One of the main challenges in the cybersecurity industry is the skills gap. This is manifested both as a lack of qualified staff and as a lack of general cybersecurity skills among the working population at large. To better the situa-tion, high-quality learning resources that capture the inherent sociotechnical nature of cybersecurity are needed. The focus of this research is on Cybersecu-rity body of knowledge (CyBOK) which is a comprehensive and free to access cybersecurity resource that comprise 21 topical texts called knowledge areas, and additional resources such as labs, lectures, and webinars. This research studies two cases where CyBOK has been used as a learning material in higher education. The goal of the study is to both evaluate the student's perception of CyBOK and the extent to which the comprehensiveness of CyBOK facilitates student engagement in topics not directly included in the assigned course material. The results suggests that CyBOK is indeed useful as a learning material for higher education and could support student engagement with cybersecurity, but the way in which it is explained and integrated into curricula is crucial.
The demand for human expertise in cybersecurity has become increasingly driven
by necessity, as organizations face a rapidly evolving threat landscape [
However, the wide range of skills and the fast-changing nature of the cybersecurity
field make it difficult to keep up with major developments. While looking at the EU
perspective, research identified that the gap in cybersecurity knowledge and skills is
partly due to the lack of proper education at the high school level. Furthermore, some
computer science teachers have limited knowledge in this area due to the breadth
of the domain. These issues have contributed to a shortage of qualified
professionals and workers in the EU's cybersecurity workforce [
To bridge this knowledge gap, access to cybersecurity knowledge resources is of
utmost need, both to support the skills development of cybersecurity professionals and
workers in other disciplines. Here, Open Educational Resources (OER) can play a
vital role in improving education in cybersecurity if the content is developed with
rigorous quality control processes and implemented through well-proven teaching
methods [
One significant initiative to improve cybersecurity education through OER was
undertaken at the University of Bristol through the CyBOK (Cybersecurity Body of
Knowledge) project. The CyBOK project is funded by the National Cyber Security
Programme and supported by the UK Cyber Security Council. The project
developed a structured guide to existing cybersecurity knowledge, mapping
established literature rather than replicating it. Since its 2019 release, it has expanded to
21 Knowledge Areas (KAs) through community input, with ongoing updates to
enhance its global relevance. The general approach to the development of those KAs
has been to let experts in the respective areas collaborate with the intent of creating
the best possible material in each area. CyBOK aims to be an internationally
recognized resource for academia, industry, and government [
Despite its structured approach, CyBOK’s integration into formal education remains an area that requires further study. To be formally accepted and recognized, it is necessary to assess its effectiveness in real-world learning environments. One way to achieve this is through academic course integration, where CyBOK modules are incorporated into university curricula, and students’ learning experiences are evaluated. Collecting student feedback on engagement, usability, and learning outcomes is essential in deter-mining whether CyBOK-based content effectively supports cybersecurity education and fills the knowledge gap in the field. As an OER covering many KAs within cybersecurity, is it also possible that the use of some KAs in one course may spark students' interest in pursuing knowledge in other KAs. This possible capability of CyBOK makes it different from traditional textbooks, which are typically contracted to one or a few topics. Understanding the extent of this effect in practice requires further research.
To that end, this study investigates the broader application of OER in cybersecurity education by analyzing CyBOK’s role in different learning environments, ranging from individual course components to fully integrated curricula. The research evaluates CyBOK’s effectiveness in student learning, engagement, and knowledge acquisition, providing insights that can inform best practices for integrating OER into cybersecurity education. This research also assesses the extent to which students who are exposed to selected KAs seek to explore other KAs spontaneously.
Empirical evidence on the effectiveness of CyBOK-based learning Insights into students’ preferences and engagement with OER materials Comparative findings across different learning environments Recommendations for enhancing CyBOK’s usability in academic settings By analyzing student feedback and engagement, this study contributes to the ongoing development of OER in cybersecurity education and informs best practices for inte-grating CyBOK into university curricula.
The following section outlines the methodology employed in this study, detailing the research design, data collection process, and analytical approach. This is followed by a presentation of results, where key findings from student feedback on CyBOK-based learning are examined, and then a discussion section. The paper concludes with a discussion of insights, emphasizing the significance of the findings, and provides recommendations for future research, including ways to enhance the integration and impact of CyBOK in cybersecurity education.
This study employs a qualitative research approach to explore the effectiveness and perception of CyBOK-based materials in cybersecurity education. The research is designed as a multi-case study, analyzing two different educational settings where CyBOK content has been integrated. By gathering qualitative insights through student surveys, this study investigated how students engage with, perceive, and utilize Open Educational Resources (OER) in cybersecurity courses.
The study examined CyBOK’s role in the following two distinct academic contexts: 1. A single CyBOK-based component integrated into a larger cybersecurity course.
2. A full campus-based course developed entirely around CyBOK.
This approach allows for a comparative assessment of CyBOK’s impact in different learning environments, ranging from supplementary learning materials to fully integrated curricula.
The data collection in this study was done using a qualitative survey. The survey was designed to capture student experiences and perceptions of CyBOK as an Open Educational Resource (OER) in cybersecurity education. The survey aimed to investigate the following key aspects considering the study goals: Students’ understanding and perception of CyBOK Comparison of CyBOK with traditional learning resources The extent to which students engaged with additional CyBOK materials beyond mandatory content Perceived strengths and limitations of CyBOK-based learning Suggestions for improving CyBOK as an educational resource To address these aspects, a structured questionnaire was developed and distributed to students who participated in CyBOK-integrated courses. The questionnaire comprised six open-ended questions, allowing students to express their thoughts, preferences, and critiques in detail. The following six questions were included in the survey: 1. How would you describe CyBOK? 2. What is your overall perception of CyBOK? 3. How do you think CyBOK compares to hard-copy books? 4. Have you used other CyBOK material beyond what was required in the course? 5. How can CyBOK be improved? 6. What are the best aspects of CyBOK? The qualitative nature of these questions allowed students to provide in-depth responses, offering insights into how effectively CyBOK supports learning, engages students, and enhances cybersecurity education. Additionally, the open-ended format encouraged students to reflect on their independent learning habits, particularly whether they sought additional resources beyond those required in the course curriculum. Responses were collected anonymously to encourage honest and unbiased feedback.
The survey was distributed to students enrolled in CyBOK-integrated courses in two different universities and learning formats. Data collection was conducted across multiple semesters to ensure comprehensive and diverse feedback. Moreover, the surveys were distributed electronically, ensuring accessibility for both campusbased and remote students. The study followed ethical research guidelines, ensuring voluntary participation, anonymity, and confidentiality of all student responses. Before partici-pation, students were informed about the purpose of the research, data usage, and their rights to withdraw at any stage. Data was collected from two different courses (Case 1 and Case 2) and from two cohorts of each course. The cases are introduced below: Case 1: Students from the Digital Forensics for Incident Response course at the University of ANON used CyBOK for one course module, which comprises about 2 ECTS credits. The mode of this course is hybrid, which allows students to attend classes virtually or on campus.
Case 2: Students from the cybersecurity course at ANON school of engineering used CyBOK as the primary resource for a complete course comprising 7.5 ECTS. The course is a campus course.
Thematic analysis, a method used to identify patterns, themes, and key insights from qualitative data was used to analyze the survey responses. The responses were systematically coded and categorized to highlight the following study goals:
The survey data was collected between January 2024 to March 2025, where the collection was distributed as per the applied context mentioned above in section 2.1 as case 1 and case 2.
For case 1, the first survey yielded 5 responses, whereas the second survey received 13 responses. Likewise, case 2 received 10 responses. To analyze the responses and finding common themes, thematic coding was applied on all received responses. The thematic analysis comes up with five main themes in students’ feedback on CyBOK-based learning. Table 1 below gives a summary of themes, categories, and example codes. The analysis found the following prominent themes 1. Interactive and Engaging Experience, 2. Initial Unfamiliarity and Misconceptions, 3. Need for Updates and Practical Context, 4. Comprehensive but Abstract Content, and 5. Ease of Use and Accessibility.
The following section presents each theme with illustrative quotes from the survey responses, highlighting what each theme suggests about CyBOK’s perceived strengths and weaknesses.
Many students found the learning experience with CyBOK to be engaging, especially when it was integrated into interactive class activities. Participants from the fully CyBOK-integrated course in Case 2, , particularly highlighted the “fun and engaging” nature of the learning, noting that it was “not too technical” for them. One student remarked that interactive lab sessions and discussions using CyBOK were “always more interesting than just reading from a book,” underscoring the value of hands-on and discussion-based learning. Another student appreciated the practical orientation, calling the CyBOK session “truly practical,” and emphasised that “practical labs… are always better than books” for learning complex topics. These responses indicate that when CyBOK content was delivered via active learning methods (labs, exercises, discussions), it succeeded in capturing student interest and engagement.
However, the data also suggests limits to this engagement. Outside the structured class exercises, few learners explored CyBOK further on their own. Most students did not use CyBOK beyond the required coursework. A Case 1 participant said, “Did not use beyond requirements,” when asked if they consulted CyBOK materials outside the assignment. Another participant wrote that“No – I have not had time,” while one student even stated to relying on “Google” rather than CyBOK for additional infor-mation.
This indicates that voluntary engagement with CyBOK was low; students generally did not continue to interact with the resource unless it was built into an exercise or assessment. The Interactive and Engaging theme thus has two sides: in-class, students found CyBOK-based learning enjoyable and motivating, but this engagement did not readily translate into motivated use of CyBOK after class. It suggests that while an interactive delivery can create interest, CyBOK on its own has not yet been perceived as the kind of internal motivation that makes students look into it deeper, without prompting.
A prominent theme, especially in the partially integrated Case 1, was a lack of familiarity with CyBOK and resulting misconceptions about its nature. Many students had never used CyBOK before. Noble quotes are Case 1 2023 student stated,
“Not familiar with CyBOK before. Heard it for the first time,”
“Not sure I understood what it is really, yet,” This reflects a general unfamiliarity among learners at the start. Even by the end of the course, some were still unsure. This uncertainty sometimes led to confusion about what CyBOK actually encompassed.
In a few cases, students misunderstood CyBOK for something related just to their course. For example, one student described CyBOK as “a malware analysis using Volatility,” confusing CyBOK with a specific forensic tool used in the class. Another response described CyBOK as “installation guide for Volatility and presentation of basic concepts of the tool,” again indicating a misconception that CyBOK was a software manual or a single-topic guide. These misunderstandings show that without a proper introduction, students struggled to grasp CyBOK’s purpose and scope. Only a few demonstrated a clear understanding. For instance, one respondent correctly identified CyBOK as “a project that aims to provide knowledge and guidelines from experts in cyber security…a resource for individuals seeking to build a career in cybersecurity, as well as for educators and organizations involved in cybersecurity training and research.” Such instances were rare; far more common were assumptions and misconceptions. The Unfamiliarity and Misconceptions theme reveals CyBOK’s awareness gap: many students started (and some even ended) the course without a firm idea of what CyBOK is, underscoring the need for better introductory orientation when integrating this OER.
In both case studies, students pointed out several limitations of CyBOK’s content and format, often accompanied by suggestions for improvement. A frequent sentiment was that while CyBOK is valuable, it needs to be kept up-to-date and made more practically relevant. For example, one Case 1 student noted that “it could be updated to work with Volatility 3 and also Linux platforms,” implying that some CyBOK materials (or related exercises) were outdated and did not reflect current tools or operating systems. While others reflected the importance of continuous updates, describing CyBOK as “ever-evolving” and urging that “it should be updated continuously.” The students desire for up-to-date content aligns with the fast-changing nature of cybersecurity knowledge, and the expectation that the resource is needed to keep pace with emerging tools, threats, and technologies.
Beyond the currency of content, practical application was a major sub-theme. Numerous participants from both universities wanted more real-world examples, hands-on exercises, and applied context to balance CyBOK’s theory. One student stated, “Include more practical exercises,” and this recommendation was repeated in various forms. Such as Case 1 2024 student added a comment that“We should have more practical labs like this,” which suggests that the practical element was valued but could be expanded. A Case 2 student similarly reflected that “CyBOK seems to be lacking in real-life scenarios” and that “many terms…are not used in the industry,” This emphasizes for content that connects to practical, and industry-relevant contexts.
When comparing CyBOK to a textbook, another student in Case 1 argued that a textbook “goes in more detail” and that “just reading books will not give practical knowledge to us.” This highlights a perception that CyBOK’s coverage, while broad, might be too high-level or abstract unless accompanied by concrete use-cases or technical depth, which also ties to the next theme (Comprehensive but Abstract Content).
Students also pointed out specific improvement ideas to enhance usability and guidance, indicating where the learning experience fell short. For example, several Case 2 respondents noted difficulties in knowing what to study in CyBOK. One said “Det var otydligt vad vi skulle läsa i boken – Tydligare läsanvisningar hade uppskattats,” which translates to “It was unclear what we were supposed to read in the book” Therefore, clearer reading instructions would have been appreciated for the course. This lack of guidance on how to navigate CyBOK made the resource less approachable. Likewise, a Case 1 student requested more upfront clarity: “Clarify what it is.” Others suggested incorporating an interactive guide or even “AI assistance…for user interaction” to help query CyBOK content. A few students encountered confusion due to the platform itself – one noted it “took me an hour before I realized I was reading the old version” of a CyBOK chapter, and recommended the removal or clearer labelling of outdated versions. These comments highlight that improvements in user guidance and platform design (such as better navigation, instructions, and version control) are needed to optimise CyBOK’s usability in an educational setting. In summary, the need for updates and a practical context theme covers all these perceived weaknesses. Students appreciate CyBOK’s value but want it to do more by staying current with the field, offering more hands-on examples and labs, and providing clearer guidance to learners. This theme points to CyBOK’s perceived weaknesses. Without adaptation or growth, it can feel static, abstract, or confusing, and this reflects students’ wishes and expectations to make improvements in CyBOK material from both the content creators and educators.
The analysis found that students generally recognised CyBOK as a comprehensive repository of cybersecurity knowledge. However, some viewed that strength as a twofold when it came to approachability. On the positive side, many comments praised CyBOK’s scope and authority. Students described CyBOK as “comprehensive” and “comprehensive in its coverage of network security, software security, human factors, hardware security, etc.” One Case 1 2024 respondent found it more comprehensive and said, “an essential, well-structured resource that standardizes and organizes cybersecurity knowledge, supporting lifelong learning, professional development, and global collaboration.” Others noted that CyBOK “gathered a lot of information in one place,” essentially serving as a one-stop reference for various cybersecurity domains.
This indicates a perceived strength in content scope. The students value that CyBOK organizes diverse topics, such as from laws and human aspects to technical fundamen-tals under one umbrella, which helps by saving them from searching through different sources. Even students who were otherwise not interested acknowledged that CyBOK is “a good initiative and has a lot of information about cyber security gathered at one place – like seminars, laws, use cases, and more.” In essence, CyBOK’s in-depth nature and community-vetted content were seen as major asset where participants regarded it as a “solid body of knowledge” and a “valuable resource for anyone involved in the field of cyber security.” At the same time, students’ feedback revealed that this very breadth and formality can render CyBOK challenging or “abstract” for learning. Several respondents felt that CyBOK’s content stays at a theoretical level, making it hard to digest or apply. For instance, a Case 2 student noted that without additional support, “the book could’ve been more useful – [it] seems to be lacking in real life scenarios, [with] many terms that are not used in the industry.” This comment points to a gap between CyBOK’s academic tone and the hands-on language practitioners use. Another student expressed a similar thought, by saying CyBOK “feels…abstract,” and one Case 1 participant frankly stated that “a book is better since it goes in more detail and the purpose is to learn” – implying that CyBOK’s summaries did not provide the depth or pedagogical structure that a dedicated textbook might. Indeed, a few students ultimately found CyBOK “quite useless” for learning compared to other resources, commenting that “there are more detailed manuals out there, [and] also quite good YouTube videos.” These harsher reviews underscore the risk that, without sufficient context or supplementary explanation, students may perceive CyBOK as too highlevel, too dense, or not directly relevant to skill-building.
This theme of Comprehensive but Abstract Content reveals a nuanced insight, students respect CyBOK’s authoritative scope and no one disputed its accuracy or completeness, but pedagogically, they struggled with it as a standalone learning material. The comprehensive coverage can overwhelm, and the academic prose can distance from practical understanding. It highlights CyBOK’s strength as a reference and its weakness as a textbook replacement, as students see the forest of knowledge, but some feel lost among the trees without guided pathways or concrete examples to ground the concepts.
The final theme captures overwhelmingly positive feedback regarding CyBOK’s usability and accessibility as an Open Educational Resource (OER). Students from both institutions appreciated that CyBOK was freely available and easy to access online, especially in contrast to traditional textbooks. Several noted the convenience of having a digital resource: “handy and easy to carry,” as one Case 1 student put it, comparing CyBOK’s downloadable PDF chapters favourably against lugging physical books. Another student, concisely summing up CyBOK’s advantages over static hard-copy texts stated that CyBOK is
“Freely accessible, continuously updated, and easily searchable online.” A student from Case 2 praised the openness and free access in terms of cost. The student commented, “Better to have it online because students are poor and all other books we had to buy – we got a PDF copy instead,”. This sentiment was also made by others who explicitly mentioned the benefit of no cost. The OER nature of CyBOK thus met a key student need, which is affordable access to learning materials. In terms of format and readability, many participants found CyBOK user-friendly. Students from Case 2 in particular, who engaged deeply with CyBOK chapters, commented on the clear structure and presentation of the material. The student said, “It has a good format… easy to read and has good illustrations,” noted one, while another agreed that “the documents were easy to read and follow.” Even students at Case 1 university who were less engaged overall still acknowledged that CyBOK was “easy to use and understand.” The availability of search functionality in digital PDFs or via the website and the ability to quickly find specific topics were implicit plus points that came up in comments about information being “easy to find.” In short, no student reported any technical or interface difficulties in accessing CyBOK on the contrary, therefore, accessibility and clarity emerged as clear strengths. One participant explicitly contrasted CyBOK’s format with printed books: “The digital version is, in my opinion, superior. It reduces cost and weight to carry around, and it’s easier to use software to make annotations and notes.” This indicates that, for most students, CyBOK’s digital format aligned well with their study preferences and needs.
It is worth noting that a small sample of people still expressed a preference for traditional textbooks. One responder admitted that“I personally prefer hard-copy books,” highlighting that learning style preferences vary. Such views, however, were in the minority. Most students valued CyBOK’s modern, open format and saw it as “easily accessible…for all of us,” “available for free, accessible by anyone without any restrictions.” Thus, the Ease of Use and Accessibility theme underscores CyBOK’s key strength as an OER. Since it removes barriers to access (cost and availability), and its format is generally student-friendly. This foundation of accessibility is important capital, and students are grateful for a free, high-quality resource. However, as the other themes showed, accessibility alone doesn’t guarantee deep engagement or learning. In combination with the previous themes, it becomes clear that while CyBOK’s form is excellent, its full educational impact depends on how the content is integrated and brought to life in the learning process. The table 1 below summarises the key themes identified, with their categories and example student phrases, which are described above in detail in the respective sections. Outdated content/issues Lack of practical examples Guidance, and usability improvements Comprehensive but
Extensive authoritative cover
Example Codes (Student Response Keywords) “fun and engaging”; “interactive discussions” “more interesting than just reading” “did not use beyond requirements” “never heard of CyBOK before” “not sure what it is”; “feels like a lab guide” “update for Volatility 3/Linux” “lacking real life scenarios”; “include more practical labs” “unclear what to read – need instructions” “lot of information in one Ease of Use and Accessibility age Theoretical/abstract nature Free and open access Convenient and user-friendly format place”; “comprehensive” “too abstract/theoretical”; “not enough depth” “freely accessible online”; “students are poor – PDF instead” “easy to read and understand”; “searchable, handy”
The results indicate that students appreciated CyBOK as a high-quality, accessible cybersecurity knowledge base, but the effectiveness of its use in teaching varied significantly depending on how it was integrated into the course. In the fully integrated course at university in Case 2, students reported higher engagement and noted Cy-BOK’s relevance and clarity, whereas in the partially integrated course at university in Case, many students remained unfamiliar with CyBOK or unsure of its purpose. Across both contexts, students highlighted CyBOK’s strengths, such as its comprehensive coverage and open accessibility, while also pinpointing weaknesses, such as a lack of practical application and the need for better guidance in using the resource. These findings align with the study’s goals of assessing student engagement, usability, and perception of CyBOK-based materials in different course formats. Below, this study critically examines the implications of these findings, compares the two case contexts, and situates the discussion in the broader literature on open educational resources (OER) and cybersecurity education.
A clear pattern is that effective integration of CyBOK into the curriculum is
important for student engagement. In the Case 2, CyBOK was used as a core learning
resource where an entire course was built around it, and students in that context
were considerably more positive about its value. They described CyBOK content as
“relevant to our course” and praised its readability and format. This suggests that
when CyBOK is closely aligned with course outcomes and when instructors
actively incorporate it into lectures, discussions, or assessments, then students develop
a stronger connection to the material. In contrast, in Case 1, where CyBOK was
used only partially, e.g., for a single lab assignment or as an optional reading,
students often did not develop the same level of familiarity or appreciation. Many Case
1 students admitted they “have not tried any [additional] resources from CyBOK”
and, in some cases, did not fully understand why they were using it. This difference
resonates with findings in OER research that students’ “feelings of connectivity
to the course” significantly influence their perception of the resource [
These observations underline a practical recommendation that instructors should
embed OER resources like CyBOK deeply and explicitly into the course design if
they expect students to engage with them. Simply assigning a chapter or two
without context risks CyBOK being seen as an afterthought. By contrast, designing
coursework, labs, or discussions around CyBOK content and clarifying how it maps
to learning objectives and assessments can motivate students to buy into its
inclusion. Our results also highlight the importance of instructor guidance. Students in
both cases called for clearer instructions on how to use CyBOK, e.g., reading guides,
specified sections to focus on, or objectives for what to gain from the readings.
This aligns with best practices for OER adoption, which prior research has noted that
faculty involvement and clear communication are critical for successful OER [
Another prominent implication of our findings is the need to bridge the gap between
CyBOK’s comprehensive theoretical content and students’ desire for practical
application. This is a familiar challenge in cybersecurity education where students and
employers expect hands-on skills and real-world context, not just theoretical
knowledge. CyBOK, by design, focuses on codifying established knowledge rather than
providing tutorials or labs, and we see very few examples where they have practical
guides. Our study found that students across both universities appreciated CyBOK’s
authoritative breadth, and no student disputed its accuracy or scope, however,
many felt it was “too abstract” or “lacking real life scenarios.” This feedback
suggests that CyBOK by itself may not satisfy learners who intend for experiential
learning, which is a well-known phenomenon in STEM education where theory
needs to be complemented by practice. The literature strongly supports
incorporating active learning for cybersecurity. Studies have shown that hands-on exercises
and labs significantly enhance skill acquisition and student engagement [
Encouragingly, there are initiatives already moving in this direction. For example, Attwood and Williams (2023) mapped UK cybersecurity job requirements to CyBOK to identify skill gaps which implicitly recognising that CyBOK’s content needs to be translated into skills. Likewise, the CyBOK project itself has funded the creation of educational resources, e.g. case study libraries and course modules, to aid instructors in applying CyBOK in teaching. Our findings point out the rationale for these efforts, where students clearly request “practical labs”, “real-world examples”, and more detailed explanations that connect abstract concepts to concrete situations. Incorporating such elements should improve student satisfaction and learning outcomes, as it addresses the currently perceived imbalance between theory and practice in CyBOK-based instruction.
The contrast between Case 1 and Case 2 provides valuable insights into how context and implementation strategy influence student experiences. In Case 1 where CyBOK was only partially integrated, e.g., used for a single project in 2023, and somewhat more in 2024 but still alongside other materials, students’ engagement with CyBOK was superficial. Many Case 1 students did not see CyBOK as central to the course, evi-denced by comments like “Not sure what CyBOK is” or “just reading books will not give practical knowledge” this implying they viewed CyBOK as just another reading. Some even bypassed the CyBOK resource when possible and opting for Google or other resources, and a few liked the discussion page regarding reflection, where one Case 1 student said that the best aspect of CyBOK was “the first and last page,” suggesting that the reflection section was great. In Case 2, with full integration, students were more informed about CyBOK and tended to speak of it as an integral part of their learning. They used positive descriptors, e.g., “good overarching information”, “easy to read”, “relevant to our course”, and demonstrated understanding of CyBOK’s purpose.
Notably, Case 2 students did not report the same level of unfamiliarity; instead, their critiques were more nuanced, focusing on the need for real-world examples or supplementary reading instructions, rather than questioning what CyBOK is. This suggests that full integration led to a deeper engagement and a more sophisticated appraisal of CyBOK, where students had enough exposure to evaluate its strengths and weaknesses, rather than simply feeling unsure about it.
From an educational standpoint, this difference reinforces the idea that consistency
and context matter [
Our findings aligned with broader OER research in several ways. First, the positive
reactions to CyBOK’s free and open availability confirm one of the oft-cited
advantages of OER, reduced financial burden and increased accessibility for students.
Participants explicitly noted the benefit of not having to purchase textbooks and having
materials freely available anytime, which is consistent with studies that show
students value the cost savings and convenience of OER [
Our results provide a case study of this, where the Case 2 course, in which the faculty
structured the syllabus around CyBOK, achieved better student-perceived outcomes
than the less structured approach. This aligns with findings that students’
satisfaction with OER is higher when they feel the OER is well-integrated into the course
and when instructors communicate its value clearly [
Furthermore, the call for more practical content and context around CyBOK connects
to the notion of “localizing” or contextualising OER for specific audiences. Authors
in [
Based on these themes and reflections, we present several practical recommendations for enhancing the implementation of CyBOK in educational settings:
Educators should introduce CyBOK early in the course, explaining its purpose, structure, and relevance. This might include a dedicated orientation session, providing students with a “user’s guide” to CyBOK, and making it clear how CyBOK aligns with exams or assignments. Throughout the course, instructors should give reading guides as students requested, for example, specifying which sections of a CyBOK chapter to focus on for a given week, and providing reflection questions to encourage critical reading. This would address the Unfamiliarity and Guidance issues by ensuring students are never left wondering why or how they should use CyBOK.
Both the content creators of CyBOK and the instructors using it can take steps to add
more practical context. CyBOK’s authors might consider adding application sections
or examples to each Knowledge Area, e.g., case studies, mini-scenarios, or pointers to
hands-on exercises where some of which could be community-contributed.
Instructors, on their part, should pair CyBOK readings with practical activities. For
instance, after students read a CyBOK chapter on Malware Forensics, the instructor
could run a lab using an open tool like Volatility, thereby connecting the conceptual
knowledge to a practical skill. Many students in our study specifically praised the
“memory forensics using Volatility” lab component, indicating that such integrations
are effective. By systematically creating lab assignments or discussion prompts
directly tied to CyBOK content, educators can prevent CyBOK from remaining an
abstract text and instead make it a springboard for active learning. This approach
would mitigate the Abstract Content issue and enhance the Interactive Experience,
potentially also motivating students to engage more deeply, since they can see
immediate, concrete outcomes from the knowledge. Previous research on student
learning and engagement in cybersecurity education has shown promising results,
highlighting increased student involvement and enhanced cybersecurity knowledge
through experiential or hands-on activities [
The CyBOK project should ensure that the platform clearly highlights the latest version of each knowledge area and perhaps archives or removes outdated versions to avoid confusion, as one student experienced in studied cases. Mechanisms for continuous updates, which the CyBOK editorial team already endeavours to do, should be communicated to users; for example, if a chapter has been revised recently, noting that can reassure students that the material is current. In an educational setting, instructors might want to supplement CyBOK with current examples from industry news or recent inci-dents to show how the static knowledge in CyBOK applies to evolving threats. This will address students’ calls for currency and reinforce CyBOK’s relevance. Additionally, improvements in the user interface could help, for instance, a better search function or a feature to create personal notes/annotations could make CyBOK more interactive for students accustomed to digital textbooks. While our respondents did find CyBOK easy to use overall, these enhancements could further increase engagement, perhaps even encouraging voluntary exploration if students find the platform userfriendly and dynamic.
One challenge highlighted by our results is that CyBOK serves multiple audiences (from novices to professionals), and some content may be too advanced or too “technical to outsiders” for undergraduates. To handle this, educators could identify and clarify difficult sections for students, effectively acting as interpreters of CyBOK. For example, if a CyBOK chapter assumes prior knowledge that students lack, the instruc-tor could prepare a short introduction or provide additional resources to bring students up to speed. On the flip side, advanced students might benefit from being pointed to deeper readings or research papers referenced in CyBOK. Thus, differentiating instruction using CyBOK, giving extra support to those who need it, and extension material to those who want more, can improve the learning experience across the spectrum. This addresses both ends of the Comprehensive but Abstract theme by leveraging the comprehensive content for those ready to absorb it, while easing the abstraction for those who are not.
To continuously improve CyBOK’s educational utility, a feedback loop is essential. The CyBOK initiative has already started gathering user feedback via surveys and workshops. We recommend that future student cohorts be actively encouraged to give feedback on their CyBOK learning experience, perhaps as a reflective assignment or via built-in feedback tools in the CyBOK platform. Student suggestions in our study, ranging from “add an AI Q&A feature” to “make it like a game” show that fresh ideas can emerge from the learner community.
Involving students in the evolution of Cy-BOK, for example, through student-led creation of study aids or examples, could also boost their engagement and sense of ownership. This aligns with the philosophy of OER, which encourages users to adapt and contribute back to open content.
The experiences from these case studies tie into the wider discourse on OER and
cybersecurity education. Our findings reinforce that OER adoption is not merely a
costsaving exercise but a pedagogical strategy that requires thoughtful
implementation. Students in our study held more favourable views of the instructors and
courses that effectively utilised OER (CyBOK) . A dynamic similarity was observed
in other contexts where students tend to rate courses using OER as more innovative
or supportive [
Looking forward, future research could explore developing structured course modules or learning pathways using CyBOK, and then measuring student outcomes in those courses versus more traditional courses. Our findings would predict that a well-structured CyBOK-based curriculum with the improvements that are discussed can perform on par with or better than textbook-based curricula in terms of student satisfaction and perhaps even knowledge gains. It would also be worthwhile to investigate the long-term effects on students who learned via CyBOK, for instance, do they retain the knowledge areas better, or are they more likely to consult CyBOK in their future work, compared to students who learned from a standard textbook? Such research could validate CyBOK’s role in not just immediate education but ongoing professional development, which is indeed one of CyBOK’s stated aims. Finally, the differences between Case 1 and Case 2 in our study highlight that institutional contexts such as class size, student backgrounds, and teaching style can influence OER adoption success.
Further comparative studies across institutions, including those in different
countries or with different student demographics, would enrich understanding of how to
tailor CyBOK’s use to various settings. For example, if students in some regions
have lower baseline familiarity with open digital resources, additional support
might be needed initially. The international CyBOK community is already
examining global adoption [
In conclusion, our results and discussion illustrate that CyBOK, as an OER in cybersecurity education, holds significant promise but requires careful implementation to realise its full benefits. Students acknowledge its comprehensive, high-quality content and appreciate its free accessibility, fulfilling key OER objectives of lowering costs and broadening access. At the same time, their voices make it clear that engagement and learning do not happen automatically simply because the resource is available. The educator’s role in contextualising CyBOK through integration into the course structure, providing guidance, and adding practical learning opportunities is crucial. When that is done, as seen in the fully integrated case, students can indeed find CyBOK “fun and engaging” and “essential” to their learning. When it is not, students may tune out, misconceive the resource, or revert to familiar study habits, undermining the OER’s impact. These findings contribute to a more nuanced understanding of how a domainspecific OER like CyBOK is perceived by learners, and they offer actionable insights for improving CyBOK’s use in teaching. By addressing the identified weaknesses like improving orientation, enhancing practical content, and maintaining ease of use, universities can better harness CyBOK as a living, evolving body of knowledge that not only informs students but actively engages and empowers them. This alignment of CyBOK’s strengths with pedagogical best practices will ultimately support its mission to be “an internationally recognized resource for academia, industry, and government”, benefiting not just the students in these case studies but the cybersecurity education community at large.
Acknowledgments This research has been supported by the CyBOK project through “mini-project” support. Declaration on Generative AI During the preparation of this work, the author(s) used Grammarly and ChatGPT in order to: Grammar and spelling check. The author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content.