Methodology and Sourcing
What we list, how we verify it, and what we do not claim.
Last updated 11 October 2026
We currently list 554 cybersecurity programs at 146 schools (190 of them formal concentrations inside broader degrees), and record 367 related offerings we checked and did not list — certificates, associate degrees, minors and degrees without a formal cybersecurity curriculum — on each school page with the reason. Coverage is partial and growing: a program missing from the directory has not been verified yet. We do not claim complete coverage of US cybersecurity education.
Which schools are eligible
A school is listed when it holds a current institutional accreditation from an accreditor recognized by the U.S. Department of Education or CHEA, and offers at least one eligible cybersecurity degree. Accreditation is checked in the Department of Education's Database of Accredited Postsecondary Institutions and Programs (DAPIP). Candidate schools were found in the federal IPEDS completions data (security-related CIP codes 11.1003, 43.0403 and 43.0404 at bachelor's, master's and research-doctorate level), the official NCAE-C directory and ABET's accredited-program database — but a candidate is listed only after its own pages are researched.
Which programs are eligible
| Included | Not included |
|---|---|
| Dedicated cybersecurity bachelor's, master's and research doctorates — including information security, information assurance, cyber operations, computer or network security and digital forensics when the official curriculum shows a substantial cybersecurity focus | Associate degrees, certificates (including graduate certificates), minors, bootcamps, non-degree and certification-prep courses |
| Formal cybersecurity concentrations, tracks or specializations inside computer science, IT, information systems, business or similar degrees — shown with their real awarded degree | Generic IT or computer science degrees with only security electives; general criminal justice degrees; policy-only security studies |
| Broader PhDs only with a formally documented cybersecurity track | PhDs where security is merely a faculty research interest; professional doctorates (shown as not PhDs); discontinued programs |
Every listed program carries an eligibility record: official program name, awarded degree wording, degree level, whether it is a dedicated degree or a concentration, the inclusion rationale, and the official page that supports it. A deterministic gate checks every research decision and can only make it stricter: anything that looks like a certificate, an associate degree, a professional doctorate, a non-security title presented as a dedicated degree, or a program without a verified study format goes to an editor instead of being published.
Concentrations keep their real degree. A Master of Science in Computer Science with a cybersecurity concentration is shown as “MS in Computer Science — Cybersecurity Concentration”, never relabelled “MS in Cybersecurity”. Every listing page has a dedicated-degree / concentration filter.
Specializations
A program is mapped to a specialization (digital forensics, cloud security, cyber operations…) only from official curriculum evidence, recorded as either a formal concentration or track, or the core of the degree itself (its field or several required courses). A topic covered in one or two courses does not count.
How format and attendance are classified
- Formats: on campus, online and/or hybrid — one record per degree, even when it is offered in several formats.
- Online delivery: fully online; online with required campus visits; online coursework with a required local internship. “Fully online” and “no mandatory campus visits” need explicit wording on the school's page.
- Attendance: campus visits, residencies, in-person labs, proctored exams, internships, dissertation defenses and live-session time zones, each as published.
- Schedule (asynchronous, synchronous, mixed) and study intensity (full-time, part-time, flexible), when published.
We never infer an online PhD from a university's general online-learning page, and never call a program fully online when the school requires campus attendance.
Accreditation, ABET and CAE
- Institutional accreditation from DAPIP, for every listed school.
- ABET from ABET's accredited-program database, attached to a program only when ABET lists that program (same school, degree level and program name). Ambiguous matches go to an editor. An accredited school does not make every program ABET-accredited, and ABET listings say nothing about online delivery.
- NSA CAE designations (CAE-CD, CAE-CO, CAE-R) from the official NCAE-C directory, with the designation type and published award period. They are shown as designations of the institution, not as accreditation and not as an endorsement of every degree. A period that has ended is shown as ended.
Neither ABET accreditation nor a CAE designation is required for a program to be listed.
What a state or city listing means
A program is grouped under the state and city where the school (or the campus that delivers it) is located. For online programs that does not mean students must live there, and it does not mean every resident of that state — or every international applicant — may enroll. We do not create duplicate records for every state where online students can enroll.
Sources
- Program facts come from the school's own pages: program pages, the online-learning site, the catalog or bulletin, admissions requirements, official tuition tables and funding pages.
- Identity (official name, location, public/private control) from IPEDS; institutional accreditation from DAPIP; CAE from the NCAE-C directory; ABET from ABET's database.
- Search engines, rankings and other directories may help us find candidate pages, but never establish a fact. We do not copy their content.
Verification
Every published fact stores the URL it came from and a verbatim quote from that page. An automated check re-fetches the page and searches for the quote; a fact whose quote is not found is stored but never shown. Editors can confirm a fact manually after reading the source. Each fact on the site shows its source and verification date; facts older than a year are flagged for re-verification. Sites that block automated access are not circumvented: their facts stay unverified and the gap is recorded.
Unknown stays unknown. Missing GRE information is “not verified”, not “not required”. Durations such as “as little as 12 months” are shown with their condition. Deadlines keep the intake, round and year the school printed; a past date is marked passed and never rolled into a new cycle. Tuition keeps its category, basis and academic year; a total is calculated only from a per-credit rate and published credits, with the formula shown, and is never presented as the full cost of attendance. Certification exam preparation is never shown as earning the certification.
Order, rankings and sponsorship
Listings are alphabetical by school by default. Visitors can sort by soonest verified deadline, lowest published tuition per credit or most recently verified — transparent orders, not quality judgments. We do not publish “best” or “top” lists. Paid placements are labelled “Sponsored”, appear only when relevant to the page's filters, sit in a separate section and never change facts or the order of the directory. Comparison never picks a winner.
What we do not claim
- We do not publish or estimate acceptance rates, rankings, graduation outcomes or salaries of graduates. Occupational statistics in our guides are labelled as such and dated.
- No degree, school or certification guarantees employment, earnings, admission or a security clearance.
- Listing is not an endorsement, and a school's absence is not a judgment.
- We are not a university, an accrediting agency, the NSA or an application service. Apply on each school's official website.
Corrections
Schools and readers can request a correction with an official source. Corrections are reviewed against official pages; nobody can edit a profile directly, and sponsorship does not change facts.