Inspiration

Ursula von der Leyen has unveiled European Commission’s latest Political Guidelines for the period 2024-2029, placing a strong emphasis on addressing the continent’s digital skills shortages. A key focus will be establishing a Union of Skills, aimed at tackling labour and skills gaps across the EU. This ambitious plan will drive investment in lifelong learning, skills retention, and the recognition of diverse types of training, helping citizens work seamlessly across borders.

STEM education overhaul and skills portability to drive EU’s digital transition

The guidelines highlight a pressing need to improve basic skills, particularly in STEM education. A new STEM Education Strategic Plan aims to reverse declining performance, increase the number of qualified STEM teachers, and encourage more women to pursue careers in these fields. Additionally, EU funding for skills development will be better aligned with labour market needs, especially in sectors crucial to the green and digital transitions, also building on the work in the Pact for Skills.

We will boost and refocus skills funding in the EU budget to ensure it is better linked to labour markets and more focused on sectors crucial for the twin transitions.

Recognising the need for cross-border skill mobility, the Commission is set to introduce a Skills Portability Initiative. This will ensure qualifications acquired in one EU country are recognized in others, facilitating the free movement of talent. Further efforts will focus on boosting digital literacy and combating misinformation through a European fact-checking network, with enhanced digital enforcement under the Digital Services Act.

We will establish a Union of Skills – focusing on investment, adult and lifelong learning, skill retention and the recognition of different types of training to enable people to work across our Union.

Draghi report highlights importance of closing skills gaps

The Draghi Report, which similarly stresses the urgency of closing the skills gaps in Europe, underscores the crucial role of digital skills in driving future economic growth. Both the Commission’s guidelines and the report call for action to ensure that Europe remains competitive in an increasingly digital world.

Demographic headwinds imply a shrinking labour force in Europe, while the US population is projected to expand in the coming decades. In this setting, a European strategy to address skills gaps – focused on all stages of education – is essential.

In line with the EU Digital Decade targets, the report emphasizes the need for 80% of working-age Europeans to have basic digital skills by 2030, reflecting the growing importance of digital literacy in the workforce. These initiatives align with broader EU efforts to ensure Europe is prepared for the digital and green transitions.

Digital skills are a necessary condition to develop capacities in digital technologies, to adopt new technologies and even promote the creation of innovative companies. As such, they are essential to the EU’s digital transition. It is key that the population at large is digitally literate, but it is also important that the pool of workers with advanced digital skills, for example in the areas of AI, programming, data management and cybersecurity, expands.

Roxana Mînzatu: a new EVP designate for skills

Roxana Mînzatu, the new Executive Vice President for Skills, is tasked with driving these changes. Her mission includes strengthening Europe’s talent pool through enhanced skills training and education, as outlined in her mission letter.

The new EVP will be tasked with stimulating the Skills Academies, which are responsible for developing learning programs that Member States will use to facilitate the recognition of credentials as a basis for formal qualifications.

She will also develop an Action Plan on Basic Skills and a STEM Education Strategic Plan, backed by the review of the Digital Education Action Plan and the adoption of a Roadmap on the future of digital education and training.

Mînzatu’s leadership will be pivotal in ensuring the EU is prepared for the future, with a strong focus on digital, green, and societal resilience skills.

© European Commission

Digital MERIT is a project co-funded by the European Union under the Digital Europe Programme. It brings together universities from four countries, industrial partners, research centres, technology transfer organizations, and digital innovation hubs with the goal of developing a strong, inclusive, and sustainable educational ecosystem with a four-year program.

The project focuses on creating a knowledge base to address society’s needs in the field of advanced digital skills. One of its key objectives is to reskill non-ICT specialists through conversion courses and provide mobility opportunities for teachers and learners across the six participating countries: Spain, Lithuania, Estonia, Latvia, Italy, and Romania. By doing so, MERIT aims to prepare students and graduates for the job market through industry-relevant courses, hackathons, and employability training.

A special focus is on countries with low scores on the Digital Economy and Society Index (DESI), such as Romania. The program will support the development of ICT specialists and provide students with tools like e-learning resources and blended learning approaches to address real-world challenges. By integrating research and practical solutions, students will gain hands-on experience in labs, companies, and public organizations.

A joint master’s program with industry collaboration

MERIT includes 5 different Master’s programs offered by four leading European universities: Polytechnic University of Catalonia (UPC), Vilnius Gediminas Technical University (VILNIUS TECH), Riga Technical University (RTU), and Tallinn University of technology (TalTech). Whose programs collaborate with each other and are supported by partners including Asoindel, Exacaster, Fondatione Bruno Kessler (FBK), Sunrise Valley Science and Technology Park (SSMTP), UPC Technology Center (CIT-UPC), and the Digital Innovation Zone (DIZNE).

Students will have the opportunity to collaborate with these and other industry leaders on real-world challenges, ensuring their education is aligned with market needs. This partnership allows students to test their solutions in real environment and gain valuable industry experience. While industry, offering challenges for student project will gain from collaboration with students and their research supervisors.

Inclusive and lifelong learning

One of MERIT’s core missions is promoting inclusivity and gender equality in STEM careers. The program will offer mentoring, networking opportunities, and hands-on experience in various sectors. A key focus will be on upskilling and reskilling professionals through short-term courses and lifelong learning initiatives, ensuring individuals stay competitive in the evolving digital landscape.

By fostering advanced digital skills and emphasizing inclusivity, MERIT aims to help shape Europe’s digital future, equipping students with the knowledge and practical experience needed to succeed in a rapidly transforming world.

The digital world already pervades many aspects of our daily lives. We use search engines to find out the result of a football match, manage our money transfers through online banking apps, pay our taxes using governments’ web portals, book flights or accommodation in travel web portals, use messaging software to chat with friends and share photos and videos. And we would not be able to do any of those things without digital skills. Basic digital skills, at their very essence, are a crucial step towards learning many other new things – and aiming higher, for new knowledge. They give confidence to use technology for work, learning and daily life. 

About the author

Luis has a BSc and MSc in Informatics from the Universidad Politécnica de Madrid (UPM) since 1989. He earned his PhD with extraordinary award from the University of Basque Country in 1997. He has served as interim associate professor at UPM (1989-1996), aggregate professor and head of department at Universidad Europea de Madrid (1996-2008) and associate professor at Universidad de Alcalá (since 2008). He was the CEO of an ICT service-oriented SME (2002-2006) and has acted as freelancer consultant for big companies. Luis has been a board member of CEPIS (2011-13, 2016-2020), and as of 2022 he is CEPIS’s president. Over the years, he has helped to shape the development of EU reference frameworks for digital skills and employment. Luis has actively contributed as an official expert to the development of the three main references in the area: the ESCO labour classification for ICT services, the European standard of e-competences for ICT professionals EN6234-1:2019 and DigComp, the Digital Competence Framework for Citizens.

Introduction

If we take a look at labour market trends, we can see that the digital transition has brought up specific needs and transformed many occupations and tasks. Most jobs today require some level of digital skills, including even those that do not ask for high levels of qualifications or experience – like working in a warehouse or as shop assistant, checking stock and inventory. Increasingly, the work of other specialists with higher qualifications in their respective disciplines, is now also dependent on digital skills: biologists need to work with complex digital 3D representations of molecule structures, lawyers now consult big juridical databases to study precedents and all aspects of legislation.
Digital skills are now needed in most jobs: and specific digital skills are also permeating traditional professions to varying degrees. Think of doctors, who work with the latest robotics technology to perform complex surgeries (more specialised skills), manufacturing employees that use industrial robots to speed up processes (different levels depending on the employee’s function), or teachers introducing digital and emerging technologies into teaching and learning. In Europe, just 54% of people have the digital skills needed for the digital world we live in (European Commission, DESI 2022). In 2021, 1 in 6 Europeans aged 16-74 had no digital skills at all and 1 in 4 of that group only had a low level of digital skills. This naturally brings challenges to the labour market, due to the need for some digital competence across roles and occupations. Yet, DESI 2022 shows that around 35% of European citizens still lack even these basic digital skills – which means they are essentially excluded from the job market, and the opportunities made possible by digital technologies. This is combined with difficulties in finding and attracting digital talent, making it even harder to respond to industry needs. More than half of companies in Europe report big difficulties in recruiting ICT specialists (Joint Research Centre, European Commission, 2019), and SMEs in particular, lag behind their larger counterparts in training and upskilling due to limited resources (financial, staffing, etc). Similar data has been disseminated by the Digital Skills and Jobs Coalition, a partnership of organisations from the public, private and non-profit sectors that works to tackle digital skills shortages across Europe.

And if we are to take a closer look at the state-of-play with the labour market in Europe, data and information available point to the need for an urgent push to develop the digital skills of EU citizens and make them fit for employment. Data from CEDEFOP (the EU’s Agency for the Development of European Vocational Education and Training) shows the importance of digital skills for jobs. In 2015, 71% of EU employees thought some fundamental level of digital skills was needed to perform their jobs. More recent data on skills that employers demand, based on millions of Online Job Advertisements (OJAs) in 28 European countries, extracted from the OVATE tool of CEDEFOP shows that digital skills are explicitly mentioned by employers (e.g., “Working with computers” was a requirement in close to 40% of all OJAs across sectors). Many other OJAs simply assume that candidates have such skills.

Digital skills are relevant and needed, and EU policymaking has tried to reflect this. In 2018, the Council of the European Union adopted a recommendation on 8 key competences to support Europeans in gaining the skills and competences needed for personal fulfilment and wellbeing, employability, and social inclusion. This also highlights efforts put in re- and up-skilling policies around digital skills: in 2018, more than half of Europeans lacked digital skills. In 2021, 54% of people aged 16 to 74 had at least a basic level of digital skills (DESI 2022).

Basic definitions for digital skills

Before defining digital skills it is relevant to firstly clarify some more general terms. These terms are: “competence”, “skills”, “knowledge”, and “attitude”. (European Commission, 2019) and they have applied to the main EU reference on digital competence, DigComp (now in its 2.2 edition), which we will talk about further on.

• Competence is the demonstrated ability to apply knowledge, skills, and attitudes for achieving observable results. For example, competence “Programming” can be described as “To plan and develop a sequence of understandable instructions for a computing system to solve a given problem or to perform a specific task”.
• A skill is the ability to carry out processes and use the existing knowledge to achieve results: e.g., “Able to verify and modify what type of metadata (e.g., location, time) is included in pictures being shared in order to protect privacy”.
• Knowledge is composed of the concepts, facts and figures, ideas and theories which are already established, and support the understanding of a certain area or subject: e.g., “Knows the main functions of the most common digital devices (e.g., computer, tablet, smartphone)”.
• Attitudes describe the disposition and mindset to act or react to ideas, persons, or situations: e.g., “Open towards sharing digital content that might be interesting and useful to others”.

See our infographic below for an illustration of this.

Getting to a definition of digital skills

The UNESCO Institute for Statistics (2009) defines digital skills as “a range of abilities to use digital devices, communication applications, and networks to access and manage information”. These abilities make possible creating and sharing digital content, communicating, and collaborating with others, solving problems, and finding creative opportunities. Similarly, the Council Recommendation on Key Competences for Life-long Learning defined digital competence as ‘the confident, critical and responsible use of, and engagement with, digital technologies for learning, at work, and for participation in society. It is defined as a combination of knowledge, skills, and attitudes’.

There is a strong link between digital skills and key competences enabling lifelong learning. European citizens should be equipped with key skills, needed for an increasingly digital world: such as the ability to filter, use, access or manage private data, personal information, one’s digital footprint, stay safe online and effectively use technologies like AI and other software. People should also ‘be able to use digital technologies to support their active citizenship and social inclusion, collaboration with others, and creativity towards personal, social, or commercial goals’ (European Commission, 2019).

This concept of digital skills is more concerned with European citizens in general, rather than the specialised skills for ICT professionals. The EU framework for citizens’ digital competence (DigComp), which we will look more in detail later, contains an outline of the digital skills citizens need to remain competitive on the labour market, socialise, shop, and learn in today’s digital world.

Categories and levels of digital skills

There are two main categories of digital skills out there: 

1. the general ones applicable to common context of life and work, and
2. the professional ones for ICT experts.

In the case of the Category A (people in general) common EU frameworks like DigComp covers a range of levels of digital skills from basic to very specialised, so the spectrum of general digital skills could be wide and varied. They range from really foundational level such (e.g., mere use of a PC, tablet or mobile device for emailing or internet browsing) to some moderate ICT use (like productivity and office tools like word-processing, creating documents and/or spreadsheets) and some advanced ICT skills (such as the initial ability to develop applications or programming or using sophisticated computer statistical analysis packages). DigComp defines 4 layers of proficiency such as foundation, intermediate, advanced, and highly-specialised.

Above those levels of general digital skills, we can find specific skills for those in ICT profession such as using software design patterns or defining firewall rules. There is a tenuous and fuzzy limit, really difficult to strictly define, between the upper levels of digital skills of those not specifically qualified as ICT professionals and the basic levels of skills of those in the professional field of technology. A good number of the skills in that limit between general digital competence and ICT professionalism frequently lie in the context of hybrid digital jobs such as digital compliance assessor. The standard EN16234-1:2019 (CEN, 2019), known as the e-Competence Framework, defines 41 e-competences, tens of examples of highly specialised skills for them and up to five levels of proficiency, which are mostly above the eight levels defined by DigComp for general citizens. Level 1, the lowest of EN16234 refers to the most basic professional skills where practitioners mostly follow well-defined procedures in structured situations: like in the case of performing simple tests of applications or acting in strict compliance with detailed instructions.

The categories and levels of digital skills and competences could also be complemented with streamlined and effective policy action. For example, the EU Digital Skills and Jobs Coalition mentions the following ones:

• Digital skills for all, to enable all citizens to be active in our digital society.
• Digital skills for the labour force for the digital economy.
• Digital skills for ICT professionals and other digital experts, across industry sectors
• Digital skills in education, for teaching and learning of digital skills in a lifelong learning perspective, including the training of teachers.

The importance of terminology and frameworks

As it’s been the case with digital jobs, the interest in digital skills has enabled a prolific period of initiatives and proposals of models and training options. The rapid development and the high numbers of options have sometimes hindered the best understanding by the general public, policy makers, employers, professionals related to education and training, etc. This situation bears a strong similarity to the landscape for training and certification in foreign languages in Europe before  the Common European Framework of Reference for Languages (CEFRL) was first published back in 2001. Before the framework’s birth, the definition of competence in a foreign language was subject to an unclear selection of existing certificates from different systems, making it challenging to compare the achievement of people in languages.

Fortunately, the EU has developed Digital Competence Framework for Citizen (DigComp) to act in similar way as CEFRL did in the past for languages. DigComp provides a common understanding of what digital competence is: version 2.2 (Vuorikari et al., 2022) has been published in March 2022. As stated in the framework, the model covers different levels of digital competence for citizens with five competence areas (Information and data literacy, Communication and collaboration, Digital content creation, Safety, and Problem-solving);  and 21 specific competences, each of which described in 8 proficiency levels (see Figure 1. Structure of competences areas and competences in DigComp below). Levels range from “Foundation” as label for levels 1 and 2 up to “Highly specialised” for levels 7 and 8.

The highest level is similar to the one required for professionals in hybrid jobs or, in some cases, to ICT-intensive jobs. The last version 2.2 of DigComp can enhance a more homogeneity in interpretation of competences thanks to the extensive set of 250 examples. The following ones are examples of knowledge, skills, and attitudes for some of the competences described in DigComp:

• Area 1. Information and data literacy
  • Competence 1.2 Evaluating and digital content, knowledge
  • Example 19: “Aware of potential information biases caused by various factors (e.g., data, algorithms, editorial choices, censorship, one’s own personal limitations)”
• Area 2. Communication and collaboration
  • Competence 2.3 Collaborating through digital technologies
  • Example 85: “Knows how to use digital tools to facilitate and improve collaborative processes, for example through shared visual boards and digital canvases (e.g. Mural, Miro, Padlet)”
• Area 4. Safety competence
  • 4.2 Protecting personal data and privacy, attitudes
  • Example 188: “Confident in carrying out online transactions after taking appropriate safety and security measures”. 

As DigComp is addressed to digital competence of general citizens, there are other complementary models focused on other contexts (e.g., education) which can contribute to the best implementation and development of digital skills in EU. For example, DigCompEdu (Redecker and Punie, 2017) details 22 competences organised in six Areas, not focused on technical skills but on how digital technologies can be used to enhance and innovate education and training. There is also a version named as DigCompOrg (Kampylis et al., 2015) with seven key elements and 15 sub-elements intended as a comprehensive and generic conceptual framework that reflects all aspects of the process of systematically integrating digital learning in educational organisations. This framework is complemented by SELFIE (Self-reflection on Effective Learning by Fostering the use of Innovative Educational technologies).

Although still pending a clear solid framework of digital competence for the labour market, we can find some preliminary cases of using DigComp for jobs in (Kluzer et al., 2020). Another example is the project EU4D that also created a digital competence framework for SMEs combining DigComp and EN16234-1:2019 Standard (CEN, 2019) for the eSkills promotion for the states of the Eastern European Partnership.

DigComp has had a influence and impact on other relevant European frameworks and reference model for employment and education, for example: the e-CF EN16234-1:2019 Standard (CEN, 2019) has included an annex to explain the possible similarities and differences with it. Moreover, many local initiatives and models on digital skills have used DigComp as initial basis for their development and activity: (Kluzer and Pujol Priego, 2018) shows a good catalogue of them.

Assessing digital skills

Given the relevance of digital skills for many aspects of life and work, it is not only important to promote their development in all contexts (e.g., education, labour market, long life learning, etc.). Training and skilling cannot help if we do not have methods for assessing digital competence and, in the end, for knowing the real capacity of a person to apply digital skills in practice. Digital skills frameworks and models exist, but they are far from widespread and clear in practice – and the development of assessment methods to test skills has not been as relevant as it should have been. We need to make a distinction between skills assessment or self-evaluation mechanisms for individuals, and the use of general indicators to represent the acquisition of digital skills for large populations and countries.

Skills assessment for individuals

We can already find a good number of proposals of methods and schemes of assessment methods for digital skills at different levels. The panorama might be confusing and hard to compare and understand, as many of the options have not clearly defined their foundations and provided details to rely on their capacity to assess real digital competence of a person.

Logically, DigComp serves as basis for different tools and methods for assessment. They frequently appear as self-assessment tools like DigCompSAT (Clifford et al., 2020). Its approach is “not intended to measure the users’ current digital competence in view of its certification or similar purposes”. For example, the tool asks the users to declare in a scale their perceived capacity of skill to carry out some actions, e.g., “I know how to send, reply and forward e-mails”, the degree of knowledge in some aspects, e.g., “I know about digital tools that can help older people or people with special needs” or even the degree of adherence to some attitudes, e.g., “When I face a technical problem, I try step-by-step to identify the problem”.

Another tool is Test your digital skills!, developed based on an initiative by the European Commission, and hosted on the Digital Skills and Jobs Platform. Again, it works as self-assessment tool for one’s digital competence, but also offers a range of additional features:

• The tool requests on some data on the user’s part related to their education and occupation to provide some extra guidance at the end of test, not only highlighting the achieved level in each of the DigComp areas, but also suggesting learning paths to build further knowledge and improve competences.
• Similar to other tools, it contains questions based on the knowledge, skills, actions or habits as perceived by the user, such as “I know how to copy and move files” answering in a scale of capacity or autonomy for each case.
• But also includes typical test multiple choice questions with limited time to answer, checking knowledge on typical digital concepts: e.g., “What is the purpose of the Eraser tool?” or “How many digits are in a PUK code?”.

There are many self-assessment tools aligned to DigComp developed by local or national initiatives and frequently as result of EU-funded projects under programmes like Erasmus+. Of course, there are other tools inspired in other models or simply with no clear link to existing models or frameworks of general digital skills.

In the case of ICT professional skills, the development of general self-assessment tools is more difficult and less effective as the huge variety and sophistication of topics recommend focusing in a specific area in each case. However, the existence of the e-Competence Framework (standard EN16234-1) enables the work with general high level of e-competences applicable to all area of ICT profession. One relevant implementation of this idea is the self-assessment tool e-CF Explorer where ICT specialists can generate a profile of their e-competences through a self-assessment questionnaire and compare the result to one of the predefined recommended profile for common ICT professional roles.

General indicators of digital skills for large populations

On a general and higher policy level, the EU has the DESI (Digital Economy and Society Index), which summarises indicators on Europe’s digital performance and tracks the progress of EU Member States in particular areas, one of which is reserved for digital skills. Since its start in 2014, DESI covers four main areas of digital progress (Human Capital, Connectivity, Integration of digital technology and Digital public services). The first area collects the information related to digital skills firstly considering internet user skills (1a) detecting individual with, at least, basic digital skills, the ones with above basic digital skills and those with, at least, basic software skills. In this first area, there are also indicators on advanced skills and development (1b) counting numbers of ICT specialists, how many of them are female professionals, the number of enterprises providing ICT training and the number of ICT graduates.

The basis of methodology for part 1a is a survey to citizens (European Union survey on ICT usage in Households and by Individuals) asking about the number of activities carried out during the previous 3 months in four dimensions: information, communication, problem solving and software for content creation. As example of questions, surveyed citizens declare how frequently they use the internet (daily, once a week, once in last three months) or if they have ordered goods or services over the internet for private use in the previous 12 months. Part 1B is based on surveys and reports from labour market and education. DESI annual reports are used by policy makers and stakeholders in education and other areas to monitor the evolution of qualification of population in digital skills and competences (see Figure 2 – Report on evolution of digital skills in DESI Report 2018-2022 below).

The last DESI (European Commission, 2022) report shows that high percentages of individuals below 54 years old with at least with basic skills (ranging 55% to 71% depending on age) while older ones (above 65 yrs., 25%), retired and inactive (29%) and those with no or low formal education (32%) have the lowest percentages. Average for EU is 53.9%. Moreover, 26% of individuals have above basic digital skills.

Certification of digital skills

Although these tools are relevant and popular and contribute to the awareness of the concept of digital skills and the different competences covered by DigComp, it is necessary to have a mechanism to effectively assess the digital skills of people. Different studies have shown that the perception of digital skills by an individual, and the reality in practice did not match, with routinary overestimation of abilities. Even the Certification as basis for independent and objectively credentialing digital skills in a valid way for third parties is an essential element for the development of digital skills in all contexts.

In the case of Europe, the certification of general digital skills still appears muddled when compared with the case of language supported by CEFRL, commented above. There is a variety of digital skills training and certification opportunities offered by various organisations and governments, although few with relevant numbers of activity, i.e., millions of certificates (e.g., ICDL, Microsoft MOS, etc.). These certifications work in different way than the self-assessment tools mentioned earlier in this paper: they check the identity of candidates and ensure that they do the tasks and questions of tests independently and without extra help from either somebody, or their notes. Instead of questions on habits or knowledge, the tests also requests users’ answers on systematic questions on knowledge (usually framed as multiple-choice questions) in terms of some tasks taking place directly in the real computer environment where the system checks if the result is correct: e.g., “underline the word “xxx” in the given text”, “recover a deleted file from the recycle bin”, “set a password for a file”, etc.

However, it is difficult to establish an easily recognisable qualification or certificate, massively adopted de facto in the job market or in education. This is the reason why the Digital Education Action Plan 2021-2027 included as Action 9 to “Develop a European Digital Skills Certificate (EDSC) that may be recognised and accepted by governments, employers and other stakeholders across Europe”. In February 2022, the European Commission launched a tender for a feasibility study exploring scenarios for the European Digital Skills Certificate (EDSC) with relevant conclusions expected towards the end of 2023 that will serve to better define a viable solution for this EDSC, probably ranging from mapping existing certifications to DigComp up to even develop a new option.

If we refer to certification of advanced digital skills and the ones for ICT professionals, the scenario looks a bit differently. There is a huge number of certifications already in the market: some unofficial non-exhaustive catalogues have identified more than 1,300 from more than 160 different providers. There are two main types of ICT professional certifications: the ones from technology vendors (e.g., Microsoft, CISCO, Oracle, etc.) that serve as main qualifications of capability of use of their tools and technology and the ones from independent entities (e.g., ISACA for IT security certifications, AXELOS on ITIL service management, etc.), focused on international methodologies, models, best practices or standards. There are many levels of exigence for earning certifications, from beginners’ level, containing simple tests to more advanced, experts’ certifications with tests, practical exercises, and review of CV – or in some cases, even with interviews. Some of them also require a regular maintenance. As shown in studies (García-García and Fernández-Sanz, 2007), ICT certifications represent a possible interesting option for entering the ICT professional world for those without a strong training or educational background in ICT; they also serve to enhance the specialisation of ICT graduates.

Looking to the future of digital skills and the EU Digital Decade

Digital skills have become essential for everybody in daily life, at work and in education. Although digital technology is not available to a large percentage of population, digital skills have not progressed at the same pace of access to devices, networks or application. Given the importance of digital transformation for Society and economy, the European Commission launched in 2021 the initiative of the Digital Decade to “empower businesses and people in a human-centred, sustainable and more prosperous digital future” with relevant targets with the horizon of 2030. There are two targets on skills: minimum of 80% of population with basic digital skills and 20 million of ICT specialists. We have seen along this document how both aspects are already supported by the existence of common frameworks that define details and guide the actions: DigComp and e-Competence Framework (standard EN16234). Both references are regularly updated to follow the fast evolution of technology and digital world.

If the need of digital skills is present in most of the personal and professional activities at present time, studies are forecasting a continuous growth in demand of digital skills for employment and professional career, putting digital literacy at the core of transversal skills (OECD, 2021). Even more aspects of specialised domains in ICT are pouring slowly but continuously into the pot of digital skills for citizens as the last version 2.2 of DigComp has showed with the inclusion of references to Artificial Intelligence. As we have commented before, although progressing and making efforts to expand digitisation and qualification in digital skills, the indicators in Europe are still far from what the EU requires for a prosper digital future. So, digital reskilling and upskilling with clear strategies of life-long learning will be the prominent trend from now.
Image credit: Kids, Adults and Computers at Hack4Kids” by Alexandre Dulaunoy is licensed under CC BY-SA 2.0.

When we talk about new, emerging technologies, we tend to wrap them up together. Artificial Intelligence (AI), Internet of Things (IoT), Machine Learning, Robotics all blend into one big digital cacophony of terms that few of us understand – whether this is due to the difficulty or novelty of the technologies themselves. While cybersecurity often falls under this umbrella, it is far from new (or emerging), and quite different in its nature and function.

In fact, we can think of cybersecurity as an enabling technology: one that makes it possible for advances in other disciplines like AI, IoT and robotics to take place in a safe and secure online space. And as these digital technologies evolve and are increasingly adopted across sectors, cybersecurity grows in importance – and so does the need for skilled cybersecurity experts with more specialised Information and Computer Technology (ICT) knowledge that know how to keep people, systems and businesses secure.

With malignant attacks and cyber-scams growing in frequency and sophistication, the skillset of a cybersecurity professional is also evolving and changing with a rapid pace. This makes the process of educating and training cybersecurity professionals even harder; and looms over the targets of making the next decade digital and European. Education systems have been slow to respond to the realities of the labour market, and the shortage of cybersecurity experts both in Europe, and in the world, gets more and more pronounced with each next year. In Europe only, the shortage of cybersecurity professionals is close to 1 million people (around 883,000), while the number of cyber experts needed globally will soon reach 4 million. The gender gap in the cybersecurity field is yet another aspect that requires urgent attention: as the latest data suggests and as we will see below, women do not even make up a quarter of cybersecurity professionals in Europe; and they are outnumbered in terms of ICT and cybersecurity enrolment in higher education too.

Introduction

Cybersecurity is an ever-growing field: no longer a buzz word, but rather a necessity for people and businesses alike. More than 90% of households (Eurostat, 2023) in Europe access the Internet often for various reasons – from doing one’s online banking or other purchases, to using online government services or booking a holiday online. Since this involves sensitive information being shared, the safe and secure storage and handling of one’s data is a priority for all – and unless good practice protocols in cybersecurity are followed, companies, governments and people risk significant leaks of information of various nature and intents – from financial and reputation damage, to identity thefts and misuse of personal data. The digital transition means more data, more information, more connected devices: and key public, social and businesses processes today depend on it. This makes them likely targets of cyberattacks – which in recent years have risen in frequency and potential to inflict damage so much that the World Economic Forum called cybercrime a “substantial global risk” in its 2021 Global Risks Report. And this is not all. Today’s cyberattacks are more sophisticated and harder to detect, since they’ve had to evolve together with the digital transition. The accelerated adoption of technologies with a high potential for transformation and impact like Artificial Intelligence (AI) or the Internet of Things (IoT) across sectors and countries, cybersecurity professionals enable new processes to run in a smooth and secure way. In Europe, demand for cybersecurity skills rose by 22% on average in 2021 alone, with some EU Member States, like Germany, Poland or Romania, seeing a rise of over 30%.

The picture looks the same worldwide. Global cyber workforce numbers have reached an all-time high, with close to 5 million ICT experts specialised in this field currently in employment. Despite this progress, there is still a shortage of 3.4 million global cyber workers (ISC2, 2022). The demand for cybersecurity professionals shows a robust increase, especially during the period after the COVID-19 pandemic, as the OECD 2023 highlights: in one study, the number of online job announcements (OJAs) looking for cybersecurity professionals in the first half of 2022 was 5 times larger than at the start of 2012, and twice as large than at the end of 2019. Some estimates in Europe (EIT Digital 2021) suggest that that EU firms are searching for hundreds of thousands of cybersecurity experts, way more than the supply of the current talent database with cybersecurity skills. Research confirms this – more than half of EU companies reported difficulties in filling ICT vacancies according to the 2022 edition of DESI, the EU Digital Economy and Society Index – an annual index that tracks EU Member States’ digital progress across key areas, including skills.

Taking stock of the cyber gap: challenges ahead

A looming shortage of cybersecurity experts: in Europe and beyond

Europe is still falling short of cybersecurity-skilled professionals in more than one or two areas of expertise. The cyber gap is made up of several dimensions, each representing a specific challenge. Take a look at the infographic below to see some of the main aspects. 

In 2022, the shortage of cybersecurity professionals in the EU ranged between 260,000 and 500,000, while the EU’s cybersecurity workforce needs were estimated at 883,000 professionals. There is also a pronounced gender imbalance in the existing pool of cybersecurity professionals: in 2022, women made up just 20% of cybersecurity graduates, and less than 20% of all Information and Communication Technology (ICT) specialists were women. Equally, women are underrepresented in STEM (Science, Technology, Engineering and Mathematics) subjects within higher education, making up just over 30% of all graduates in the field (Education and Training Monitor 2022). European universities have made sound progress in getting students excited about ICT security: the number of programs and students studying cybersecurity in higher education are growing. According to ENISA (2021), this means we could expect to see cybersecurity graduates’ number to double within the next couple of years. 

Experts are hopeful about the impact of this trend on the workforce. One crucial area in which cybersecurity remains underdeveloped in Europe concerns the skills present in the workforce – something which over the years has become a ‘well-documented problem’ (ENISA 2021). On a global scale, the picture bears similarity. With more than 3.12 million jobs in cybersecurity going unfilled in 2021, the talent shortage worldwide is a cross-cutting issue that affects people, the labour force, education and digital experts alike. Looking at higher education, more effort is needed to attract people to ICT studies in general, and to cybersecurity in particular. Data from Eurostat shows that just 3.8% of graduates in the EU for 2018 received an ICT degree (Eurostat, 2020).

Still fewer women than men in cyber

Gender balance equally remains an issue, with just 20% of female students in Europe enrolled in cybersecurity programs in university (ENISA, 2021). Despite these averages, some EU Member States have made significant progress in bridging the digital gender gap. This is the case with Greece, where the share of women graduates in ICT almost doubled between 2019 to 2021, rising from 8.6% to 15.8% (World Economic Forum, 2022. Global Gender Gap Report). Getting more women interested into cybersecurity education and careers is key if we want to address this, and the lack of diversity in the sector is palpable. Data from LinkedIn shows that, amongst 12 EU countries, women make up just about 17% of the cyber workforce (this ratio is the highest in Poland – 13%, and the lowest in Italy, where women stand at 25%). Women represent less than one quarter (24%) of the global cybersecurity workforce (ISC2, 2022), and this ratio varies with age: they make up 30% of cyber professionals under 30, but just 14% of cyber employees above the age of 60. It will be hard to meet the EU’s target for 20 million ICT specialists by 2030 without improving inclusion. Based on current trends, less than 25% of ICT specialists will be female in 2030, rising from 19% in 2021. In many countries, the share is actually falling (Sekmokas & Vitaitė, 2021:8). And while some EU Member States are getting close to a more balanced ratio (women ICT specialists in Germany have topped 2 million, and those in France are above 1.5 million), based on current trends other countries are bound to lag behind when it comes to diversifying ICT. Studies point to worrying trends of an increasing gender ICT gap in countries like Bulgaria, Estonia, Ireland, Cyprus or Czechia (Sekmokas & Vitairte, 2021:15).

Mission impossible? Training cybersecurity experts

Training cybersecurity professionals takes time and effort too: both related to the higher education, but also to on-the job training, important for both up- and re-skilling.  This is also the case with on-the-job training: making sure employees are trained in the latest cybersecurity and privacy approaches, or hiring qualified cybersecurity personnel can take a company from 6 months up to a year (Symantec, 2019). And if we talk about personal and professional growth, the picture gets even more complex. It can take years to become a skilled cybersecurity professional and an expert in the field, with knowledge and experience of the latest trends and developments. In a recent survey targeting cybersecurity professionals worldwide (ESG/ISSA, 2020), the majority of respondents estimated that it takes between 3 to 5 years to develop real cybersecurity proficiency; others pointed to a broader learning curve of 5 years and more. 

Technology keeps changing, so it’s hard for industry personnel to keep up, and often it requires specialised knowledge that takes time to develop. According to the European Union Agency for Cybersecurity (ENISA, 2019), manufacturers and other organizations using Industry 4.0 and IoT solutions often don’t have time to train staff adequately before things change again, leaving themselves exposed to potential risks. What’s more, the training that is available is inadequate and/or expensive, making it even less feasible for SMEs.

Cybersecurity (together with IoT) is also an area in higher education, where universities have proven slow in adapting curricula or updating content so it reflects the latest technological developments, according to a 2021 report by EIT Digital that surveys the educational offer for cybersecurity in Europe. In another report by EIT Digital, which uses data from CyberHEAD, the biggest online database for higher education in ICT and cybersecurity, just 34% of bachelor’s and master’s level programs in the EU require an internship – an aspect that means many graduate students leave education with little to no practical experience, often needed to secure first-time employment in the sector.

Research shows that cybersecurity education in Europe is growing, but not evenly, and gaps affecting its quality remain (poor interaction with industry, lack of cybersecurity educators, lack of alignment with labour market realities, etc.) (Vishik & Heisel, 2015).  Assessing CyberHEAD data, only 34% of EU programmes envisage a compulsory internship for students. While internships can be challenging to setup, the lack of internship opportunities may negatively impact the skills of graduates, and also make it more difficult to attain a security job given a lack of working experience.

Tackling the cybersecurity skills gap

Building cybersecurity frameworks and assessing qualifications

Several frameworks, resources and tools have been set up and commonly accepted to strengthen EU cyber competitiveness and enable cybersecurity experts to gain the skills needed to excel in a rapidly changing digital world. One example is the European Cybersecurity Skills Framework (ECFS), a practical tool that helps to identify the tasks, competences, skills and knowledge associated with the day-to-day work of cybersecurity professionals in Europe, bridging the gap between professional cyber workplaces and learning environments. The main aim of the ECFS framework is to create a common understanding between all actors of the cybersecurity ecosystem (individuals, employers, and training providers) in the EU Member States. It also supports the design of cybersecurity related training programs, and facilitates recognition of cybersecurity skills. The ECFS breaks down cybersecurity roles into 12 profiles, each of which individually assessed across pre-defined parameters (skills, responsibilities, tasks, interdependencies, etc.). Other frameworks that categorise and map out ICT and digital skills in general can also be useful and include privacy and security competence areas. For example, the EU Digital Competence Framework (DigComp), now in its 2.2 edition, includes knowledge of cybersecurity-related aspects such as privacy or sharing of personal information or data. The European e-Competence Framework (e-CF) provides common language for competences, skills and proficiency levels across Europe. Competences in the e-CF are organised according to 5 ICT business areas and related to the European Qualifications Framework (EQF). With the European Cybersecurity Act, Europe can now also benefit from a cybersecurity certification framework for products and services and a strengthened mandate of ENISA, the European Union Agency for Cybersecurity, first established in 2004.

Reducing the cybersecurity skills gap in Europe: one step at a time

Main EU initiatives and actions to bridge the cyber skills gap

Together with the European Commission, ENISA coordinates the European Cyber Security Month (ECSM) Campaign: an awareness-raising campaign that promotes cybersecurity through education, sharing of good practices, and competitions. The European Cyber Security Challenge (ECSC) is another annual competition that brings together young cybersecurity talents from across Europe to test their data security skills.

Funding under the DIGITAL Europe Programme for the period 2023-2024 include a specific work programme focusing on cybersecurity, with a budget of €375 million for the period of 2023-2024, to enhance the EU’s collective resilience against cyber threats. The role of EU Digital Innovation Hubs in streamlining funding under DIGITAL towards the cybersecurity domain will foster further innovation for SMEs and the public sector. With 2023 hauled as the ‘Year of Skills’ by European Commission President Ursula Von der Leyen, the EU-wide campaign of the year is focused around addressing skills shortages, and boosting investment in training. These goals are also key priorities embedded in the Digital Education Action Plan (2021-2027), the vision for the future of education in Europe at the heart of which lie digital skills.

Supporting businesses and SMEs

A range of mechanisms exist to support businesses and especially small and medium-sized enterprises (SMEs) make the most of cybersecurity and ensure their staff can handle online risks in a competent and informed way. Numbering 25 million (or 90% of businesses in the EU), SMEs are the backbone of European economy. With fewer resources, staff and knowledge, SMEs are less likely to invest in keeping their businesses and operations secure, and also less likely to train their staff. Several factors influence the lack of cybersecurity uptake amongst SMEs, and negatively impacts employee training. Low cybersecurity awareness of the personnel and lack of ICT cybersecurity professionals to monitor and guide in difficult tasks is a big challenge for SMEs. So is lack of budget to recruit new, and train existing, employees, and weak management support. This means sensitive and critical business information in many SMEs is left unprotected. SMEs are also likely to experience problems outside of their control and are more volatile to shifts and shortages in the labour market (ENISA, 2019). Organisations also often think they safer than they actually are, with cyber threats being underestimated both at employee and management level. In 2023 ENISA launched a new tool to help Small and Medium Enterprises (SMEs) diagnose, compare and enhance their level of cybersecurity maturity and, in this way, define and tackle the cyber risks they face.

Bridging the gender gap in cyber

A range of cyber-related initiatives aim to bridge the gender divide in the cyber field too. Women4Cyber is an EU platform, which offers networking opportunities, mentorship programmes, and a variety of resources that aim to support women in launching (or keeping up with) a career in cybersecurity. The annual campaign International Girls in ICT Day raises awareness about careers in the ICT sector amongst women and girls, including in cybersecurity since its kick-off back in 2013. Tackling the digital gender gap is also of main objectives of ManagiDITH, the Master of Managing Digital Transformation in the Health Sector (ManagiDiTH). Launched in January 2023, ManagiDITH wants to reach at least 50% of female certificated students at the end of the two cycles of the master. The CyberWISER Light project (Cyber Mentoring and Training for Women in Cybersecurity) focuses on increasing female participation in the cybersecurity field through training, mentorship, and capacity-building activities.

Amongst actions that can be taken to tackle gender disparities present in the EU cybersecurity landscape, successful strategies include spotlighting women in key, important cyber positions and interviewing female graduates in cybersecurity and ICT for testimonials and inspirational quotes. Providing scholarship and mentorship opportunities to women and girls is another winning approach, with proven impact on boosting female enrolment in cybersecurity education and in the world of work. Several initiatives in Europe attempt to do exactly this. MolenGeek, an innovative tech incubator and upskilling actor, bases its activities in an area in Brussels marked by high unemployment and populated by people from low socio-economic backgrounds. The project has to break a sort of a double stigma: prejudices related to women working in ICT, and then prejudices against refugees and their integration. In partnership with Microsoft, MolenGeek provides training programs in cybersecurity together with recognised industry certifications, boosting employment for marginalised groups, and those left behind by the digital transformation. Similarly, the Kosciuszko Institute in Poland offers a cybersecurity training program for Polish women and Ukrainian refugee women. The ReDI School of Digital Integration equips refugee and underprivileged women with cybersecurity and ICT skills.

Looking ahead to a cyber-proof future

With further synergies between different initiatives on various levels, the cybersecurity skills is being bridged every day. At the same time, looming shortages point to an urgent need for more cybersecurity professionals with the skills needed to support the digital transformation of European economy and society. Increased efforts to encourage more people to go into the cyber field and ICT in general have proven successful, but more action on local, regional, national and EU level is still needed. Europe is missing around 1 million of cybersecurity experts – and the global shortage looks equally alarming. Gender disparity in the ICT field in general, and the cybersecurity field in particular, is also still very much an issue that has to be resolved if Europe is to achieve the targets of the European Digital Decade – getting to 20 million ICT experts, with gender conversion across tech fields. Businesses, and especially SMEs, need additional support and resources to train their staff, as they are less likely to embark on training programs – and a variety of initiatives on an EU level aim to provide this support to SMEs, whether it is in the form of OERs (Open Educational Resources), making software open source, or helping via mentorship and guidance.

Getting back on track with all there is to know about the latest state-of-play with digital skills, jobs, and technology has never been easier. The 2024 ‘State of the Digital Decade’ report came out in mid-July this year, with new, hot takes on what are the top skills to boost the continent’s digital transition even further – and may we insist, in a sustainable way. Just on time for us to bring a copy of it to read on the plane.

We hope you had a nice holiday this summer, but things haven’t really been that quiet on our end. While we did take a couple of days off, undoubtedly the scorching heat most EU Member States experienced this summer was hardly something we enjoyed. And since we almost couldn’t get to Greece (where, by the way, some of the most scorching heat was experienced) due to some tech difficulties along the way, we decided to take stock of the main lessons we learned this summer. Hint: they all have a digital flair. 

‘The butterfly effect’ of the largest software crash in our history

We may be going on about this interruption to our holiday plans, but let us explain why this is so important this time round. Some records were broken, but indeed they were the *not-so-positive ones*. 

An Olympic-worthy internet-breakdown

We only had to interrupt our summer break due to the largest (ever!) software crash in history. It may have been a good day for Apple users, but 8.5 million systems operating on Windows essentially crashed – with huge repercussions that ended up costing us (globally) around 10 billion. A faulty configuration update of CrowdStrike’s key software ended up being deployed, causing an issue with many organisation-owned computers and systems, with virtually all sectors affected.

In case you missed the whole saga, basically, this caused hospitals to halt non-essential surgeries and interventions due to inability to operate certain high-tech machines, manage appointments correctly, or connect to government software to process patients. It led to a ton of issues for banks and their clients, with many unable to withdraw money or perform digital transactions. Ordinary people from all over the world could neither access their bank accounts, nor reach essential public digital services, wreaking a one-day havoc on individual plans for millions.

In case you were affected, accept our sincerest condolences. The silver lining? If anything, this whole chaos made us painfully aware of the vulnerabilities of our own digital infrastructure and security systems.

Cybersecurity A to Z: let’s talk figures

We rarely think about how much from our own pockets ends up lost to cybercrime, but rest assured the amount is far from small. In fact, projections point to a worrying trend, in which the global cost of cybercrime will keep increasing to new highs between 2024 and 2029 (going up in price by more than 6 trillion euros).

By 2029, this figure will most probably stand at over 15 trillion. What is more, for the period from 2015 to 2020, global cost almost doubled to 5.5 trillion (see this infographic of the European Council on the EU cybersecurity developments for that period). In Germany alone, cybercrime in 2023 has costed the economy close to €150 billion – and this number is expected to go up further. Cyber crime is changing too – see the image ENISA, the EU Cybersecurity Agency made, which forecasts the top cyber threats in 2030 and see for your own how experts think online crime is likely to evolve.

With more than 10 terabytes of data stolen monthly, ransomware is currently one of the biggest cyber threats in the EU (and worldwide), with phishing identified as a key foundational step for these attacks, essentially making them possible. Distributed Denial of Service (DDoS) attacks also rank among the highest threats. Similar trends can be observed worldwide.

“This is Ground Control to Major Tom”: a cyber-powered future for us all

Cybersecurity is a core factor for a successful digital society and economy. Fast-paced developments in key emerging technologies such as AI and digitalisation progress overall, require even more, secure infrastructure and cyber know-how – regardless of the sector we end up finding ourselves in. And legislation has tried to reflect this, too. The EU Cybersecurity Act puts forward a European cyber security certification framework for ICT products, services and processes. It also reinforces the role of ENISA, the European Agency for Cybersecurity, too. The Cyber Resilience Act (CRA), which came into force at the start of 2024, aims to safeguard consumers and businesses buying or using products or software with a digital component. And the EU Cyber Solidarity Act effectively adds another layer of resilience to our digital capabilities and infrastructures.

Policymaking goes hand in hand with financing when it comes to allocating funding to boost the digital and cyber capabilities of the continent. Just in the last 2 years, the Commission opened calls worth over €210 million under the Digital Europe Programme (DEP) for proposals to strengthen cybersecurity and digital capacities across the EU.

For about a year now, the Digital Skills & Jobs Platform is the proud home of the Cyber Skills Academy – a European policy initiative with the goal of building bridges between existing cybersecurity skills initiatives, launched as one of the main activities under the 2023 European Year of Skills. Ultimately, its long-term aim is to close the cyber security talent gap, strengthen the EU cyber workforce and boost EU competitiveness, growth and resilience.

Mind the gap! How large is Europe’s cyber lack?

Why is this necessary? Well, there is an acute shortage of digital experts in Europe, and this includes the more specialised segments of ICT, like AI, cybersecurity, and others. The EU has more than 60 000 cybersecurity companies and more than 660 centres of cybersecurity expertise, but organisations continue to experience difficulties in hiring cyber talent.

Close to half of companies surveyed in the latest Eurobarometer on Cyber Skills (May 2024), 45% of companies surveyed cited difficulty in finding qualified candidates as one of the main challenges in recruiting staff with the right cybersecurity skills. See some other reasons that made this list below.

To tackle head on this shortage, in 2023 the European Commission adopted a ‘Communication on a Cybersecurity Skills Academy’, essentially giving birth to the Cyber Skills Academy. Since March 2024, the Digital Skills and Jobs Platform hosts the Women4Cyber Network, a collaborative effort between the European Commission and the Women4Cyber Foundation, with the goal of achieving gender convergence amongst cybersecurity positions by 2030. 

Together with the CyberSkills Academy, make sure you check out these specific pledges, dedicated to making the online world a safer place (and turning citizens into confident users).

Setting the record straight: key cybersecurity activities this autumn

A range of initiatives, events and activities are scheduled for this autumn as per usual fashion (if you didn’t know that October is the month the EU dedicates to cybersecurity, now you do). The European Cybersecurity Challenge, part of the EU Cybersecurity Month, takes place from 7 – 11 October 2024 in Turin, Italy.

It is jointly organised by the Italian National Cybersecurity Agency together with the Cybersecurity National Lab, with the support of ENISA – the EU Cybersecurity Agency, and the European Commission. As every year, in this edition too, teams of youngsters and promising cybersecurity talents between the ages of 14 and 24 from all over Europe will compete for the championship in a range of cyber-themed competitions and games.

The EU Cybersecurity Month is one of the largest campaigns of the European Union, bringing together millions each year in various events, throughout the month of October. Previous campaigns have focused on numerous awareness-raising cyber topics– such as the ‘’Think before U click” campaign in 2021 – against phishing, or the 2022 campaign that ran under the motto of “Be Smarter than a Hacker”. Find out more about the EU Cybersecurity Challenge and how to take part in this year’s edition here.

Not specifically focused on cybersecurity, but incorporating a range of cybersecurity-themed activities is EU Code Week, which this year runs from 14-27 October.

What started as a grassroots-based initiative quickly grew into one of the longest standing annual campaigns of the Commission – bringing a record number of participants every year in activities dedicated to fostering the development of coding and computational thinking for all.

Read more about the story of EU Code Week – we’ve highlighted its main achievements here, in our good practice section on the Digital Skills & Jobs Platform.

Further routes towards skills for cyber

If the above sparked your interest, we have good news – this was really just the tip of the iceberg. On the Digital Skills & Jobs Platform you will find a range of training opportunities on all levels, from beginner to advanced, as well as 2 learning paths (‘Cybersecurity and me: love or hate?‘, meant for those seeking introductory knowledge, and ‘Know yourself, know your enemy, and you will win the battle!’ that caters to more advanced learners).

If reading is your thing, say no more. This digital brief on cybersecurity dives deeper into the essential concepts, frameworks, and principles for a secure online environment. Additional resources and trainings remain available via the CyberSkills Academy.