MSc

MSc Cybersecurity

Defend organisations in an age of persistent threats

Online or on campus

24 months36 creditsEnglish

Overview

Cyber attacks cost the global economy trillions annually. This MSc develops practitioners who can protect networks, respond to breaches, and embed security culture across organisations. You will study penetration testing methodology, digital forensics, secure software development, and security governance frameworks including ISO 27001 and NIST CSF. Labs run in isolated virtual environments with realistic attack scenarios. MSc Cybersecurity is taught as one award, not a list of unrelated modules. The published length is 24 months, and the credit total is 36. Students move from Network Security & Protocols through Network Security & Protocols; Cryptography & PKI; Operating System & Application Security; Security Governance & Risk Management; Penetration Testing Methodology; Digital Forensics & Incident Response, and finish on MSc Cybersecurity Capstone. Each course has a question, a method, and a submission. In this field, students map one named system, write a threat model, and specify the controls that would stop the most likely path. Reading is control catalogues, incident write-ups, and a short technical standard. The artefact a marker expects is a defensive design with a test plan and a statement of residual risk. The award is built so that a graduate can do the following in practice: Conduct vulnerability assessments and penetration tests ethically and legally Lead incident response from detection through recovery and post-mortem Design zero-trust architectures for cloud and hybrid environments Teaching assumes the student can read a source, attempt a problem before the seminar, and revise after feedback. Attendance at live seminars is part of the design. The capstone or final course must use the methods of the earlier courses; a project that ignores them does not pass. The pages for each course name the topics that are examined. Those topics are the syllabus. A brochure line is not a substitute for them.

Labs run in isolated virtual environments — legal and ethical scope is taught before any offensive technique. You will complete a full breach-response capstone from detection through board reporting. Content aligns with CompTIA Security+ and CEH knowledge domains.

Who This Programme Is For

IT administrators moving into security operations
Developers adopting DevSecOps responsibilities
Risk and compliance officers needing technical depth

Faculty spotlight

Professor Marcus Chen, ex-CISO in financial services, leads Security Governance; Dr. Yuki Tanaka runs red-team/blue-team intensives.

How you can study

Recommended

Study online

100% tuition-free online

Online tuition is free. Online examinations are free. There is no exam fee for online study.

✦ Tuition: £0 / $0
✦ Examinations are free. There is no exam fee.
✦ Learn from anywhere · Live online seminars

Apply online →

On-campus study

Study at our campus

Prefer to learn at our Edinburgh campus? Campus tuition and campus examinations are charged. The published campus price is on each programme page.

✦ Tuition: £9,500 / US$12,000/year
✦ Location: 3 Lady Lawson St, Edinburgh EH3 9DS, United Kingdom
✦ Campus examinations are charged
✦ In-person seminars, library & student services

Apply for campus →

What You Will Learn

Conduct vulnerability assessments and penetration tests ethically and legally
Lead incident response from detection through recovery and post-mortem
Design zero-trust architectures for cloud and hybrid environments
Implement security governance aligned with ISO 27001 and SOC 2
Communicate cyber risk effectively to boards and non-technical stakeholders
Produce incident reports and root-cause analyses for executives
Design security awareness programmes measurably reducing phishing risk

Curriculum

Year 1 — Core Security

Code	Course	Credits · hours
CY501	Network Security & Protocols Network Security & Protocols (CY501) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Network Security & Protocols as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY501-M1 · Assets, trust boundaries, and the adversary model — Network Security & Protocols CY501-M2 · Threat modelling and attack paths — Network Security & Protocols CY501-M3 · Identity, logging, and segmentation — Network Security & Protocols CY501-M4 · Detection, containment, and evidence — Network Security & Protocols CY501-M5 · Residual risk and what a control does not stop — Network Security & Protocols CY501-M6 · Defensive design, test plan, and after-action review — Network Security & Protocols	3 · 30 h
CY502	Cryptography & PKI Cryptography & PKI (CY502) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Cryptography & PKI as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY502-M1 · Assets, trust boundaries, and the adversary model — Cryptography & PKI CY502-M2 · Threat modelling and attack paths — Cryptography & PKI CY502-M3 · Identity, logging, and segmentation — Cryptography & PKI CY502-M4 · Detection, containment, and evidence — Cryptography & PKI CY502-M5 · Residual risk and what a control does not stop — Cryptography & PKI CY502-M6 · Defensive design, test plan, and after-action review — Cryptography & PKI	3 · 30 h
CY503	Operating System & Application Security Operating System & Application Security (CY503) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Operating System & Application Security as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY503-M1 · Assets, trust boundaries, and the adversary model — Operating System & Application Security CY503-M2 · Threat modelling and attack paths — Operating System & Application Security CY503-M3 · Identity, logging, and segmentation — Operating System & Application Security CY503-M4 · Detection, containment, and evidence — Operating System & Application Security CY503-M5 · Residual risk and what a control does not stop — Operating System & Application Security CY503-M6 · Defensive design, test plan, and after-action review — Operating System & Application Security	3 · 30 h
CY504	Security Governance & Risk Management Security Governance & Risk Management (CY504) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Security Governance & Risk Management as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY504-M1 · Assets, trust boundaries, and the adversary model — Security Governance & Risk Management CY504-M2 · Threat modelling and attack paths — Security Governance & Risk Management CY504-M3 · Identity, logging, and segmentation — Security Governance & Risk Management CY504-M4 · Detection, containment, and evidence — Security Governance & Risk Management CY504-M5 · Residual risk and what a control does not stop — Security Governance & Risk Management CY504-M6 · Defensive design, test plan, and after-action review — Security Governance & Risk Management	3 · 30 h

Year 1 — Offensive & Defensive

Code	Course	Credits · hours
CY505	Penetration Testing Methodology Penetration Testing Methodology (CY505) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Penetration Testing Methodology as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY505-M1 · Assets, trust boundaries, and the adversary model — Penetration Testing Methodology CY505-M2 · Threat modelling and attack paths — Penetration Testing Methodology CY505-M3 · Identity, logging, and segmentation — Penetration Testing Methodology CY505-M4 · Detection, containment, and evidence — Penetration Testing Methodology CY505-M5 · Residual risk and what a control does not stop — Penetration Testing Methodology CY505-M6 · Defensive design, test plan, and after-action review — Penetration Testing Methodology	3 · 30 h
CY506	Digital Forensics & Incident Response Digital Forensics & Incident Response (CY506) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Digital Forensics & Incident Response as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY506-M1 · Assets, trust boundaries, and the adversary model — Digital Forensics & Incident Response CY506-M2 · Threat modelling and attack paths — Digital Forensics & Incident Response CY506-M3 · Identity, logging, and segmentation — Digital Forensics & Incident Response CY506-M4 · Detection, containment, and evidence — Digital Forensics & Incident Response CY506-M5 · Residual risk and what a control does not stop — Digital Forensics & Incident Response CY506-M6 · Defensive design, test plan, and after-action review — Digital Forensics & Incident Response	3 · 30 h
CY507	Cloud Security Architecture Cloud Security Architecture (CY507) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Cloud Security Architecture as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY507-M1 · Assets, trust boundaries, and the adversary model — Cloud Security Architecture CY507-M2 · Threat modelling and attack paths — Cloud Security Architecture CY507-M3 · Identity, logging, and segmentation — Cloud Security Architecture CY507-M4 · Detection, containment, and evidence — Cloud Security Architecture CY507-M5 · Residual risk and what a control does not stop — Cloud Security Architecture CY507-M6 · Defensive design, test plan, and after-action review — Cloud Security Architecture	3 · 30 h
CY508	Secure Software Development (DevSecOps) Secure Software Development (DevSecOps) (CY508) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Secure Software Development (DevSecOps) as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY508-M1 · Assets, trust boundaries, and the adversary model — Secure Software Development (DevSecOps) CY508-M2 · Threat modelling and attack paths — Secure Software Development (DevSecOps) CY508-M3 · Identity, logging, and segmentation — Secure Software Development (DevSecOps) CY508-M4 · Detection, containment, and evidence — Secure Software Development (DevSecOps) CY508-M5 · Residual risk and what a control does not stop — Secure Software Development (DevSecOps) CY508-M6 · Defensive design, test plan, and after-action review — Secure Software Development (DevSecOps)	3 · 30 h

Year 2 — Advanced

Code	Course	Credits · hours
CY601	Advanced Threat Intelligence Advanced Threat Intelligence (CY601) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Advanced Threat Intelligence as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY601-M1 · Assets, trust boundaries, and the adversary model — Advanced Threat Intelligence CY601-M2 · Threat modelling and attack paths — Advanced Threat Intelligence CY601-M3 · Identity, logging, and segmentation — Advanced Threat Intelligence CY601-M4 · Detection, containment, and evidence — Advanced Threat Intelligence CY601-M5 · Residual risk and what a control does not stop — Advanced Threat Intelligence CY601-M6 · Defensive design, test plan, and after-action review — Advanced Threat Intelligence	3 · 30 h
CY602	Security Leadership & Compliance Security Leadership & Compliance (CY602) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Security Leadership & Compliance as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY602-M1 · Assets, trust boundaries, and the adversary model — Security Leadership & Compliance CY602-M2 · Threat modelling and attack paths — Security Leadership & Compliance CY602-M3 · Identity, logging, and segmentation — Security Leadership & Compliance CY602-M4 · Detection, containment, and evidence — Security Leadership & Compliance CY602-M5 · Residual risk and what a control does not stop — Security Leadership & Compliance CY602-M6 · Defensive design, test plan, and after-action review — Security Leadership & Compliance	3 · 30 h
CY603	MSc Cybersecurity Capstone MSc Cybersecurity Capstone (CY603) is a 6-credit course on MSc Cybersecurity, with 60 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using MSc Cybersecurity Capstone as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone. CY603-M1 · Assets, trust boundaries, and the adversary model — MSc Cybersecurity Capstone CY603-M2 · Threat modelling and attack paths — MSc Cybersecurity Capstone CY603-M3 · Identity, logging, and segmentation — MSc Cybersecurity Capstone CY603-M4 · Detection, containment, and evidence — MSc Cybersecurity Capstone CY603-M5 · Residual risk and what a control does not stop — MSc Cybersecurity Capstone CY603-M6 · Defensive design, test plan, and after-action review — MSc Cybersecurity Capstone	6 · 60 h

Code

Course

Credits · hours

CY601

Advanced Threat Intelligence

Advanced Threat Intelligence (CY601) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Advanced Threat Intelligence as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

CY601-M1 · Assets, trust boundaries, and the adversary model — Advanced Threat Intelligence
CY601-M2 · Threat modelling and attack paths — Advanced Threat Intelligence
CY601-M3 · Identity, logging, and segmentation — Advanced Threat Intelligence
CY601-M4 · Detection, containment, and evidence — Advanced Threat Intelligence
CY601-M5 · Residual risk and what a control does not stop — Advanced Threat Intelligence
CY601-M6 · Defensive design, test plan, and after-action review — Advanced Threat Intelligence

3 · 30 h

CY602

Security Leadership & Compliance

Security Leadership & Compliance (CY602) is a 3-credit course on MSc Cybersecurity, with 30 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using Security Leadership & Compliance as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

CY602-M1 · Assets, trust boundaries, and the adversary model — Security Leadership & Compliance
CY602-M2 · Threat modelling and attack paths — Security Leadership & Compliance
CY602-M3 · Identity, logging, and segmentation — Security Leadership & Compliance
CY602-M4 · Detection, containment, and evidence — Security Leadership & Compliance
CY602-M5 · Residual risk and what a control does not stop — Security Leadership & Compliance
CY602-M6 · Defensive design, test plan, and after-action review — Security Leadership & Compliance

3 · 30 h

CY603

MSc Cybersecurity Capstone

MSc Cybersecurity Capstone (CY603) is a 6-credit course on MSc Cybersecurity, with 60 notional learning hours. By the end, students can map one named system, write a threat model, and specify the controls that would stop the most likely path, using MSc Cybersecurity Capstone as the working context rather than a generic management example. The course is taught in three movements. First, students establish the terms and the decision the course is about. Second, they apply the method to a case, dataset, text, or design and compare it with a weaker alternative. Third, they revise the work after feedback and state what the conclusion cannot support. Preparation uses control catalogues, incident write-ups, and a short technical standard. Seminar time is for the decision, not for reading the materials aloud. Assessment is a defensive design with a test plan and a statement of residual risk. A pass requires a clear method, evidence a marker can check, and an explicit limit. Credit is not awarded for summary alone.

CY603-M1 · Assets, trust boundaries, and the adversary model — MSc Cybersecurity Capstone
CY603-M2 · Threat modelling and attack paths — MSc Cybersecurity Capstone
CY603-M3 · Identity, logging, and segmentation — MSc Cybersecurity Capstone
CY603-M4 · Detection, containment, and evidence — MSc Cybersecurity Capstone
CY603-M5 · Residual risk and what a control does not stop — MSc Cybersecurity Capstone
CY603-M6 · Defensive design, test plan, and after-action review — MSc Cybersecurity Capstone

6 · 60 h

Career Paths

Security Operations Centre (SOC) Analyst
Penetration Tester / Ethical Hacker
Cybersecurity Consultant
Chief Information Security Officer (CISO)
Digital Forensics Investigator

Programme Highlights

Hands-on labs with Kali Linux, Wireshark, and SIEM tools
Red team / blue team exercises each semester
Preparation for CompTIA Security+ and CEH concepts
Faculty with military and financial-sector security backgrounds
Capstone simulating a full breach response lifecycle
Hands-on SIEM, Wireshark, and hardening labs every term
Capstone simulates ransomware response end-to-end

Assessment

Modules are assessed through a published mix of coursework, applied projects, and examinations. Exam windows are announced in advance so students in other time zones are not forced into overnight sittings. Alternative arrangements are available where documented.

Admission requirements

Academic entry

Bachelor's degree from an accredited institution (minimum 2:2 or GPA 2.5/4.0)

English language

English proficiency: IELTS 5.5, TOEFL 46, or equivalent (waived for prior English-medium study)

Documents

Statement of Purpose (500 words minimum) outlining your goals and fit for the programme
Two academic or professional references with contact details
CV or résumé documenting relevant education and professional experience

Programme questions

How long is the MSc Cybersecurity?

The published duration is 24 months. Teaching language: English. Actual time-to-complete depends on mode and any recognised prior learning.

Can I study this from my country?

You may study this award fully online from your country, or — where published — on campus at Brigant. Online study does not require a student visa. Campus study may.

What does it cost?

Degree tuition for this award is published as £0 / tuition-free on the online pathway. Examination or administrative fees may apply at checkout — never an annual tuition invoice. Check the Fees page for any extras.

What are the entry requirements?

Requirements are grouped on this page (academic, English, documents). Equivalent qualifications are considered. English may be waived after prior English-medium study.

How is the programme assessed?

Assessment is typically a mix of coursework, projects, and examinations. Doctoral awards include a thesis or dissertation and an oral examination. Details sit in the programme specification and module outlines.

Will this award be recognised where I live?

Recognition of the award for local employment, professional licence, or ministry attestation is decided by your employer or regulator. University of Brigant publishes verification pages for certificates. We do not claim automatic equivalence in every country.

How do I apply?

Start an application on this website. Progress is saved from the first step. Admissions: admissions@brigant.uk.

Recognised & Accredited

Ready to begin?MSc Cybersecurity

Start an application

Loading…