# The cybersecurity major in Saudi Arabia: where it is taught, how many hours, what follows

> **The short answer**: The cybersecurity major in Saudi Arabia is a four-year bachelor's. KSU offers it as a 131-hour track in Applied Computing and a 127-hour track in Information Technology, and KFUPM pairs it with AI in a 127-hour degree. The NCA's workforce framework defines 40 job roles you can aim the degree at.

**Key takeaways**

- KSU alone teaches it in two colleges, so check the college name before you rank a choice.
- The first edition of the Saudi Cybersecurity Workforce Framework has 5 categories, 12 specialty areas and 40 roles.
- Ask every university whether its programme is aligned with the NCA's higher education framework.
- Never test a system without its owner's written permission, even to learn.

![Cybersecurity major in Saudi Arabia: the guide before you choose](https://tiswa.app/assets/blog/major-cybersecurity/major-cybersecurity-cover-en.webp)

> Major quiz: Answer 6 quick questions to get 3 majors close to your interests, each with a full guide. https://tiswa.app/en/tools/major-quiz/

## What is the cybersecurity major?

It trains the people who protect networks, systems and data: they monitor them, assess risks and vulnerabilities, and respond to an attack and investigate it afterwards. KSU's Applied Computing page lists the track's outcomes as security technologies, risk management, continuous network monitoring and vulnerability assessment.[^1]

The daily work is quieter than the films. Logs, alerts, reports, controls. If that kind of patience suits you, you will fit.

## How many years is a cybersecurity degree, and how many hours?

Four years in all three programmes we read. The hours, the college and the training differ:

| Programme | University and college | Credit hours | Training |
|---|---|---|---|
| Applied Computing, cybersecurity track | KSU, College of Applied Studies | 131[^1] | Summer internship or co-op |
| Information Technology, cyber security track | KSU, College of Computer and Information Sciences | 127[^2] | 8 full-time weeks in summer |
| Artificial Intelligence and Cybersecurity | KFUPM | 127[^3] | Summer training or internship option |

![Comparison card of the guide table](https://tiswa.app/assets/blog/major-cybersecurity/major-cybersecurity-inline-2-en.webp)


KSU's IT track is taught entirely in English.[^2] KFUPM's degree has a preparatory year in front of it, so count that in your timeline.[^3] To compare other universities course by course, read [compare cybersecurity study plans](https://tiswa.app/en/blog/compare-cybersecurity-study-plans/).

## What are the cybersecurity course subjects?

You start with shared foundations in programming, networks, operating systems and databases, because you cannot protect what you do not understand. Then come the security courses. Examples from two plans:

- KSU's IT track: Application Security (IT 371), Cyber Security Governance (IT 471), Cybercrime and Digital Forensics (IT 472), System Security (IT 473), Network Security (IT 474), and Information Assurance, Compliance and Audit (IT 475).[^2]
- KFUPM: information security, cryptography and blockchain applications, penetration testing and ethical hacking, secure software development, and data privacy.[^3]
- Courses where KFUPM joins the two fields: AI for cybersecurity, and security in AI systems.[^3]

Notice the lean. KSU's IT track tilts towards governance, audit and forensics; KFUPM tilts towards cryptography and AI. The first is closer for anyone who sees themselves in compliance or incident response.

## What are the cybersecurity course requirements in Saudi Arabia?

There is no single cut-off. KSU requires both the General Aptitude Test (Qudurat) and the Achievement Test (Tahsili) from every Saudi applicant, whatever their school track, and uses the best score from the five years before you apply.[^7] The Deanship of Admission and Registration announces the criteria and their weights for each track before admission opens, and weights differ between majors.[^7] Read the figures for your own intake year on the Deanship site, not from a screenshot of an old year.

## What is the Saudi Cybersecurity Workforce Framework?

The National Cybersecurity Authority issued the Saudi Cybersecurity Workforce Framework (SCyWF) as a reference for preparing, developing, recruiting and promoting the security workforce.[^4] Its first edition sorts the work into 5 categories, 12 specialty areas and 40 job roles, each with its tasks, knowledge and skills.[^5] The NCA has since released an updated version with revised role descriptions and a career progression appendix.[^4]

Use it directly. Open the role list in your second year, pick one or two roles, and build your projects and electives around them. In interviews you will then speak the employer's language.

## What jobs can I get with a cybersecurity degree?

These roles recur in job ads, and each has a counterpart in the national framework:

- SOC analyst, watching alerts and catching attacks.
- Penetration tester, working under formal permission and writing vulnerability reports.
- Incident responder and digital forensics analyst.
- Governance, risk and compliance specialist.
- Network or cloud security engineer.

Neither the NCA nor the universities publish salaries on these pages, so do not trust a salary table without an official source. For placements, see the [cybersecurity co-op training](https://tiswa.app/en/blog/cybersecurity-coop-projects/) guide.

## Is a cybersecurity course hard?

Yes, for students who want the tools before the foundations. Anyone who jumps to hacking tools before understanding networks and operating systems struggles in third year, when every course builds on that base. Students who put in the work on programming and networks in the first two years find the security courses logical.

> **tiswa's take**: Our view at tiswa: pick a security track inside IT or computing if you want a broad technical base that leaves other doors open should you change your mind. Pick a degree that pairs security with AI if maths and programming are your strengths. Either way, ask about NCA alignment before you rank the programme.

## Is the programme aligned with the NCA framework?

The NCA issued the Saudi Cybersecurity Higher Education Framework (SCyber-Edu) as a reference for developing, evaluating and accrediting security programmes. It publishes the list of aligned programmes, and an alignment certificate lasts five years.[^6] The cyber security track in KSU's IT degree holds an alignment decision for five years.[^2] Look your programme up on that list on the NCA site.

## How do I choose the best university for cybersecurity in Saudi Arabia?

The NCA publishes no ranking of universities, so distrust any "best" list without criteria. Compare the programmes open to you with four questions, and write the answers in a table before you rank your choices:

- Is the programme on the NCA's list of programmes aligned with the higher education framework?
- How many real security courses are in the plan once general computing courses are taken out?
- Short summer training or a long co-op? The second keeps you inside a real team for longer.
- The teaching language, and whether a preparatory year adds a year to the degree.

A nearby university with an aligned programme and a co-op can serve you better than a famous one in another city with a plan you know only by name.

## What mistakes do cybersecurity students make?

- Testing a system they do not own without written permission, which breaks the law even when the aim is learning.
- Collecting short certificates instead of building the networks and operating systems base.
- Neglecting report writing, half of an analyst's job.
- Judging a programme by its name without counting the security courses in its plan.

## How do I practise safely and legally?

1. **Build a home lab**: Virtual machines on your own computer, so you never touch someone else's system.
2. **Join capture the flag events**: CTF competitions train you on security challenges in a permitted setting.
3. **Follow a roadmap**: Learn in a sensible order with [learn cybersecurity from scratch](https://tiswa.app/en/blog/cybersecurity-roadmap/).
4. **Write up every challenge**: Your write-ups become the portfolio employers ask to see.
5. **Read the NCA's documents**: National controls and frameworks are the language of the organisations that will hire you.

![5-step flow: Build the base before the tools / Set up a home lab / Join capture the flag competitions / Never test a system without written / Document](https://tiswa.app/assets/blog/major-cybersecurity/major-cybersecurity-inline-1-en.webp)


To use AI in your studies without crossing safety lines, read [AI for cybersecurity students](https://tiswa.app/en/blog/ai-for-cybersecurity-students/). If you are torn between this and the broader degree, read the [information technology major](https://tiswa.app/en/blog/major-information-technology/).

The laptop that runs your virtual machines and the developer tools around it have student pricing. tiswa collects them under [computer science student essentials](https://tiswa.app/en/deals/majors/computer-science/), with discount levels in the [student discount index](https://tiswa.app/en/deals/student-discount-index/). [Join tiswa](https://tiswa.app/en/join/)

## Questions

### Cybersecurity course: how many years in Saudi Arabia?

Four years. KFUPM adds a preparatory year first, and plans run from 127 to 131 credit hours.

### What are the cybersecurity course requirements at KSU?

Qudurat and Tahsili for every Saudi applicant, with the best score from the last five years; the Deanship announces each track's weights before admission.

### Is a cybersecurity course hard?

Hard if you skip the foundations. Students who master programming and networks in the first two years find the security courses logical.

### Where can I find a cybersecurity internship in Saudi Arabia?

Through your programme's training: KSU's IT track requires 8 full-time weeks, and its Applied Computing track offers summer or co-op training.

### What is the Saudi Cybersecurity Workforce Framework?

The NCA's reference for preparing and hiring security staff. Its first edition defines 40 job roles across 12 specialty areas and 5 categories.


## Sources

[^1]: King Saud University, College of Applied Studies: Bachelor of Applied Computing (Cybersecurity Track), https://cas.ksu.edu.sa/en/node/788
[^2]: King Saud University, CCIS: BS in Information Technology, Cyber Security Track (CYS), https://ccis.ksu.edu.sa/en/it/cys-bsc-program
[^3]: KFUPM Bulletin: BS in Artificial Intelligence and Cybersecurity, Summer Training Option, https://bulletin.kfupm.edu.sa/program?program_id=1160&title=bachelor-of-science-in-artificial-intelligence-and-cybersecurity---summer-training-option
[^4]: National Cybersecurity Authority: Saudi Cybersecurity Workforce Framework (SCyWF), https://nca.gov.sa/en/regulatory-documents/frameworks-and-standard-list/scywf/
[^5]: National Cybersecurity Authority: SCyWF-1:2020 document, https://nca.gov.sa/scywf_en.pdf
[^6]: National Cybersecurity Authority: Saudi Cybersecurity Higher Education Framework (SCyber-Edu), https://nca.gov.sa/en/regulatory-documents/frameworks-and-standard-list/scyberedu/
[^7]: King Saud University, Deanship of Admission and Registration: Frequently Asked Questions about Admission, https://dar.ksu.edu.sa/en/FAQ