Executive Summary

China launched a government program to certify World-Class Cybersecurity Schools (WCCS; ⼀流网络安全学院)¹ in 2017. The Ministry of Education and Cyberspace Administration of China (CAC) have since awarded 11 universities the WCCS designation. Seven U.S. federal agencies, led by the Department of Homeland Security and the National Cryptographic School at the National Security Agency, similarly certify qualifying U.S. universities as Centers of Academic Excellence (CAE) in the areas of cyber defense, cyber research, and cyber operations.² Receiving a CAE, or WCCS, certification allows a university to promote its program as a rigorous course of study. Students from these institutions can quickly receive recognition on a job application for obtaining an excellent education in cybersecurity. Both the U.S.-CAE and China-WCCS programs set standards of excellence for cybersecurity education and aim to bolster the talent pool for each nation’s respective cybersecurity sector.

China’s WCCSs offer more courses in artificial intelligence/machine learning (AI/ML) in their cybersecurity programs than do the U.S. CAE-Cyber Operations degrees. Eight of China’s 11 WCCS universities integrate classes on AI and ML into their cybersecurity degree programs; only one of the 20 U.S. universities certified in cyber operations offers an optional class on machine learning. Over time, China will gradually produce a significant cohort of graduates with both cybersecurity and AI/ML skills. Such widespread knowledge of both skills may increase innovation for, and speed adoption of, AI-enabled cybersecurity tools. By contrast, the U.S. CAEs do not develop valuable ML skills as part of the talent pipeline; the number of graduates with both cybersecurity and AI skills would increase significantly if the U.S. were to add an AI/ML course option or requirement for CAE degree programs.

This difference in competencies for cybersecurity professionals, typified by the differences in curriculum examined here, may grant China a growing advantage over the United States as both nations try to adopt AI-enabled cybersecurity tools or securely deploy AI-enabled systems. In the United States, the well-developed cybersecurity talent pipeline can quickly adopt measures to remediate differences between these two curricula. The seven U.S. agencies tasked with overseeing the CAE program should monitor the progress of 13 National Science Foundation awards that are testing new class structures that teach both AI and cybersecurity and consider adding new AI/ML knowledge units.

1. The PRC government launched its “world-class universities and world-class curricula” (世界一流大学和一流学科) initiative, abbreviated “double world-class” (“双一流”), in 2017 with the aim of increasing the number of Chinese universities that rank among the world’s best. In August 2017, the Cyberspace Administration of China released its “Notice on the Publication of Management Methods for the Demonstration Project for Building World-Class,” which established World-Class Cybersecurity Colleges as a subset of the “double world-class” initiative. See “Original CSET translation of ‘Notice on the Publication of Management Methods for the Demonstration Project for Building World-Class Cybersecurity Colleges,’ Cyberspace Administration of China (CAC, and 国家互联网信息办公室), Center for Security and Emerging Technology, August 14, 2017, https://cset.georgetown.edu/publication/notice-on-the-publication-of-management-methods-for-the-demonstration-project-for-building-world-class-cybersecurity-colleges/.
2. National Security Agency, “National Centers of Academic Excellence in Cybersecurity,” accessed June 29, 2021, https://www.nsa.gov/resources/students-educators/centers-academic-excellence/.