CHIATECH JOURNAL · Registered Version of Record

Integrating Defensive and Offensive Cybersecurity Education: A Lab-Based Competency Framework for Workforce-Ready Learning

1. Shiaondo Kenneth Chia · ORCID 0009-0009-6434-4586
   CHIATECH Solutions and Resources Ltd, Abuja, Nigeria

Abstract

Background: Cybersecurity education often separates defensive operations from offensive testing even though workforce practice requires professionals to understand how attack paths, controls, detection and response interact. Objective: This article develops a curriculum and competency framework that integrates defensive engineering and authorized adversary-emulation perspectives within isolated, ethically governed laboratories. Methods: A design synthesis mapped the proposed competency architecture against the NIST Cybersecurity Framework 2.0, the NICE Workforce Framework for Cybersecurity, CSEC2017 curricular guidance and recent research on cybersecurity teaching. Results: The proposed architecture progresses through foundations and lab setup, defensive engineering, authorized adversary emulation, specialized domains, threat hunting/incident response, automation and governance. A purple-team learning loop—understand risk, defend, emulate threats safely, detect/investigate, respond/improve—connects technical tasks to organizational outcomes. Assessment emphasizes observable competencies through threat models, hardening plans, log analysis, vulnerability reports, secure configurations, incident reports and capstone exercises. Offensive content is bounded by written authorization, scoped targets, isolated environments, no external persistence and evidence-based reporting. Conclusion: Defensive and offensive knowledge should be integrated educationally but separated operationally by strict authorization and safety controls. Workforce readiness depends on demonstrated capability, ethical judgment and communication as much as on tool familiarity.

Keywords: ethical hacking; penetration testing; AI security; NIST CSF 2.0; OWASP ASVS; MITRE ATT&CK; vulnerability management; CVSS v4.0; EPSS; cybersecurity governance

Licence: Creative Commons Attribution 4.0 International (CC BY 4.0)

Published by CHIA TECH SOLUTIONS AND RESOURCES LIMITED. ISSN assignment remains pending.