An analysis of the top 121 US undergraduate computer science programs found that none of the top 10 require students take a cybersecurity course
Kelly Jackson Higgins / darkREADING :
Context & Ripple Effects
This analysis lands mid-arc in a string of studies probing how US computer science education feeds the security workforce. It follows a [[a:831157|survey of 121 universities showing CS graduates are far more diverse than the people major tech companies actually hire]], and it precedes reporting that CS enrollment doubled to over 106,000 students between 2013 and 2017 while the professor supply fell behind (the enrollment surge).
The finding that none of the top 10 programs require a cybersecurity course matters because it predates two demand-side signals: a review finding only 5% of the global top 100 companies list a CISO or CSO in their leadership pages (the CISO representation review), and a survey of 500+ cybersecurity pros cataloguing exactly which candidate skills are most frequently lacking (the practitioner skills survey).
First-order effects
- Students graduating from the top-ranked US CS programs enter the job market without any mandated exposure to security coursework, leaving employers to screen for or train up security knowledge themselves.
Second-order effects
- The gap shifts training burden onto employers and bootcamps — consistent with the practitioner survey showing certain skills repeatedly missing in candidates — and gives lower-ranked schools that do require security courses a differentiation argument in recruiting.
Third-order effects
- If the pattern holds under the enrollment boom, curricula will keep lagging because faculty capacity is already strained, pushing security credentialing further toward industry certifications and employer-side programs rather than degree requirements.
The trend: University CS curricula are structurally slower than the security labor market they feed, and the widening gap between enrollment growth and faculty supply makes mandatory security coursework less likely, not more.