Bridging the Chasm: Filling the Security Knowledge Gap between Academia and Industry

Mike Biocchi opens with a gap he saw while teaching computer science in Canada and the United States. Many graduates finish four-year degrees without taking a security course, and students in his classes could not explain basics such as hashing versus encryption, how HTTPS works, or the CIA triad. Using a student email and his experience updating an outdated fourth-year course, he frames the problem as a mismatch between what schools teach and what employers expect.

The middle of the talk walks through figures he gathered from university and college curriculum pages. Security courses are common as electives but much less often required for graduation. Industry surveys from 2022 and 2024 show many organizations still struggling to find staff with the skills they need. He also describes how slowly curricula change, sometimes taking around two years to update a course, and how developers under delivery pressure treat security findings as added cognitive load. That problem grows as AI-generated code reaches production, often without reviewers who recognize insecure patterns.

He closes with partial remedies: closer ties between academia and industry through advisory boards and co-op placements, partnerships with certification bodies, and a dedicated required security course that covers ethics and privacy alongside technical material. The takeaway for educators and employers is to treat basic secure coding knowledge as a baseline rather than a specialty, and to make small curriculum changes that can happen now.