人工智能赋能网络安全能力建设中的人才制约及其应对

Talent Constraints and Countermeasures in AI-Empowered Cybersecurity Capacity Building

摘要: 人工智能特别是生成式大模型正在重塑网络攻击、防御与安全治理方式，网络安全人才制约也由单纯的数量不足转变为人才总量短缺与能力结构失衡并存。针对复合型实战人才供给不足、人工智能–网络攻防–行业业务能力割裂及培养体系响应迟滞等问题，本文以能力本位教育、项目式学习和情境学习为教学理论基础，并引入组织知识创造理论，构建“能力目标–真实项目–情境参与–知识协同”的分析框架。研究提出，人才培养应由知识叠加转向能力贯通，重点形成将人工智能输出转化为可信安全证据、将技术异常转化为业务风险判断、将攻防结果转化为治理决策的三种能力。基于职业本科的类型定位，进一步提出场景驱动的课程模块开发闭环、项目制虚拟教研室、安全责任分级管理及产教融合实战环境，并与普通应用型本科进行类型化比较。研究认为，上述机制有助于把岗位能力要求转化为可教、可练、可评的项目任务，但其实施仍受真实场景供给、跨专业协作成本、企业参与稳定性、数据合规和实证证据不足等约束，需要通过分级脱敏、制度化协作、周期评价和持续验证加以控制。

Abstract: Artificial intelligence (AI), particularly generative large language models, is reshaping cyberattack, defense, and security governance. The talent constraint in cybersecurity has consequently evolved from a simple quantitative shortage into a compound problem involving both insufficient supply and structural capability imbalance. To address the shortage of interdisciplinary practice-oriented professionals, the fragmentation among AI, cyber offense and defense, and industry-domain capabilities, as well as the slow response of education systems to technological and industrial change, this paper develops an analytical framework of “competency objectives-authentic projects-situated participation-knowledge collaboration” based on competency-based education, project-based learning, situated learning, and organizational knowledge-creation theory. It argues that talent development should shift from knowledge accumulation to capability integration, with emphasis on three transformation capabilities: converting AI outputs into trustworthy security evidence, translating technical anomalies into business-risk judgments, and transforming offensive and defensive findings into governance decisions. Drawing on the distinctive positioning of vocational undergraduate education, the paper further proposes a scenario-driven curriculum-module development cycle, a project-based virtual teaching and research office, graded safety-responsibility management, and an industry-education integrated practice environment, and compares these mechanisms with those of application-oriented undergraduate education. These mechanisms may help convert occupational competency requirements into teachable, trainable, and assessable project tasks; however, their implementation remains constrained by access to authentic scenarios, interdisciplinary collaboration costs, continuity of enterprise participation, data compliance, and limited empirical evidence. These constraints should be addressed through graded de-identification, institutionalized collaboration, periodic evaluation, and continuous validation.