Cybersecurity Research: Venues, Vulnerability Data, Standards and Funders
Cybersecurity research is split between a conference culture and a standards-and-disclosure culture, and anyone funding or administering it needs both. Peer-reviewed results appear at ACM CCS, the IEEE Symposium on Security and Privacy, the USENIX Security Symposium and the NDSS Symposium, alongside journals such as the Journal of Cybersecurity, which asks for interdisciplinary work with stated societal implications, and IEEE Transactions on Information Forensics and Security. Preprints go to arXiv cs.CR and, for cryptology, the IACR Cryptology ePrint Archive, which checks scope but does not peer review.
The field’s shared reference points sit outside the papers. Vulnerabilities are identified through the CVE Program, scored with CVSS (version 4.0 is current) and enriched in the National Vulnerability Database. CISA’s Known Exploited Vulnerabilities Catalog and MITRE ATT&CK give researchers common data on what is attacked and how. Coordinated disclosure through bodies such as the CERT Coordination Center, which typically discloses publicly 45 days after first contact if a vendor does not respond, shapes when and how findings can be published. The Cyber Security Body of Knowledge (CyBOK) organises the field into 22 knowledge areas in six categories.
Compliance and governance frameworks matter as much as technique: NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev. 5 with its 20 control families, ISO/IEC 27001 (third edition, 2022) and the NIST post-quantum standards, FIPS 203, 204 and 205, released in August 2024. In the United States the NSF SaTC programme funds research, education and seedling projects; in the UK the NCSC and EPSRC recognise Academic Centres of Excellence in Cyber Security Research. The specialisations below cover cryptography, software and network security, malware, operations, hardware, industrial systems, privacy, human factors, identity, AI security and governance.
New to the field? What is Cybersecurity & Information Security? →
Reviewed 5 November 2026 byCASRAI Editorial Board
- CyBOK knowledge base v1.1(read 5 November 2026)
- CERT Coordination Center (Wikipedia)(read 5 November 2026)
- ACM SIGSAC(read 5 November 2026)
- NSF Security, Privacy, and Trust in Cyberspace (SaTC)(read 5 November 2026)
- CISA Known Exploited Vulnerabilities Catalog(read 5 November 2026)
- MITRE ATT&CK(read 5 November 2026)
- NIST Cybersecurity Framework 2.0(read 5 November 2026)
- Common Vulnerability Scoring System (CVSS)(read 5 November 2026)
- NIST post-quantum cryptography standards(read 5 November 2026)
- IACR Cryptology ePrint Archive(read 5 November 2026)
Field at a glance
Journals
Journal of Cybersecurity (Oxford University Press)
Interdisciplinary journal that publishes original cyber research with explicit societal, human or organisational implications.Website ↗
IEEE Transactions on Information Forensics and Security
IEEE Signal Processing Society journal on information forensics and security, monthly since a March 2006 first issue.Website ↗
Societies
ACM SIGSAC
ACM Special Interest Group on Security, Audit and Control; runs CCS (since 1993), SACMAT, ASIACCS, WiSec and CODASPY.Website ↗
IEEE Symposium on Security and Privacy
Annual security and privacy conference started in 1980 and regarded as among the top in the field.Website ↗
USENIX
Nonprofit membership organisation founded in 1975; organises the USENIX Security Symposium.Website ↗
NDSS Symposium (Internet Society)
Network and Distributed System Security Symposium, hosted by the Internet Society for over 30 years, with about 120 papers a year.Website ↗
FIRST (Forum of Incident Response and Security Teams)
Incident response and product security team forum founded in 1990; maintains CVSS, TLP and EPSS.Website ↗
Funders and programmes
NSF Security, Privacy, and Trust in Cyberspace (SaTC)
Cross-directorate NSF programme with RES, EDU and SEED designations, funding security, privacy and trust research.Website ↗
Academic Centres of Excellence in Cyber Security Research
NCSC and EPSRC recognition scheme for UK universities; the latest assessment recognised 21 universities.Website ↗
Archives, facilities and data
CVE Program
Reference catalogue of publicly known vulnerabilities with unique CVE identifiers, maintained by MITRE with CVE Numbering Authorities.Website ↗
National Vulnerability Database (NVD)
NIST-run SCAP-formatted database that enriches CVE entries with CVSS scores, product names and impact metrics.Website ↗
CISA Known Exploited Vulnerabilities Catalog
CISA catalogue of vulnerabilities exploited in the wild, downloadable as CSV or JSON and used to prioritise fixes.Website ↗
MITRE ATT&CK
Free knowledge base of adversary tactics and techniques with Enterprise, Mobile and ICS matrices.Website ↗
Standards and formats
NIST Cybersecurity Framework 2.0
Current NIST framework for managing cybersecurity risk; CSF 1.1 is archived.Website ↗ · Our guide →
NIST SP 800-53 Rev. 5
Catalogue of security and privacy controls in 20 families, with OSCAL versions and an ISO/IEC 27001:2022 crosswalk.Website ↗
ISO/IEC 27001
Information security management system standard; the current edition is the third, published October 2022.Website ↗ · Our guide →
Common Vulnerability Scoring System (CVSS)
FIRST standard that scores vulnerability severity; v4.0 is current and v3.1 and earlier are archived.Website ↗
NIST post-quantum cryptography standards
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), released August 2024.Website ↗ · Our guide →
Preprints and indexes
IACR Cryptology ePrint Archive
Author-posted cryptology preprint server; papers are scope-checked, not peer-reviewed.Website ↗
arXiv cs.CR (Cryptography and Security)
arXiv category covering cryptography and security, including authentication and public-key cryptosystems.Website ↗
Frontier AI Safety & Governance
- AI Red Teaming: Definition and How It Works in Frontier AI Safety
AI red teaming inside a frontier safety framework is a safeguard-testing commitment, not the AppSec/jailbreak service most search results describe –…
- AI Safety vs. AI Security: What the Distinction Actually Means
A short definitional guide distinguishing AI safety (preventing an AI system from causing unintended harm through its own behavior or capabilities) fr…
- Gray Swan Arena: Crowdsourced Red-Teaming as Pre-Deployment Evidence
Gray Swan’s Arena crowdsources adversarial testing to 15,000+ red-teamers, and two competitions with UK AISI and US CAISI produced public papers. What…
- Is AI Red-Teaming Security Theater? What the Research Says
Carnegie Mellon researchers surveyed the AI red-teaming literature and analyzed six real exercises — Bing Chat, GPT-4, Gopher, two Claude releases, a…
- NIST AI 100-2 vs. OWASP Top 10 for LLM Applications: Taxonomy vs. Ranked Risk ListComparison
NIST AI 100-2e2025 and the OWASP Top 10 for LLM Applications get cited together as though they were competing standards. They are not the same kind of…
- UK AI Safety Institute vs AI Security Institute: The 2025 Rename Explained
The UK government renamed its AI Safety Institute to the AI Security Institute on 14 February 2025. It is the same organisation under a new name, not…
- What Anthropic Pays for a Jailbreak: Inside Its Model Safety Bug Bounty
Anthropic will pay up to $15,000 through HackerOne for a novel, universal jailbreak against its CBRN and cybersecurity safeguards. Here’s exactly what…
Research Data Management
- Data Anonymisation in Research: Techniques, Standards, and When It’s Required
How researchers anonymise data: core techniques, the GDPR/HIPAA/NIST standards that define the term, and when anonymisation is actually required versu…
- Data Security Incident Notification Requirements: GDPR, HIPAA, and State Law
A practical breakdown of when a data security incident involving research data triggers legal notification duties — GDPR Articles 33 and 34, the HIPA…
- Differential Privacy for Research Data Release
What differential privacy means, a worked numeric example, how to choose an epsilon privacy budget, and when it should replace suppression for releasi…
- k-Anonymity and Disclosure Risk in Shared Datasets
How k-anonymity, l-diversity and t-closeness quantify re-identification risk in a dataset before it is shared, with a worked example and how they rela…
- Synthetic Data in Research: Generation, Documentation, and Sharing Policy
How synthetic data is generated, documented, and validated in research settings, and what current GDPR, ICO, EHDS, and NIH guidance actually says abou…
Research Integrity & Compliance
- ISO 27001 for Research Data Security
ISO/IEC 27001 is a general information security management standard, not a research-data standard — here is what it actually certifies, why funders an…
- NIST Cybersecurity Framework 2.0: What It Actually Requires for a Federally Funded Research Lab
What CSF 2.0’s six functions (including the new Govern function) actually mean, how CSF 2.0 relates to NIST 800-171/CUI compliance obligations researc…
- NIST SP 800-171 and CUI in University Research
When DFARS 252.204-7012 flows down to a university award, NIST SP 800-171 and CUI safeguarding become real obligations — distinct from, and often conf…
Research Methods & Statistics
- Cryptography vs Cybersecurity: What Is the Difference?Comparison
Cryptography is the mathematics of securing information; cybersecurity is the broader practice of protecting systems, data and people. Compared side b…
- What Is Cryptography? Methods, Standards, and Research Context
Cryptography is the mathematics of protecting information against adversaries. This guide covers symmetric and public-key methods, hashing, signatures…
- What Is Cybersecurity? A Research Field and an Institutional Duty
Cybersecurity is the discipline of protecting computing systems and the information on them. This guide covers it as a research field and as an obliga…
Laboratory Compliance & Quality
- FDA Premarket Cybersecurity for Medical Devices: Section 524B, SBOM, and Threat Modeling
What FDA’s premarket reviewers actually check under Section 524B: the cyber device test, the SBOM, the secure product development framework, threat mo…
- What Is Medical Device Cybersecurity?
Medical device cybersecurity means protecting connected, software-driven devices from vulnerabilities that could affect patient safety — and why FDA…
Research Information & Identifiers
- InCommon Explained: The US Research and Education Identity Federation
InCommon is the identity federation operated by Internet2 that lets a US researcher’s campus login work at thousands of external services. This guide…
- Shibboleth Single Sign-On: How Federated SAML Authentication Works
Shibboleth is the open-ntity Provider and Service Provider roles work, how InCommon…
Scholarly Publishing
- SeamlessAccess: How Federated Single Sign-On Works for Institutional Access
SeamlessAccess is a not-for-profit, NISO/GEANT/Internet2/STM-governed initiative for federated single sign-on to subscribed scholarly content. This gu…
Key terms
← All disciplines & industries
