Computing & Data
Cybersecurity Research: Venues, Vulnerability Data, Standards and Funders
Cybersecurity research is split between a conference culture and a standards-and-disclosure culture, and anyone funding or administering it needs both. Peer-reviewed results appear at ACM CCS, the IEEE Symposium on Security and Privacy, the USENIX Security Symposium and the NDSS Symposium, alongside journals such as the Journal of Cybersecurity, which asks for interdisciplinary work with stated societal implications, and IEEE Transactions on Information Forensics and Security. Preprints go to arXiv cs.CR and, for cryptology, the IACR Cryptology ePrint Archive, which checks scope but does not peer review.
The field's shared reference points sit outside the papers. Vulnerabilities are identified through the CVE Program, scored with CVSS (version 4.0 is current) and enriched in the National Vulnerability Database. CISA's Known Exploited Vulnerabilities Catalog and MITRE ATT&CK give researchers common data on what is attacked and how. Coordinated disclosure through bodies such as the CERT Coordination Center, which typically discloses publicly 45 days after first contact if a vendor does not respond, shapes when and how findings can be published. The Cyber Security Body of Knowledge (CyBOK) organises the field into 22 knowledge areas in six categories.
Compliance and governance frameworks matter as much as technique: NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev. 5 with its 20 control families, ISO/IEC 27001 (third edition, 2022) and the NIST post-quantum standards, FIPS 203, 204 and 205, released in August 2024. In the United States the NSF SaTC programme funds research, education and seedling projects; in the UK the NCSC and EPSRC recognise Academic Centres of Excellence in Cyber Security Research. The specialisations below cover cryptography, software and network security, malware, operations, hardware, industrial systems, privacy, human factors, identity, AI security and governance.
New to the field? What is Cybersecurity & Information Security? →
Reviewed 5 November 2026 by CASRAI Editorial Board
- CyBOK knowledge base v1.1(read 5 November 2026)
- CERT Coordination Center (Wikipedia)(read 5 November 2026)
- ACM SIGSAC(read 5 November 2026)
- NSF Security, Privacy, and Trust in Cyberspace (SaTC)(read 5 November 2026)
- CISA Known Exploited Vulnerabilities Catalog(read 5 November 2026)
- MITRE ATT&CK(read 5 November 2026)
- NIST Cybersecurity Framework 2.0(read 5 November 2026)
- Common Vulnerability Scoring System (CVSS)(read 5 November 2026)
- NIST post-quantum cryptography standards(read 5 November 2026)
- IACR Cryptology ePrint Archive(read 5 November 2026)
Field at a glance
Journals
- Journal of Cybersecurity (Oxford University Press)
- Interdisciplinary journal that publishes original cyber research with explicit societal, human or organisational implications.Website ↗
- IEEE Transactions on Information Forensics and Security
- IEEE Signal Processing Society journal on information forensics and security, monthly since a March 2006 first issue.Website ↗
Societies
- ACM SIGSAC
- ACM Special Interest Group on Security, Audit and Control; runs CCS (since 1993), SACMAT, ASIACCS, WiSec and CODASPY.Website ↗
- IEEE Symposium on Security and Privacy
- Annual security and privacy conference started in 1980 and regarded as among the top in the field.Website ↗
- USENIX
- Nonprofit membership organisation founded in 1975; organises the USENIX Security Symposium.Website ↗
- NDSS Symposium (Internet Society)
- Network and Distributed System Security Symposium, hosted by the Internet Society for over 30 years, with about 120 papers a year.Website ↗
- FIRST (Forum of Incident Response and Security Teams)
- Incident response and product security team forum founded in 1990; maintains CVSS, TLP and EPSS.Website ↗
Funders and programmes
- NSF Security, Privacy, and Trust in Cyberspace (SaTC)
- Cross-directorate NSF programme with RES, EDU and SEED designations, funding security, privacy and trust research.Website ↗
- Academic Centres of Excellence in Cyber Security Research
- NCSC and EPSRC recognition scheme for UK universities; the latest assessment recognised 21 universities.Website ↗
Archives, facilities and data
- CVE Program
- Reference catalogue of publicly known vulnerabilities with unique CVE identifiers, maintained by MITRE with CVE Numbering Authorities.Website ↗
- National Vulnerability Database (NVD)
- NIST-run SCAP-formatted database that enriches CVE entries with CVSS scores, product names and impact metrics.Website ↗
- CISA Known Exploited Vulnerabilities Catalog
- CISA catalogue of vulnerabilities exploited in the wild, downloadable as CSV or JSON and used to prioritise fixes.Website ↗
- MITRE ATT&CK
- Free knowledge base of adversary tactics and techniques with Enterprise, Mobile and ICS matrices.Website ↗
Standards and formats
- NIST Cybersecurity Framework 2.0
- Current NIST framework for managing cybersecurity risk; CSF 1.1 is archived.Website ↗ · Our guide →
- NIST SP 800-53 Rev. 5
- Catalogue of security and privacy controls in 20 families, with OSCAL versions and an ISO/IEC 27001:2022 crosswalk.Website ↗
- ISO/IEC 27001
- Information security management system standard; the current edition is the third, published October 2022.Website ↗ · Our guide →
- Common Vulnerability Scoring System (CVSS)
- FIRST standard that scores vulnerability severity; v4.0 is current and v3.1 and earlier are archived.Website ↗
- NIST post-quantum cryptography standards
- FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), released August 2024.Website ↗ · Our guide →
66 pages across 8 topic areas
Research Tools & Software
- Block Cipher: Implementation and Modes Guide
Implement block ciphers in Python and OpenSSL: configure AES-256, select CBC or GCM modes, handle PKCS#7 padding, and benchmark research performance.…
- Cuckoo Sandbox: Automated Malware Analysis Guide
Configure Cuckoo Sandbox for automated malware analysis, run isolated VM detonations, extract JSON telemetry reports, and troubleshoot analysis pipeli…
- CVE Database: How to Search CVE Records in Research
How to search and correlate CVE database records across CVE.org, NIST NVD, OSV, and GitHub Advisory using REST APIs and CLI tools in research computin…
- Data Poisoning: Types, Pipeline Stages and Defenses
Data poisoning explained: NIST attack types, the OWASP pipeline stages where it enters, and a provenance checklist for training-data curators.…
- IEC 62443 Explained: Parts, Security Levels and Foundational Requirements
A reference to IEC 62443: its parts by role, security levels SL1-SL4, seven foundational requirements, zones and conduits, and ISO 27001 compared.…
- Malware Analysis: Research Workflows and Guide
Conduct malware analysis in research: set up isolated REMnux environments, execute static capability triage with capa, and map telemetry to MITRE ATT&…
- MalwareBazaar: What It Is, Free Access and How to Query It
MalwareBazaar is abuse.ch's free malware sample database. Learn what it holds, the fair-use limits and how to run hash lookups through the API.…
- Microsoft PyRIT: AI Red-Teaming Tool Install and Use Guide
Microsoft PyRIT is an open-source AI red-teaming framework. Install it, run a first attack, read scores and memory, and cite the correct repository.…
- MISP Threat Intelligence Platform: What It Is and How to Use It
MISP threat intelligence platform explained: what the name means, what it does, and how to create and read your first event, from the official docs.…
- OpenCTI: Open-Source Threat Intelligence Platform Guide
OpenCTI install and first-run guide: Docker steps, install gotchas, reading the dashboard, importing a file, and a free-alternatives table.…
- Phishing-Resistant MFA: What Qualifies (NIST 800-63B and CISA)
Which MFA methods are phishing resistant, what NIST SP 800-63B-4 requires at AAL2 and AAL3, and how CISA ranks FIDO/WebAuthn, PKI, OTP, push and SMS.…
- PoPETs: Proceedings on Privacy Enhancing Technologies
What PoPETs (Proceedings on Privacy Enhancing Technologies) is, how it relates to PETS, and how its issues, review cycle and artifact badges work.…
- Pyramid of Pain: The Six Levels of Indicators Explained
The Pyramid of Pain ranks six indicator types, from hashes to TTPs, by how costly each is for an attacker to change. Levels, limits and ATT&CK links.…
- RAPPOR: Privacy-Preserving Telemetry Explained
How RAPPOR (Randomized Aggregatable Privacy-Preserving Ordinal Response) works, its epsilon parameters, and the steps to run the archived demo code.…
- SageMath: System Architecture & Research Use
An authoritative guide to SageMath for researchers: bundled engines, installation options, notebook use, and applications in cryptography and algebra.…
- Tabletop Exercise (TTX): What It Is, Example, and How One Runs
A tabletop exercise is a discussion-based test of a plan. See an example scenario, who takes part, the NIST SP 800-84 stages and the after action repo…
- Threat Intelligence: Definition, Types, Lifecycle and Sources
What threat intelligence is, its three types, the intelligence cycle, OSINT source categories and how STIX/TAXII and ATT&CK turn reports into detectio…
- URLhaus: Threat Feeds, API Queries and Analysis
URLhaus is an open threat intelligence feed. Query malware distribution URLs, access real-time CSV and JSON dumps, and parse threat telemetry via REST…
- Verizon DBIR: Security Incident Analysis Guide
Analyze Verizon DBIR incident data and the VERIS framework in R using verisr to query threat actors, attack vectors, and empirical cybersecurity bench…
- WebAuthn: How Web Authentication Works (Registration and Sign-In)
How WebAuthn registration and sign-in work, what the server must verify, and how WebAuthn, passkeys, FIDO2 and CTAP relate, per W3C Level 3.…
- What Is an Advanced Persistent Threat (APT)? Definitions, Examples, Defences
Advanced persistent threat explained: NIST's differing definitions, MITRE ATT&CK group examples, how APTs get several names, and CISA's mitigations.…
- YARA Rules: Syntax, Command Line and Reading Matches
How YARA rules work: strings and conditions, install from source, a worked rule, command-line options and reading the output.…
Scholarly Publishing
- ACSAC: Annual Computer Security Applications Conference
Comprehensive guide to the Annual Computer Security Applications Conference (ACSAC), including applied research tracks, artifact evaluations, and proc…
- CAPEC: Common Attack Pattern Enumeration Guide
A comprehensive guide to MITRE CAPEC: understanding common attack pattern enumerations, abstraction levels, and integrations with CWE and ATT&CK.…
- CISA KEV: Known Exploited Vulnerabilities Guide
A guide to the CISA KEV Catalog: active exploitation criteria, BOD 26-04 mandates, JSON feeds, and vulnerability prioritization workflows for institut…
- Common Vulnerabilities and Exposures (CVE) Guide
An authoritative guide to the CVE Program, detailing vulnerability identification, CNA workflows, CVE Record JSON 5.1 schemas, and security integratio…
- CVSS Score: Common Vulnerability Scoring Guide
A comprehensive guide to CVSS scores: understanding base metrics, 0.0 to 10.0 severity ranges, CVSS v4.0 updates, and CVE differences.…
- CWE: Common Weakness Enumeration Platform Guide
A guide to Common Weakness Enumeration (CWE): software and hardware weakness hierarchies, CWE vs CVE differences, CWE Top 25, and root cause mapping.…
- EPSS: Exploit Prediction Scoring System Guide
A comprehensive guide to the Exploit Prediction Scoring System (EPSS): understanding 30-day exploit probabilities, percentiles, CVSS differences, and…
- European Vulnerability Database (EUVD): NIS 2 Guide
A comprehensive guide to the European Vulnerability Database (EUVD), ENISA's NIS 2 repository for coordinated disclosure, CVSS scoring, and threat int…
- GCVE: Global CVE Allocation System Guide
A technical guide to the Global CVE Allocation System (GCVE), an open, federated vulnerability numbering architecture operated by CIRCL.…
- IEEE Symposium on Security and Privacy Guide
A comprehensive guide to the IEEE Symposium on Security and Privacy (S&P), the premier academic conference in computer security known as Oakland.…
- MITRE ATLAS: What It Is and How to Use the AI Threat Matrix
MITRE ATLAS is a knowledge base of adversary tactics against AI systems. Where its data lives, which file to use, and its limits.…
- MITRE ATT&CK: Tactics, Matrix and Guide
A guide to the MITRE ATT&CK framework: matrix structure, TTP taxonomy, enterprise tactics, ATT&CK Navigator tools, and threat intelligence workflows.…
- National Vulnerability Database (NVD) Guide
A comprehensive operational guide to the National Vulnerability Database (NVD) maintained by NIST, detailing CVE enrichment, CVSS scores, and API 2.0…
- NDSS Symposium: Security Conference & Papers Guide
A comprehensive guide to the NDSS Symposium: Internet Society governance, open-access proceedings, research scope, review cycles, and conference alter…
- SeamlessAccess: How Federated Single Sign-On Works for Institutional Access
SeamlessAccess is a not-for-profit, NISO/GEANT/Internet2/STM-governed initiative for federated single sign-on to subscribed scholarly content. This gu…
- Stakeholder-Specific Vulnerability Categorization (SSVC): Prioritization Guide
A detailed guide to Stakeholder-Specific Vulnerability Categorization (SSVC), explaining decision trees, stakeholder models, and actionable remediatio…
- Traffic Light Protocol (TLP): TLP 2.0 Guide
An authoritative operational guide to the Traffic Light Protocol (TLP 2.0) governed by FIRST, detailing RED, AMBER, GREEN, and CLEAR sharing rules.…
Frontier AI Safety & Governance
- AI Red Teaming: Definition and How It Works in Frontier AI Safety
AI red teaming inside a frontier safety framework is a safeguard-testing commitment, not the AppSec/jailbreak service most search results describe --…
- AI Safety vs. AI Security: What the Distinction Actually Means
A short definitional guide distinguishing AI safety (preventing an AI system from causing unintended harm through its own behavior or capabilities) fr…
- Garak: LLM Vulnerability Scanner and Probing Guide
A researcher guide to garak, the open-source LLM vulnerability scanner: probe architecture, OWASP mapping, CLI testing workflows, and safety evaluatio…
- Gray Swan Arena: Crowdsourced Red-Teaming as Pre-Deployment Evidence
Gray Swan's Arena crowdsources adversarial testing to 15,000+ red-teamers, and two competitions with UK AISI and US CAISI produced public papers. What…
- Is AI Red-Teaming Security Theater? What the Research Says
Carnegie Mellon researchers surveyed the AI red-teaming literature and analyzed six real exercises -- Bing Chat, GPT-4, Gopher, two Claude releases, a…
- NIST AI 100-2 vs. OWASP Top 10 for LLM Applications: Taxonomy vs. Ranked Risk ListComparison
NIST AI 100-2e2025 and the OWASP Top 10 for LLM Applications get cited together as though they were competing standards. They are not the same kind of…
- UK AI Safety Institute vs AI Security Institute: The 2025 Rename Explained
The UK government renamed its AI Safety Institute to the AI Security Institute on 14 February 2025. It is the same organisation under a new name, not…
- What Anthropic Pays for a Jailbreak: Inside Its Model Safety Bug Bounty
Anthropic will pay up to $15,000 through HackerOne for a novel, universal jailbreak against its CBRN and cybersecurity safeguards. Here's exactly what…
Research Methods & Statistics
- Cryptography vs Cybersecurity: What Is the Difference?Comparison
Cryptography is the mathematics of securing information; cybersecurity is the broader practice of protecting systems, data and people. Compared side b…
- CVE vs CVSS: Key Differences and Roles in SecurityComparison
A side-by-side comparison of CVE and CVSS, highlighting the differences between vulnerability identification dictionaries and severity scoring framewo…
- CVE vs CWE: Key Differences and CVSS RolesComparison
A technical comparison of CVE and CWE, contrasting specific vulnerability instances against abstract software flaw taxonomies and explaining the role…
- EPSS vs CVSS: Vulnerability Threat vs SeverityComparison
A detailed technical comparison of EPSS and CVSS, explaining the distinction between exploitation probability and vulnerability severity in risk manag…
- What Is Cryptography? Methods, Standards, and Research Context
Cryptography is the mathematics of protecting information against adversaries. This guide covers symmetric and public-key methods, hashing, signatures…
- What Is Cybersecurity? A Research Field and an Institutional Duty
Cybersecurity is the discipline of protecting computing systems and the information on them. This guide covers it as a research field and as an obliga…
Research Data Management
- Data Anonymisation in Research: Techniques, Standards, and When It’s Required
How researchers anonymise data: core techniques, the GDPR/HIPAA/NIST standards that define the term, and when anonymisation is actually required versu…
- Data Security Incident Notification Requirements: GDPR, HIPAA, and State Law
A practical breakdown of when a data security incident involving research data triggers legal notification duties -- GDPR Articles 33 and 34, the HIPA…
- Differential Privacy for Research Data Release
What differential privacy means, a worked numeric example, how to choose an epsilon privacy budget, and when it should replace suppression for releasi…
- k-Anonymity and Disclosure Risk in Shared Datasets
How k-anonymity, l-diversity and t-closeness quantify re-identification risk in a dataset before it is shared, with a worked example and how they rela…
- Synthetic Data in Research: Generation, Documentation, and Sharing Policy
How synthetic data is generated, documented, and validated in research settings, and what current GDPR, ICO, EHDS, and NIH guidance actually says abou…
Research Integrity & Compliance
- EU Cyber Resilience Act (Regulation 2024/2847)
Scope, milestones, conformity routes, reporting deadlines and maximum fines under the EU Cyber Resilience Act, Regulation (EU) 2024/2847.…
- ISO 27001 for Research Data Security
ISO/IEC 27001 is a general information security management standard, not a research-data standard — here is what it actually certifies, why funders an…
- NIST Cybersecurity Framework 2.0: What It Actually Requires for a Federally Funded Research Lab
What CSF 2.0's six functions (including the new Govern function) actually mean, how CSF 2.0 relates to NIST 800-171/CUI compliance obligations researc…
- NIST SP 800-171 and CUI in University Research
When DFARS 252.204-7012 flows down to a university award, NIST SP 800-171 and CUI safeguarding become real obligations — distinct from, and often conf…
Laboratory Compliance & Quality
- FDA Premarket Cybersecurity for Medical Devices: Section 524B, SBOM, and Threat Modeling
What FDA's premarket reviewers actually check under Section 524B: the cyber device test, the SBOM, the secure product development framework, threat mo…
- What Is Medical Device Cybersecurity?
Medical device cybersecurity means protecting connected, software-driven devices from vulnerabilities that could affect patient safety -- and why FDA…
Research Information & Identifiers
- InCommon Explained: The US Research and Education Identity Federation
InCommon is the identity federation operated by Internet2 that lets a US researcher's campus login work at thousands of external services. This guide…
- Shibboleth Single Sign-On: How Federated SAML Authentication Works
Shibboleth is the open-source SAML software behind "Login via your institution" -- how Identity Provider and Service Provider roles work, how InCommon…
Key terms
- ACM Transactions on Privacy and Security (TOPS)
- Computers & Security: Journal Metrics & Impact
- Controlled unclassified information (CUI)
- De-identification
- IEEE Transactions on Dependable and Secure Computing
- IEEE Transactions on Information Forensics and Security
- Jailbreak (LLM)
- NIST SP 800-171
- Prompt injection
- Pseudonymisation
- Red-teaming
