Cybersecurity workforce readiness: a three-dimensional assessment and scenario-based intervention framework aligned with NICE

The U.S. cybersecurity workforce faces a readiness gap that, we argue, current educational approaches address only in part. Industry surveys identify the most frequently cited deficiencies as non-technical, such as communication, critical thinking, and professional judgment under pressure, and official reports on major incidents, such as the 2017 Equifax breach and the 2020 SolarWinds compromise, describe accountability and coordination problems alongside technical and governance failures, while the 2023 MOVEit campaign extended exposure beyond organizational perimeters; we use these cases as illustrations, not as evidence that readiness failures caused them. This conceptual analysis proposes a framework to address the gap and positions it through a structured literature review with a documented search of OpenAlex and the Education Resources Information Center (ERIC) (2018–2026). Of 83 included studies, 19 assessed at least one non-technical readiness dimension per individual, 13 of them only through learners’ self-reports, and none combined individual assessment of motivational, cognitive, and communicative readiness, alignment with the National Initiative for Cybersecurity Education (NICE) Framework, and evaluation of AI-generated outputs within a scenario-based development cycle. The proposed framework adapts to cybersecurity a three-component model of professional readiness that was experimentally validated in emergency-services education. Its Contextual Readiness Assessment (CRA) is designed to produce a three-dimensional profile of Motivational-Goal, Cognitive, and Communicative-Activity readiness aligned with NICE Framework Components v2.2.0. Its Cyber-Quest methodology is designed to develop these dimensions through four learning mechanisms: role-activated professional identity, obligatory information asymmetry, deliberate evaluation of AI-generated artifacts, and structured experiential debrief. The two are linked in an assess–develop–reassess cycle in which learners evaluate accurate and inaccurate AI outputs against evidence. The paper distinguishes readiness from competence, performance, and self-efficacy, illustrates the cycle with a hypothetical use case, describes the conditions on which the framework rests, and sets out a staged validation plan; the framework has not yet been validated in cybersecurity populations.