Overview
Cyber attacks cost the global economy trillions annually. This MSc develops practitioners who can protect networks, respond to breaches, and embed security culture across organisations. You will study penetration testing methodology, digital forensics, secure software development, and security governance frameworks including ISO 27001 and NIST CSF. Labs run in isolated virtual environments with realistic attack scenarios.
MSc Cybersecurity is taught as one award, not a list of unrelated modules. The published length is 24 months, and the credit total is 36. Students move from Network Security & Protocols through Network Security & Protocols; Cryptography & PKI; Operating System & Application Security; Security Governance & Risk Management; Penetration Testing Methodology; Digital Forensics & Incident Response, and finish on MSc Cybersecurity Capstone.
Each course has a question, a method, and a submission. In this field, students map one named system, write a threat model, and specify the controls that would stop the most likely path. Reading is control catalogues, incident write-ups, and a short technical standard. The artefact a marker expects is a defensive design with a test plan and a statement of residual risk.
The award is built so that a graduate can do the following in practice: Conduct vulnerability assessments and penetration tests ethically and legally Lead incident response from detection through recovery and post-mortem Design zero-trust architectures for cloud and hybrid environments
Teaching assumes the student can read a source, attempt a problem before the seminar, and revise after feedback. Attendance at live seminars is part of the design. The capstone or final course must use the methods of the earlier courses; a project that ignores them does not pass.
The pages for each course name the topics that are examined. Those topics are the syllabus. A brochure line is not a substitute for them.
Labs run in isolated virtual environments — legal and ethical scope is taught before any offensive technique. You will complete a full breach-response capstone from detection through board reporting. Content aligns with CompTIA Security+ and CEH knowledge domains.
Who This Programme Is For
- ✦IT administrators moving into security operations
- ✦Developers adopting DevSecOps responsibilities
- ✦Risk and compliance officers needing technical depth
Faculty spotlight
Professor Marcus Chen, ex-CISO in financial services, leads Security Governance; Dr. Yuki Tanaka runs red-team/blue-team intensives.
Programme Structure & Delivery
Coursework
Interactive modules, weekly readings, recorded and live seminars, and collaborative discussions with peers worldwide.
Assessment
Module assignments, proctored examinations, and capstone projects designed to demonstrate mastery of the field.
Learning Outcomes
- ✦Conduct vulnerability assessments and penetration tests ethically and legally
- ✦Lead incident response from detection through recovery and post-mortem
- ✦Design zero-trust architectures for cloud and hybrid environments
- ✦Implement security governance aligned with ISO 27001 and SOC 2
- ✦Communicate cyber risk effectively to boards and non-technical stakeholders
- ✦Produce incident reports and root-cause analyses for executives
- ✦Design security awareness programmes measurably reducing phishing risk
Career Pathways
- ✦Security Operations Centre (SOC) Analyst
- ✦Penetration Tester / Ethical Hacker
- ✦Cybersecurity Consultant
- ✦Chief Information Security Officer (CISO)
- ✦Digital Forensics Investigator
Assessment
Modules are assessed through a published mix of coursework, applied projects, and examinations. Exam windows are announced in advance so students in other time zones are not forced into overnight sittings. Alternative arrangements are available where documented.
Curriculum
Year 1 — Core Security
CY501Network Security & Protocols- CY501-M1 · Assets, trust boundaries, and the adversary model — Network Security & Protocols
- CY501-M2 · Threat modelling and attack paths — Network Security & Protocols
- CY501-M3 · Identity, logging, and segmentation — Network Security & Protocols
- CY501-M4 · Detection, containment, and evidence — Network Security & Protocols
- CY501-M5 · Residual risk and what a control does not stop — Network Security & Protocols
- CY501-M6 · Defensive design, test plan, and after-action review — Network Security & Protocols
3 creditsCY502Cryptography & PKI- CY502-M1 · Assets, trust boundaries, and the adversary model — Cryptography & PKI
- CY502-M2 · Threat modelling and attack paths — Cryptography & PKI
- CY502-M3 · Identity, logging, and segmentation — Cryptography & PKI
- CY502-M4 · Detection, containment, and evidence — Cryptography & PKI
- CY502-M5 · Residual risk and what a control does not stop — Cryptography & PKI
- CY502-M6 · Defensive design, test plan, and after-action review — Cryptography & PKI
3 creditsCY503Operating System & Application Security- CY503-M1 · Assets, trust boundaries, and the adversary model — Operating System & Application Security
- CY503-M2 · Threat modelling and attack paths — Operating System & Application Security
- CY503-M3 · Identity, logging, and segmentation — Operating System & Application Security
- CY503-M4 · Detection, containment, and evidence — Operating System & Application Security
- CY503-M5 · Residual risk and what a control does not stop — Operating System & Application Security
- CY503-M6 · Defensive design, test plan, and after-action review — Operating System & Application Security
3 creditsCY504Security Governance & Risk Management- CY504-M1 · Assets, trust boundaries, and the adversary model — Security Governance & Risk Management
- CY504-M2 · Threat modelling and attack paths — Security Governance & Risk Management
- CY504-M3 · Identity, logging, and segmentation — Security Governance & Risk Management
- CY504-M4 · Detection, containment, and evidence — Security Governance & Risk Management
- CY504-M5 · Residual risk and what a control does not stop — Security Governance & Risk Management
- CY504-M6 · Defensive design, test plan, and after-action review — Security Governance & Risk Management
3 creditsYear 1 — Offensive & Defensive
CY505Penetration Testing Methodology- CY505-M1 · Assets, trust boundaries, and the adversary model — Penetration Testing Methodology
- CY505-M2 · Threat modelling and attack paths — Penetration Testing Methodology
- CY505-M3 · Identity, logging, and segmentation — Penetration Testing Methodology
- CY505-M4 · Detection, containment, and evidence — Penetration Testing Methodology
- CY505-M5 · Residual risk and what a control does not stop — Penetration Testing Methodology
- CY505-M6 · Defensive design, test plan, and after-action review — Penetration Testing Methodology
3 creditsCY506Digital Forensics & Incident Response- CY506-M1 · Assets, trust boundaries, and the adversary model — Digital Forensics & Incident Response
- CY506-M2 · Threat modelling and attack paths — Digital Forensics & Incident Response
- CY506-M3 · Identity, logging, and segmentation — Digital Forensics & Incident Response
- CY506-M4 · Detection, containment, and evidence — Digital Forensics & Incident Response
- CY506-M5 · Residual risk and what a control does not stop — Digital Forensics & Incident Response
- CY506-M6 · Defensive design, test plan, and after-action review — Digital Forensics & Incident Response
3 creditsCY507Cloud Security Architecture- CY507-M1 · Assets, trust boundaries, and the adversary model — Cloud Security Architecture
- CY507-M2 · Threat modelling and attack paths — Cloud Security Architecture
- CY507-M3 · Identity, logging, and segmentation — Cloud Security Architecture
- CY507-M4 · Detection, containment, and evidence — Cloud Security Architecture
- CY507-M5 · Residual risk and what a control does not stop — Cloud Security Architecture
- CY507-M6 · Defensive design, test plan, and after-action review — Cloud Security Architecture
3 creditsCY508Secure Software Development (DevSecOps)- CY508-M1 · Assets, trust boundaries, and the adversary model — Secure Software Development (DevSecOps)
- CY508-M2 · Threat modelling and attack paths — Secure Software Development (DevSecOps)
- CY508-M3 · Identity, logging, and segmentation — Secure Software Development (DevSecOps)
- CY508-M4 · Detection, containment, and evidence — Secure Software Development (DevSecOps)
- CY508-M5 · Residual risk and what a control does not stop — Secure Software Development (DevSecOps)
- CY508-M6 · Defensive design, test plan, and after-action review — Secure Software Development (DevSecOps)
3 creditsYear 2 — Advanced
CY601Advanced Threat Intelligence- CY601-M1 · Assets, trust boundaries, and the adversary model — Advanced Threat Intelligence
- CY601-M2 · Threat modelling and attack paths — Advanced Threat Intelligence
- CY601-M3 · Identity, logging, and segmentation — Advanced Threat Intelligence
- CY601-M4 · Detection, containment, and evidence — Advanced Threat Intelligence
- CY601-M5 · Residual risk and what a control does not stop — Advanced Threat Intelligence
- CY601-M6 · Defensive design, test plan, and after-action review — Advanced Threat Intelligence
3 creditsCY602Security Leadership & Compliance- CY602-M1 · Assets, trust boundaries, and the adversary model — Security Leadership & Compliance
- CY602-M2 · Threat modelling and attack paths — Security Leadership & Compliance
- CY602-M3 · Identity, logging, and segmentation — Security Leadership & Compliance
- CY602-M4 · Detection, containment, and evidence — Security Leadership & Compliance
- CY602-M5 · Residual risk and what a control does not stop — Security Leadership & Compliance
- CY602-M6 · Defensive design, test plan, and after-action review — Security Leadership & Compliance
3 creditsCY603MSc Cybersecurity Capstone- CY603-M1 · Assets, trust boundaries, and the adversary model — MSc Cybersecurity Capstone
- CY603-M2 · Threat modelling and attack paths — MSc Cybersecurity Capstone
- CY603-M3 · Identity, logging, and segmentation — MSc Cybersecurity Capstone
- CY603-M4 · Detection, containment, and evidence — MSc Cybersecurity Capstone
- CY603-M5 · Residual risk and what a control does not stop — MSc Cybersecurity Capstone
- CY603-M6 · Defensive design, test plan, and after-action review — MSc Cybersecurity Capstone
6 creditsAdmission requirements
Academic entry
- Bachelor's degree from an accredited institution (minimum 2:2 or GPA 2.5/4.0)
English language
- English proficiency: IELTS 5.5, TOEFL 46, or equivalent (waived for prior English-medium study)
Documents
- Statement of Purpose (500 words minimum) outlining your goals and fit for the programme
- Two academic or professional references with contact details
- CV or résumé documenting relevant education and professional experience
Programme questions
How long is the MSc Cybersecurity?+
The published duration is 24 months. Teaching language: English. Actual time-to-complete depends on mode and any recognised prior learning.
Can I study this from my country?+
This is a fully online award. You study from your country. No student visa and no campus relocation are required.
What does it cost?+
Degree tuition for this award is published as £0 / tuition-free on the online pathway. Examination or administrative fees may apply at checkout — never an annual tuition invoice. Check the Fees page for any extras.
What are the entry requirements?+
Requirements are grouped on this page (academic, English, documents). Equivalent qualifications are considered. English may be waived after prior English-medium study.
How is the programme assessed?+
Assessment is typically a mix of coursework, projects, and examinations. Doctoral awards include a thesis or dissertation and an oral examination. Details sit in the programme specification and module outlines.
Will this award be recognised where I live?+
Recognition of the award for local employment, professional licence, or ministry attestation is decided by your employer or regulator. Durham University publishes verification pages for certificates. We do not claim automatic equivalence in every country.
How do I apply?+
Start an application on this website. Progress is saved from the first step. Admissions: admissions@durhm.co.uk.