This paper explores the growing significance of vulnerability disclosure and bug bounty programs within the cybersecurity landscape, driven by regulatory changes in the European Union. The effectiveness of these programs relies heavily on the expertise of participants, presenting a challenge amid a shortage of skilled cybersecurity professionals, particularly in less sought-after sectors. To address this issue, the paper proposes a collaborative approach between academia and bug bounty issuers.

To keep up with the growing number of cyber-attacks and associated threats, there is an ever-increasing demand for cybersecurity professionals and new methods and technologies. Training new cybersecurity professionals is a challenging task due to the broad scope of the area. One particular field where there is a shortage of experts is Ethical Hacking. Due to its complexity, it often faces educational constraints. Recognizing these challenges, we propose a solution: integrating a real-world bug bounty programme into the cybersecurity curriculum. This innovative approach aims to fill the practical cybersecurity education gap and brings additional positive benefits.

The cybersecurity field is a fast-paced, ever-changing, and complex environment. Society’s growing dependency on ICT combined with the rising number and seriousness of cyber threats emphasizes the need for a sufficient number of cybersecurity experts, who are, at the moment, still pretty scarce. Furthermore, the lack of common methodology, understanding of individual cybersecurity work roles, and the disparate perspectives of cybersecurity stakeholders from diverse backgrounds (academia, public entities, private sector) further hinder any long-term solutions. In our previous contributions, we presented the National Qualifications Framework in Cybersecurity, which could provide a solution for a sufficiently up-to-date, broad, and granular taxonomy of skills requirements for existing and future cybersecurity work roles that could mitigate this problem. The Platform, including the curation mechanism, was created for this Framework to be easy to navigate, administer, update and flexible. This enabled further utilization (and possibly even development) of the available inputs and synergies from existing qualification frameworks, such as the NICE Framework and the European Cybersecurity Skills Framework. In this article, we introduce and analyze the curation mechanism and the challenges of navigating cybersecurity qualification frameworks and producing a sufficient UI. Primarily we focus on the specific functions of the curation mechanism, e.g., the feedback collection and Framework updates, which could be adapted even for other framework content or languages and thereby implemented in parallel solutions. Therefore, we present the Platform, including the curation mechanism, as a dynamic common reference tool for cybersecurity workforce requirements.

The scarcity of cybersecurity experts negatively affects the overall state of cybersecurity among all relevant stakeholders in the private and public sectors. The efforts to close the cybersecurity skills gap are unfortunately limited by the lack of a sufficiently broad and granular taxonomy. In this article, we introduce our work on the Czech National Qualifications Framework in Cybersecurity as a possible remedy for the said problem. Firstly, we shortly describe other relevant projects and initiatives. Further, we focus on the development process of the Czech Framework, its components and their interactions, and subsequently we focus on the Platform and its functions. This interactive platform offers other stakeholders (and future users) an effective access to the framework and its further utilization. It also simplifies and allows for an effective administration and update of a framework on this level of granularity.

This paper is focused on challenges connected with the persisting imbalance between the supply and demand of the cybersecurity expert workforce. We analyse the current situation in the Czech Republic, finding that although the shortage of experts affects the private and public sectors both, the public sector is constrained by a massive financial undervaluation of cybersecurity experts and other legal and systematic deficiencies and obstacles and therefore has a much lower chance of attracting talents in this field. The inability of public institutions to find relevant workforce causes, among other things, problems with formulating public procurements, assessing offers and communicating their requirements to the supply-side of the labour market. One of the solutions to this crisis might be in the systematic support of education programmes. However, the cybersecurity field is so dynamic and fragmented that the alignment of the education programme with the market needs presents a significant challenge. There, a unified qualifications framework could serve as a basis for finding common ground. We focus on the benefits of creating such a framework, especially the benefits that a united taxonomy can bring to the cybersecurity labour market by bolstering cybersecurity higher education. Finally, we summarise the key features of the cyber-qualifications framework that is being developed under our current project and highlight its potential use for labour market optimisation and efficient development of new cybersecurity study programs and further education.