practical) endorsed by DSIT/industry that substitutes for years-of-experience in public-sector and supplier procurement.

PT4 – AI, Automation, and the Regional/SME Divide seniority

• AI is erasing junior tasks and reshaping roles — context: SOC triage automates; threat actors use AI; pathways to narrow if juniors don’t get reps. Action: Introduce AI-Cyber hybrid competencies across all roles (adversarial ML basics, secure model use, data governance); require human-in-the-loop exercise hours so early-career staff still build judgement.

• Frameworks aren’t AI/quantum-ready — context: static role profiles age out quickly. Action: Bake “emerging tech deltas” into the taxonomy with quarterly addenda (AI, quantum-safe crypto, automation ops), and co-fund pilot curricula with clusters/universities to test and iterate.

• Regional access and SME capability lag — context: 99% of UK businesses are SMEs; many regions lack provision and awareness. Action: Scale CyberLocal-style regional delivery as a National Implementation Framework: LSIP-aligned outreach, community micro-credentials, school-to-SME pipelines, and a ring-fenced SME Skills Support Fund for training and toolkits.

• Awareness and guidance are fragmented — context: teachers, advisers, and small firms don’t see clear, localised options. Action: Run a “Cyber for All” national campaign using the taxonomy’s plain-English role map; provide regional role snapshots (top sectors, typical stacks, entry routes) and one-stop guidance portals.