How to Find PhD Supervisors in Cybersecurity (and Get Funded)

Cybersecurity has a funding story most adjacent fields don't: a single, widely marketed national scholarship program that almost every university's own cybersecurity page promotes, and that program has always excluded international students entirely. Understanding that restriction, and what actually funds a non-citizen through a cybersecurity PhD instead, matters more here than in most of the other technical fields our field-hub guides cover.

CyberAI SFS: the program everyone names, and who it actually funds

What used to be called CyberCorps Scholarship for Service has recently been renamed CyberAICorps Scholarship for Service (CyberAI SFS), now operating under NSF solicitation NSF 26-503, with its scope expanded to explicitly cover CyberAI, the use of artificial intelligence in cybersecurity and the security of AI systems themselves, alongside its original mission. The structure hasn't changed: NSF awards funding to participating universities, which run their own scholarship tracks, and the baseline eligibility rule has always been the same hard line, US citizens and lawful permanent residents only, in exchange for a post-graduation service obligation working in the cybersecurity mission of a federal, state, local, or tribal government agency. If you've seen "CyberCorps" referenced on a university's cybersecurity page and assumed it's a general funding route, it isn't, for most international applicants it's effectively not available at all.

The money runs through the university, and terms vary school to school

Even for eligible US applicants, CyberAI SFS funding isn't something you apply for directly through NSF. NSF makes institutional awards, typically ranging from roughly $300,000 to $2.5 million per grant, to participating universities, and each university then runs its own version of the scholarship with its own specific requirements layered on the federal baseline. One participating university's PhD track requires a Computer Science PhD with a minimum 3.25 GPA on a 4.00 scale; another requires a program of study that includes at least four 400- or 500-level cybersecurity courses. The practical implication is that you apply through your target university's own SFS office, and the exact eligibility bar genuinely differs from one school's program to the next, so check a specific university's own current SFS page rather than assuming one school's terms apply everywhere.

For international students: the real route is a professor's own grant

CyberAI SFS's citizenship restriction doesn't mean cybersecurity research in US universities is unfunded for international students, it means the funding comes from a different source: a professor's own active research grant. Cybersecurity research draws support from NSF's core Secure and Trustworthy Cyberspace (SaTC) program within its computer and information science directorate, from DARPA-funded projects, and from the Department of Homeland Security's Science and Technology Directorate, none of which carry a blanket citizenship bar the way CyberAI SFS does. A professor holding an active SaTC or DARPA award can fund a PhD student, international or domestic, through that grant's own research-assistant budget line, exactly the same mechanism our guide to finding computer science PhD supervisors describes for CS funding more broadly. The practical search strategy for an international applicant isn't "which university runs an SFS program," it's "which specific professor currently holds an active, non-SFS grant with room for a new student," a genuinely different target than the one most university marketing pages lead with.

CyberAI SFS isn't the only citizenship-gated program in this field

The Department of Defense's SMART Scholarship-for-Service program is a second major named funding source that shows up constantly in cybersecurity and related STEM funding searches, and it carries its own service-obligation structure, generally one year of civilian Department of Defense employment for each year of funding received. Its citizenship rules have genuinely shifted over time and sources describe them inconsistently: older guidance restricts it to US citizens only, while some more recent program listings describe eligibility extending to citizens of a small set of allied nations, Australia, Canada, New Zealand, and the United Kingdom, alongside US citizens. We could not resolve that inconsistency against a single current authoritative source in the research for this guide. Either way, SMART remains closed to the large majority of international applicants, reinforcing the same underlying pattern as CyberAI SFS: check a program's own current, official eligibility page directly at smartscholarship.org rather than assuming either an older or a newer secondary description still applies.

Export controls and clearance requirements: real, but not universal

A second restriction worth knowing about, separate from CyberAI SFS, is that some cybersecurity research touches areas subject to export-control rules or security-clearance requirements, particularly work tied to critical infrastructure protection, certain cryptographic systems, or defense-adjacent projects. This is the same pattern our guide to engineering professors and international students describes for ITAR-restricted labs more broadly, and it can genuinely bar non-citizens from participating in a specific project regardless of how the position is funded. It isn't universal across the field though: a large share of academic cybersecurity research, usable security, privacy-enhancing technologies, applied cryptography published in the open literature, carries no such restriction at all. Ask a prospective advisor directly whether a specific project involves export-control or clearance requirements rather than assuming either answer based on the subfield's name alone.

One ambiguous exception worth checking for yourself: SWSIS

Scholarships for Women Studying Information Security (SWSIS), run through CRA-W and ACSA, is a named scholarship for women enrolled in an information security or related program, open to upper-level undergraduates and Master's students, generally requiring enrollment at a US university campus. Its citizenship rule is the rare case in this field that isn't cleanly settled: one university's own scholarship office states a US citizenship requirement directly, while a separate program description lists the requirement more loosely as enrollment at a US institution without explicitly naming citizenship as a separate gate, and we could not resolve that inconsistency against the sponsor's own current cycle materials. If you're a woman enrolled in an information security program at a US university regardless of citizenship, it's worth emailing SWSIS directly (swsis@swsis.org) to confirm current eligibility for yourself rather than assuming either description settles the question, since this is one of the only named programs in the field where international eligibility isn't a clear no from the outset.

Where cybersecurity PhDs actually sit administratively

Cybersecurity rarely exists as its own standalone PhD-granting department. Most doctoral-level cybersecurity research happens inside a Computer Science department, sometimes inside a dedicated security research center or institute that spans CS and electrical engineering, and at some universities inside a separate School of Cybersecurity or Information Sciences built specifically around NSA- or DHS-designated Centers of Academic Excellence status. That designation itself, a Center of Academic Excellence in Cyber Defense Education or Cyber Research, is a genuine signal worth checking, since many SFS-participating universities hold it, but it's an institutional credential, not a guarantee that any specific professor inside that program currently has funded capacity for a new student.

A practical search order for an international applicant

• Identify professors publishing recently in your specific cybersecurity subfield, cross-checking their recent conference acceptances at venues like IEEE S&P, USENIX Security, and ACM CCS alongside their lab's own project pages.
• Check NSF's award search for each professor's current grants, specifically under the SaTC program, rather than assuming SFS participation at their university tells you anything about their own project's funding or citizenship eligibility.
• Ask directly, in your first email, both whether the professor currently has funding for a new student and whether the specific project carries any export-control or clearance restriction, since the second question rarely gets volunteered unprompted.
• If you are a US citizen or permanent resident, separately check whether your target university participates in CyberAI SFS and what its own specific eligibility terms are, since that program can be a genuinely strong funding option on top of, or instead of, a standard research assistantship.

GradScoutFunding searches professors by field and country, confirms they're actively publishing, and drafts a personalized first email grounded in their real recent paper for you to review and send yourself, it never sends anything automatically. The free tier gives 2 credits with no card required, and paid credit packs are one-time purchases that never expire.

Common questions