Bachelor's vs. Master's in Cybersecurity

A bachelor's and a master's in cybersecurity are not two sizes of the same thing. A bachelor's builds the computing foundation and general education around it. A master's assumes you already hold a degree and spends its credits on advanced or specialized work. Sometimes it also gives a career changer a structured way into the field. Which one fits depends less on ambition than on where you are starting from.

What a bachelor's is for

A bachelor's degree is the usual starting credential. The U.S. Bureau of Labor Statistics lists a bachelor's as the typical entry-level education for information security analysts and says they typically need a bachelor's degree in a computer science field along with related work experience. That describes the occupation as a whole, not the outcome of any particular degree.

A cybersecurity bachelor's typically combines general education with programming, networking, operating systems, mathematics and a run of security courses, often with a capstone, internship or cooperative education. Some programs make work experience part of the degree. RIT, for example, states that students in its cybersecurity bachelor's "are required to complete two blocks of cooperative education experience."

Browse bachelor's programs to see how much these curricula vary.

Three ways into a bachelor's

Not every bachelor's is open to every applicant. Read the entry route before anything else.

First-year entry

Most bachelor's programs admit students straight from high school. Technical programs may set high school course expectations. RIT's cybersecurity BS lists four years of mathematics through pre-calculus, with calculus preferred.

Completion programs

A completion program is built for people who already have college credit or an associate degree, and it is not open to applicants without those prior credits. Two examples from our research:

• Mississippi State's Bachelor of Applied Science in Cybersecurity requires an accredited Associate of Applied Science in cybersecurity, cyber defense, information systems security, network security or another computer-science-related field.
• George Mason's BAS with a Cyber Security concentration is available only to graduates of four named Virginia community colleges.

Transfer-friendly degrees

Some bachelor's programs admit first-year students but also accept large amounts of transfer credit. Excelsior University's BS in Cybersecurity page reads "Transfer up to 113 Credits." How much of your own credit applies is decided by the school after it evaluates your transcripts. The transfer and degree-completion guide covers this in more detail.

What a master's is for

A master's requires a completed bachelor's degree. Beyond that, programs aim at different people.

• Advancing professionals. Champlain College Online says it expects graduate applicants to have "experience or current employment in the field they intend to study," while considering limited experience case by case.
• Applicants from a computing degree. Many technical master's programs ask for a computing or engineering bachelor's. RIT's cybersecurity MS lists computing security, computer science, software engineering, IT and related fields, and admits others on a contingent basis.
• Career changers. Some programs accept any bachelor's but require foundation courses first. Davenport's MS in Information Assurance – Cybersecurity is open "no matter your undergraduate degree," with information security, cryptography, networking and statistics courses to complete before the program courses.

A master's does not have to be in the same field as your bachelor's. It does have to fit your preparation, or you pay for the gap in extra courses.

Typical master's prerequisites

Prerequisites fall into three groups: programming, networking and systems, and mathematics. How programs let you meet them differs:

• Foundation courses at the school. Kennesaw State's MS in Cybersecurity requires three foundation courses (programming principles, computing infrastructure, and data communications and networking) for students who have not taken those subjects in another degree.
• Bridge courses outside the degree count. RIT notes that bridge courses "are not counted toward the 30 credit hours required for the master's degree," so they add time and tuition.
• Non-credit learning. St. John's University requires base-level knowledge of programming and networking and accepts certifications, bootcamps or online certificates of about 40 hours as evidence.
• Credit courses only. UNM's MS in Cybersecurity and Business Analytics says its prerequisite courses "cannot be satisfied by work experience or non-credit certifications."

The programming prerequisites guide has more examples.

Combined and accelerated paths

If you are still an undergraduate, a combined program can shorten the route. George Washington University's combined BS/MS in Cybersecurity lets students take 6 graduate credits as part of their undergraduate program, which reduces the credits normally required for the master's. Rules for GPA, timing and which courses count are set by each school, so read the specific program's page.

How to decide

Ask yourself these questions in order:

1. Do you hold a bachelor's degree? If not, you are choosing among bachelor's programs. Check whether each one admits first-year students or is a completion program.
2. If you do, is it in computing? A computing bachelor's opens technical master's programs directly. Otherwise, add up the foundation or bridge courses each master's would require.
3. Do you have work experience in IT or security? Some master's programs require or expect it. Others, like Davenport's, do not.
4. What do you want the degree to add? Depth in a technical area, a move into management, or a first structured education in security point to different programs.
5. What does the full route cost? Compare total credits including prerequisites, not just the number printed on the program page.

When you have a shortlist, put the programs side by side on Compare and check each admission requirement against the school's own page.