ISCAP Proceedings: Abstract Presentation
Bridging the Entry-Level Paradox: Immersive Cyber Range Simulations as a Workforce Development Strategy
Timothy Greer
Middle Tennessee State University
Nita Brooks
Middle Tennessee State University
Abstract
The cybersecurity workforce shortage isn't only about headcount — it's also a mismatch between the skills employers need and what new graduates can actually demonstrate. The World Economic Forum's Global Cybersecurity Outlook 2026 ranks a lack of cybersecurity expertise as organizations' second-largest challenge, trailing only the threat landscape itself (World Economic Forum & Accenture, 2026). The shortage hits nongovernmental organizations and public-sector agencies hardest, with 51% and 57% of respondents, respectively, reporting major gaps. Smaller, under-resourced organizations are especially exposed: they rarely have the staff, funding, or specialized expertise to keep pace with threats in newer areas like threat intelligence analysis, DevSecOps, and identity and access management (World Economic Forum & Accenture, 2026). The 2025 ISC2 Cybersecurity Workforce Study finds much the same thing — nearly two-thirds of respondents report critical or significant skills gaps, with AI and cloud security among the hardest areas to staff (ISC2, 2025). Meanwhile, employers routinely describe "entry-level" cybersecurity roles in terms that assume two or three years of prior experience, shutting out the very graduates higher education is preparing for the field (DeepStrike, 2026).
The stakes are real. Security professionals describe today's threat environment as among the most difficult they've faced, and the average cost of a data breach is high enough to threaten many organizations financially (DeepStrike, 2026) — a burden that falls hardest on organizations already understaffed or short on expertise. The cybersecurity workforce gap, in other words, isn't just a hiring problem; it's a business and public-sector risk that needs a coordinated response from employers, educators, and everyone else preparing the next generation of cybersecurity professionals.
This raises a practical question for higher education: how should universities prepare students for this environment? Lectures and static lab assignments still matter, but they're not sufficient on their own. Students need realistic environments where they can investigate attacks, defend systems under pressure, and see the consequences of their decisions play out. Cyber ranges and other simulation-based environments have been shown to strengthen cybersecurity education and training (Katsantonis et al.; Chowdhury & Gkioulos), and work-based learning, internships, and industry certifications can round out the practical experience employers expect.
This paper describes the design and early implementation of a cloud-based cyber range built on IBM X-Force infrastructure at a mid-size regional R2 university in the southeastern United States. Funded through state appropriations and private donor support, the range gives students access to realistic attack-and-defense scenarios without adding a separate program or course fee. Its scenarios target the areas workforce studies repeatedly flag as hardest to staff — threat intelligence, DevSecOps, identity and access management, cloud security, and AI-related risk. Alongside the instructional case, the paper covers the governance, procurement, funding, and sustainability decisions behind building it.
It closes with lessons learned: what helped the project move forward, what got in the way, and what we'd adjust next time — offered for other institutions weighing a similar effort.
Keywords: Cybersecurity workforce shortage, cyber range, immersive simulation, experiential learning, workforce development, higher education partnerships
References
World Economic Forum & Accenture. (2026). Global Cybersecurity Outlook 2026. https://www.weforum.org/publications/global-cybersecurity-outlook-2026/
ISC2. (2025). 2025 ISC2 Cybersecurity Workforce Study: Cybersecurity Professionals Navigate Evolving Workplaces While Seizing New Opportunities. https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study
Katsantonis, M.N., Manikas, A., Mavridis, I. et al. Cyber range design framework for cyber security education and training. Int. J. Inf. Secur. 22, 1005–1027 (2023). https://doi.org/10.1007/s10207-023-00680-4
Chowdhury, N., & Gkioulos, V. Cyber Security Training for Critical Infrastructure Protection: A Literature Review. Computer Science Review, Volume 40, 2021, 100361, ISSN 1574-0137, https://doi.org/10.1016/j.cosrev.2021.100361.