Conceptual Analysis Outlines Three-Dimensional Framework to Assess Cybersecurity Workforce Readiness

A conceptual analysis published in Frontiers in Education outlines a structured framework to evaluate and develop professional readiness across the United States cybersecurity workforce, targeting persistent deficits in non-technical capabilities. Authored by Lyubov Didukh of the Health Care Service Corporation in Chicago alongside Oleksandr Khlevnoi and Nazarii Burak of the Lviv State University of Life Safety in Ukraine, the study argues that contemporary educational models address workforce preparedness only in part. These critical shortfalls center on interpersonal communication, critical thinking, and the execution of sound professional judgment under intense operational pressure.

To contextualize the operational urgency of workforce readiness, the authors reference several high-profile cybersecurity incidents documented in official government and industry reports. These historical events include the 2017 Equifax data breach, the 2020 SolarWinds software supply-chain compromise, and the 2023 MOVEit campaign, which significantly extended threat exposure beyond conventional organizational boundaries. The researchers observe that formal post-incident reviews of these events routinely highlight pervasive coordination breakdowns and accountability problems operating alongside acute technical and governance failures. However, the authors explicitly emphasize that these notable historical cases serve strictly as contextual illustrations of complex organizational operating environments, rather than empirical evidence demonstrating that readiness failures directly caused the breaches.

To systematically map existing educational approaches, the authors conducted a documented literature review querying the OpenAlex and Education Resources Information Center databases for relevant research published from 2018 through 2026. From an initial corpus, the review synthesized findings across 83 included studies to evaluate how training programs assess non-technical proficiencies. The synthesis revealed that only 19 of the 83 examined studies evaluated at least one non-technical readiness dimension on an individual learner basis.

Additionally, 13 of those 19 studies assessed readiness only through learners' self-reports. Across all 83 analyzed studies, none simultaneously combined individual-level assessment across motivational, cognitive, and communicative readiness dimensions, formal alignment with the National Initiative for Cybersecurity Education Framework, and the systematic evaluation of artificial intelligence outputs within a scenario-based developmental cycle. To bridge this gap, the authors adapted a three-component model of professional readiness that had previously achieved experimental validation in emergency-services education, translating its foundational pedagogical architecture into the operational domain of cybersecurity education.

At the core of the proposed architecture is the Contextual Readiness Assessment, an evaluation methodology engineered to produce a comprehensive three-dimensional profile for each individual learner. This diagnostic tool assesses Motivational-Goal readiness, Cognitive readiness, and Communicative-Activity readiness, mapping these attributes directly against the standardized components of the National Initiative for Cybersecurity Education Framework version 2.2.0.

To cultivate these capabilities following baseline assessment, the authors developed a situated intervention methodology termed Cyber-Quest. This scenario-based learning environment is designed to drive professional growth through four distinct instructional mechanisms: role-activated professional identity, obligatory information asymmetry, deliberate evaluation of artificial intelligence artifacts, and structured experiential debriefing.

The Contextual Readiness Assessment and the Cyber-Quest intervention are linked into an iterative assess–develop–reassess developmental cycle that actively incorporates artificial intelligence tools. Within this training cycle, learners are required to deliberately evaluate both accurate and intentionally inaccurate artificial intelligence-generated outputs against empirical evidence and ground-truth scenario data.

Throughout their conceptual analysis, the authors maintain precise theoretical boundaries by explicitly distinguishing professional readiness from related constructs such as competence, immediate operational performance, and self-efficacy beliefs. To demonstrate how the integrated model functions in practice, the paper illustrates the full developmental cycle through a hypothetical cybersecurity use case and details the specific environmental conditions upon which the framework relies. Importantly, the authors note a primary limitation: while the underlying three-component model was experimentally validated in emergency-services education, this adapted cybersecurity framework has not yet been validated in cybersecurity populations, concluding with a staged validation plan to guide future empirical investigations.

Subject of Research: Three-dimensional assessment and scenario-based intervention framework for cybersecurity workforce readiness

Article Title: Cybersecurity workforce readiness: a three-dimensional assessment and scenario-based intervention framework aligned with NICE

Article References: Didukh, L., Khlevnoi, O., & Burak, N. (2026). Cybersecurity workforce readiness: a three-dimensional assessment and scenario-based intervention framework aligned with NICE. Frontiers in Education, 11, Article 1958161. https://doi.org/10.3389/feduc.2026.1958161

Image Credits: AI Generated

DOI: 10.3389/feduc.2026.1958161

Keywords: cybersecurity workforce readiness, Contextual Readiness Assessment, Cyber-Quest methodology, NICE Framework Components v2.2.0, non-technical readiness, professional judgment under pressure, scenario-based learning, AI-generated artifacts, calibrated trust, information asymmetry, experiential debrief, emergency-services education, OpenAlex, Education Resources Information Center, role-activated professional identity, Motivational-Goal readiness, Communicative-Activity readiness, staged validation plan