In 1788, 13-year-oldEugène-François Vidocq, the son of a wealthy merchant in Arras, France, stole his father’s set of silver plates. And so began a life of crime that resulted in dozens of heists and several thrilling prison escapes — andinspired the fictionof Victor Hugo, Edgar Allan Poe and Honoré de Balzac.
The tale also caught the attention of cybersecurity expertYan Shosh*taishvili, who knew how the story ends.
At the age of 30, following a year of hiding in his mother’s house, Vidocq made a history-defining choice. He decided to stop trying to beat the authorities and, instead, joined them. With the blessing of Napoleon, Vidocq created the Sûreté, later reformed and renamed as thePolice Nationale, the official law-keeping force of France. He recruited criminals and personally trained them, remarkably reducing crime in Paris.
Shosh*taishvili is an associate professor of computer science and engineering in theSchool of Computing and Augmented Intelligence, part of theIra A. Fulton Schools of Engineeringat Arizona State University. He also serves as associate director of workforce development at ASU’sCenter for Cybersecurity and Trusted Foundations, or CTF.
He and his CTF team have been awarded a two-year, $4.5 million grant from theU.S. Defense Advanced Research Projects Agency, or DARPA, to establish an institute that will educate the next generation of cybersecurity professionals and address critical workforce shortages.
As part of ASU’sGlobal Security Initiative, and with the DARPA funding, the CTF team has established theAmerican Cybersecurity Education (ACE)Institute. When considering how the new organization would function, Vidocq’s story and its ethos — that it takes a great thief to catch one — inspired Shosh*taishvili.
An old solution to a new problem
TheU.S. Department of Homeland Securityhas said thatcybersecurity threats to critical infrastructureare one of the country’s greatest risks. Meanwhile, theInternet Crime Reportfrom theFederal Bureau of Investigationcharts alarming growth in cybercrime, noting a record number of complaints in 2023, with $12.5 billion in reported financial losses.
But in computer science, cybersecurity education comes with a unique set of challenges.
“To learn to write a program, you just have to learn to write a program,” Shosh*taishvili says. “But to understand how to hack a program, you have to understand how that program works better than the people who actually wrote it, so you can catch their mistakes and exploit them.”
Much in the way Vidocq believed the best criminals could be great police officers, Shosh*taishvili theorized that the best way to train cybersecurity pros is to teach them to think like cybercriminals.
Some of that work was already underway in the School of Computing and Augmented Intelligence.
Adam Doupé, a Fulton Schools associate professor of computer science and engineering and CTF director;Connor Nelson, a CTF staff software engineer; and Shosh*taishvili had createdpwn.college— a unique combination of an educational curriculum, a competitive practice environment and a set of communication tools to help students learn collaboratively.
On the pwn.college site,cybersecurity students from around the worldcomplete programming modules and participate in hacking exercises to gain real insight into how attackers access secured systems.
It’s this applied approach that Shosh*taishvili seeks to expand upon in the ACE Institute.
Training the best for today’s toughest challenges
Shosh*taishvili and his team identified two key areas the ACE Institute must focus on: preparing current students for the toughest cybersecurity challenges, and recruiting enough students to fill the jobs pipeline for the future.
A pressing problem is ensuring that today’s students have the depth of knowledge needed to fill the most advanced roles.
“When undergraduates leave school, one issue is that they are immediately thrust into extremely complex environments,” Shosh*taishvili says. “They must outthink cybercriminals, who can even be state actors, and successfully attacking a system could be their entire livelihood. These people are very, very motivated.”
To combat this problem, one of the ACE Institute’s first steps will be to create a master’s degree in cybersecurity. The degree, offered by the School of Computing and Augmented Intelligence, is scheduled to begin enrolling students in the 2025–26 academic year.
For the new degree program, Shosh*taishvili and his team will design a curriculum that requires students to complete numerous advanced courses and successfully engage in a number of real-world exercises. Building upon the pwn.college model, master’s degree students will learn to hack highly complex systems, training to beat cybercriminals at their own game. They will also acquire the skills needed to build artificial intelligence, or AI, and machine learning applications for security systems.
Recruiting the best for tomorrow
Next, the ACE Institute will partner with other universities across the country. Dakota State University, or DSU, will join the initiative as a founding partner. DSU is located in Madison, South Dakota, and is one of 10 institutions in the country with all three National Center of Academic Excellence designations from theU.S. Department of Homeland Security.
Joel Wohnoutka, executive director of the Applied Research Lab at DSU, says that his team will take inspiration from the pwn.college program as part of their ongoing efforts to increase involvement in cybersecurity education.
“We’re looking to partner with the ACE Institute to ensure that our classes are hands-on and provide options for many different learning styles,” says Wohnoutka, adding that they plan to use institute resources to develop college credit course options for high school students.
Shosh*taishvili says he is especially excited about the partnership with DSU, which he notes has a successful track record of running cybersecurity workshops for middle schoolers and working to recruit students from historically underserved populations.
Wohnoutka adds that DSU is expanding the offerings of itsCybHERoutreach program to include an after-school program for elementary school students, enhancing efforts designed to provide young people with early exposure to computer science and diversify the pool of potential learners.
ACE Institute partners will work cooperatively to implement standards in cybersecurity education, and especially to fill the jobs pipeline with quality graduates. There are an estimated3.5 million unfilled cybersecurity jobsworldwide, 750,000 of which are in the U.S.
Ross Maciejewski, director of the School of Computing and Augmented Intelligence, says that the new institute will prepare graduate students for leadership roles as well as boost recruiting efforts for future students.
“The ACE Institute continues the school’s efforts to create a home for excellence in cybersecurity education,” Maciejewski says. “The new endeavor will also further efforts to establish both the university and the state of Arizona as global hubs for innovation in this arena.”
