Cybersecurity PhDs and Other Research Doctorates

A research doctorate is a different kind of degree from a bachelor's or master's. Coursework is only the first stage; the degree is awarded for original research, written up as a dissertation and defended before a committee. This guide walks through what cybersecurity PhD programs actually require, using their own catalog wording, and explains how to tell a documented cybersecurity track from a general doctorate with security faculty.

Research doctorate vs. professional doctorate

Our PhD listings include PhDs and other research doctorates. Professional doctorates (DSc, DEng, DIT, EdD and similar) are not PhDs, and we list one only if the institution itself describes it as a research doctorate. Old Dominion University, for example, offers both a PhD in Cybersecurity and a Doctor of Engineering with a cybersecurity concentration; its catalog describes the DEng program as educating engineering practitioners. Both are doctorates, built for different purposes.

The milestones of a PhD

Program names differ, but the sequence is similar across the catalogs we reviewed.

1. Coursework and research credits

George Mason University's PhD in Cybersecurity requires 72 credits, of which 48 must be coursework and 24 research. Old Dominion requires at least 18 credit hours of doctoral dissertation, in addition to its coursework.

2. Finding an advisor

The advisor relationship shapes the whole degree, and programs handle it differently:

• Old Dominion assigns a faculty advisor on admission and expects the student to identify a dissertation

advisor by the time formal coursework is completed.

• At George Mason, admission to the PhD in Cybersecurity also depends on alignment with the department's

faculty research expertise and the applicant's area of interest.

• Purdue's Interdisciplinary Information Security program says you do not need a major advisor before

applying.

• Northeastern University assigns a dissertation advising team of two cybersecurity faculty members, one in

a technical area.

Before you apply, read faculty research pages and, where the program invites it, contact potential advisors.

3. Qualifying or candidacy exam

Old Dominion requires a PhD candidacy examination. George Mason's PhD in Information Technology describes an oral comprehensive exam, typically two hours long. Northeastern's route to candidacy combines core courses with a 3.5 GPA and either a paper published in a strong conference or journal or an oral exam by three cybersecurity faculty.

4. Dissertation proposal

George Mason requires a written dissertation proposal presented to the dissertation committee before advancement to candidacy. Old Dominion requires a successful proposal defense. National University's online PhD uses a pre-candidacy prospectus course before doctoral candidacy.

5. Dissertation and defense

George Mason requires a final public oral defense with the entire committee present. Northeastern requires a dissertation that involves original research in cybersecurity, which the student must defend.

Teaching requirements and time limits

Some programs require teaching: Old Dominion lists a cybersecurity teaching practicum, the University of Texas at San Antonio says all PhD in IT students must teach at least one course unless granted a waiver, and Northeastern has a teaching requirement for graduation. On time, Northeastern says students entering with a bachelor's degree typically need four to five years, Old Dominion's requirements must ordinarily be completed within eight years of admission, and National University sets a seven-year limit from matriculation.

Residency: what "online PhD" really means

"Residency" has two meanings in doctoral catalogs, and an online label does not settle it:

• On-campus visits. Dakota State's PhD in Cyber Operations is offered online but includes three required

on-campus residencies of approximately three days each.

• Continuous full-time study. Northeastern requires one year of continuous full-time study after

admission to candidacy.

• None stated. National University says its online PhD in Cybersecurity has no residency requirement.

Our program profiles record residencies, required campus visits and dissertation defenses separately.

Funding: assistantships, packages and limits

Funding varies more at the doctoral level than anywhere else:

• Northeastern says all students admitted to its Computer Science and Cybersecurity PhD programs receive a

five-year funding package.

• UTSA says full-time PhD in IT students are generally funded with a research or teaching assistantship that

includes paid tuition and fees for up to four years.

• Old Dominion's School of Cybersecurity periodically offers graduate teaching assistantships, and faculty

may support students through externally funded research grants.

• Dakota State says assistantship awards are not available for its online PhD in Cyber Operations.

CyberCorps: Scholarship for Service also covers research-based doctoral students, according to OPM, with a government service obligation afterward; see our scholarships and service obligations guide.

Reading a "PhD track" claim

Many universities do security research inside a general computer science or computing PhD. That is not the same as a documented cybersecurity track. We list a broader PhD only when the catalog or program page formally names a cybersecurity track, concentration or specialization, for example George Mason's PhD in Information Technology with a Concentration in Cyber Security Engineering or UTSA's PhD in Information Technology with a Cybersecurity Concentration. At Purdue, the Interdisciplinary Information Security degree is granted through the student's home department with INSC listed as the concentration.

A lab or faculty interest does not count. Carnegie Mellon's CyLab, for instance, says several colleges and departments offer PhD programs whose faculty and students are active in CyLab research; we found no formally documented cybersecurity PhD track there, so those programs are not listed. That says nothing about research quality, only about what the degree formally is. Our methodology explains the rule.

Where CAE-R fits

The NCAE-C program includes a Center of Academic Excellence in Cyber Research (CAE-R) designation. According to the CAE Community, eligible institutions are DoD schools, PhD-producing military academies, or regionally accredited PhD-granting universities that are classified as R1, R2 or R3 doctoral universities or justify significant research. Institutions must apply for re-designation every five academic years.

CAE-R is held by an institution. It is not accreditation, and it does not by itself tell you that a given PhD program exists, is formally focused on cybersecurity, or is funded. Check our list of CAE-designated schools, then check the program itself.

Questions to ask a PhD program

1. Is this a research doctorate (PhD) or a professional doctorate?
2. Is the cybersecurity focus a documented track, or a research area within a broader degree?
3. How and when is an advisor matched to you?
4. What are the candidacy, proposal and defense requirements, and the time limit?
5. Are there campus residencies, and how often?
6. What funding is offered to admitted students, for how many years, and with what duties?