Abstract:

The rapid digitalization of public services, education, healthcare, banking, industry, and tourism is improving efficiency and service quality, but it is also expanding the attack surface for cybercrime. For SMEs, now highly dependent on cloud services and data-driven operations, cybersecurity has become a business-continuity requirement: breaches can expose sensitive data, disrupt operations, damage reputation, and trigger compliance costs. Yet SMEs often lack the budget and specialised staff needed for proactive protection. As the European Union strengthens cyber resilience through policies, funding instruments, and preparedness initiatives, it is essential that candidate and neighbouring regions, particularly the Western Balkans, develop comparable skills, practices, and learning pathways.

This paper presents CyberFort, an Erasmus+ Capacity Building in Vocational Education and Training (CBVET) project that strengthens cybersecurity competence in Albania and Bosnia & Herzegovina, with relevance to the wider Western Balkans. CyberFort responds to persistent regional gaps, including uneven cybersecurity maturity across institutions and enterprises, limited strategic planning, weak awareness and cyber culture, skills shortages, and challenges in implementing standards and protective technologies.

CyberFort delivers an end-to-end capacity-building model that links labor-market needs to training design, delivery, and recognition. It maps national contexts and training needs in VET and SME settings, drawing on work-based learning (WBL) and competence-based tools to define required knowledge and skills aligned with qualification frameworks, producing a competency map for cybersecurity roles relevant to SME operations. Cyberfort develops a transnational, learning-outcomes-based curriculum, alongside adaptable methodologies and resources, for VET providers and in-company trainers.

The Cyberfort learning intervention is currently heavily under development. For access and sustainability, CyberFort implements an e-learning platform that hosts all resources and supports an online community of practice. The platform is populated with MOOC-style training content and resources focused on practical SME cybersecurity scenarios. Specifically, Cyberfort develops comprehensive course materials, integrating expert knowledge from cybersecurity experts across participating organizations in Albania, Bosnia & Herzegovina, Turkey, Greece, and Portugal. Content includes incident response, risk analysis, data protection, secure software development, data protection, governance, compliance, and cloud security. In addition, the project designs a cross-border recognition framework based on micro-credentials. Project results will be piloted in VET and SME contexts, supported by a structured testing methodology and targeted workshops with VET stakeholders and SMEs to refine relevance and uptake. Capacity building will extend in the future to educators through study visits and peer learning, strengthening the professional development of VET teachers and in-company trainers.

By integrating competency mapping, practice-oriented curriculum design, digital delivery, organizational self-assessment, trainer development, and micro-credential recognition, CyberFort provides a scalable model for strengthening cybersecurity skills in VET-SME ecosystems, advancing Western Balkan preparedness for an increasingly risk-intensive digital economy.

Keywords:

Cybersecurity, education, capacity building, VET, Western Balkans.