Operations and defence
Monitoring, incident handling, hardening systems, vulnerability management. Technical, often with on-call duty, close to the systems.
Study IT security alongside your job
You work in IT and want to move into security, or want the qualification for what you already do. The key point first: this subject has two very different routes, and the one you pick decides your working day.
Positioning
Two routes that must not be confused
The programme title says little. The module plan says everything.
Behind the label IT security sit two working worlds. One is technical: hardening networks and systems, hunting vulnerabilities, simulating attacks, analysing incidents, cryptography and secure software development. The other is organisational: building a management system for information security, assessing risks, writing policies, preparing audits and evidencing all of it to customers and regulators. Both are in demand, both are demanding, but the working day feels entirely different.
So before you enrol, read the module plan rather than the title. A programme with lab work, cryptography and secure development leads one way, one with standards, law, risk management and audit methodology leads the other. And the neighbouring subjects:
- Computer science is broader and treats security as one area among many. If you do not want to commit early, it keeps more doors open, more on it under computer science by distance learning.
- Business informatics translates between the business side and IT. Security appears there as a requirement, not as a craft.
- Data protection is a legal discipline and not the same thing as information security. The topics overlap, the training routes do not.
- Data science touches security at one point only, namely detecting attacks in large volumes of data. The rest is a different subject, see data science by distance learning.
What applies to both routes: this field runs on evidence. Alongside the degree, certificates, documented projects and, in many organisations, employer clearances all count. The degree is the foundation, not the only building block.
Admission
Possible without the Abitur, and from more occupations than you think
For the organisational route, audit experience counts almost as much as IT experience.
A completed vocational qualification plus a few years of work experience opens university access for a subject-related degree in Germany. Anyone who also holds an advanced vocational qualification usually gains general university access and with it a free choice of subject. The three routes are under studying without the Abitur.
Typical feeder occupations:
- IT specialists in systems integration, the most direct path into the technical route. Networks, systems and operations are already daily work.
- IT systems electronics and network engineering, strong on the infrastructure side, often with data centre experience.
- Advanced IT qualifications, since the German reform issued as specialist and as Bachelor Professional in IT. They frequently bring admission and credit at the same time.
- Commercial and administrative roles with an audit background, for example from internal audit, quality management or compliance. A very solid start for the organisational route.
If you have no programming experience, that is not a knock-out criterion, but it costs time in the first year. In that case plan a preparatory course and pick a programme whose emphasis matches where you are starting from.
Credit transfer
What your IT experience is worth
The strongest lever in this subject, and the one people use least.
Vocational IT training is a formal qualification with documented learning outcomes, and that is exactly what credit transfer builds on. Foundation modules in networks, operating systems, databases and programming are typically credited. Anyone holding an advanced vocational qualification usually gets a considerably larger block. For learning acquired outside higher education, an upper limit of 50 percent of a programme's ECTS usually applies.
What that means is clear from the arithmetic. A bachelor covers 180 ECTS. If 60 are credited, 120 remain. At 10 ECTS per semester, which is realistic alongside a full-time job with on-call duty, that is six years instead of nine. You have changed nothing about your daily routine and saved three years.
Certificates from practice are a special case. Some universities credit recognised security certificates against individual modules, others not at all, and nobody can promise it in advance. Submit them anyway, together with the number of hours and the examination record. How the process works is set out under crediting ECTS and credit for work experience. Which universities in the German-speaking region qualify is best compared on Hochschulnavigator.
Workload
Time and cost, realistically
Lab exercises need connected blocks, and that shapes the semester load.
| ECTS per semester | Hours per week | In practice | Bachelor takes |
|---|---|---|---|
| 5 | around 7 to 8 | enough for theory, not for lab assignments | 18 years, single modules only |
| 10 | around 15 | two evenings plus half a weekend day | 9 years, 6 with credit |
| 15 | around 22 | hard to plan with an on-call rota | 6 years, 4 with credit |
| 20 | around 30 | effectively a second part-time job | 4.5 years |
Calculated with 30 hours per ECTS and around 20 active weeks per semester. How to work out your own figure is under ECTS per semester.
On cost, part-time bachelor programmes usually sit at a few hundred euros a month. What counts is the total at a realistic pace, and that falls above all through credit transfer, see what distance learning costs.
Employers contribute more often than average in this field, because security roles are hard to fill and many organisations would rather grow their own. Watch out for repayment clauses, they typically tie you in for several years, see getting your employer to pay.
Afterwards
Where the degree leads
Three directions that differ clearly in daily work and in what they demand.
Management systems and audit
Building and maintaining an information security management system, risk analyses, audit preparation, evidence for customers and regulators.
Architecture and consulting
Carrying security requirements into projects, reviewing designs, assessing vendors. A lot of coordination, predictable hours, often the route into a staff function.
An honest word on salary: the degree alone does not change it, the changed role does. Anyone doing the same work after the degree usually earns the same. The step up comes with the move into a security role with its own responsibility, and in many organisations the degree is the formal precondition for that. More on this under salary after your degree.
And the limit of the subject: a degree on its own does not lead into offensive security. Attack simulations call for demonstrable practice, relevant certificates and written authorisation, because testing systems you do not own without permission is a criminal offence. In public authorities, in defence and in critical infrastructure, separate clearances apply that run independently of the degree. Which of these apply in your case is quickest to settle in an initial consultation.
Common questions
IT security by distance learning
The questions that come up in almost every initial consultation.
Can I study IT security without the Abitur?
As a rule yes. Completed IT training plus several years of work experience opens access to a subject-related degree. An advanced vocational qualification often adds general university access on top. For the organisational route, commercial or administrative training with an audit or review background is a solid way in as well.
Technical or organisational, which one suits me?
This choice decides your working day, not your level. The technical route works on systems, networks and attack simulations and calls for an appetite for tools and lab work. The organisational route works on policies, risk analyses and audits and calls for stamina in documentation and coordination. Both are in demand, but the two jobs feel entirely different.
How much of my IT experience gets credited?
That depends on the university and the differences are substantial. Foundation modules in networks, operating systems and programming are usually credited, further points come from advanced vocational qualifications and relevant years in the job. For learning acquired outside higher education, an upper limit of 50 percent of a programme's ECTS usually applies.
Does the degree replace my certificates?
No, the two run side by side. Certificates evidence current tool and procedural knowledge and have to be renewed regularly, the degree provides the foundations and the academic title. Many job adverts ask for both, and candidates who bring only one often drop out at the screening stage.
What is the difference to computer science?
Computer science is the broader subject and treats security as one area among many. A degree in IT security reverses the emphasis: cryptography, network security, secure development, law and management systems sit at the centre. If you want to stay flexible in your career, computer science keeps more doors open.
Next step
What is actually possible in your case
Route, admission, credit transfer and a fitting programme, settled in one conversation.
Levels in this subject
Which level fits your goal?
The same subject, two different answers. Each level has its own admission routes and leads somewhere else.
Bachelor part-time
The technical or the organisational route
Master part-time
Which bachelor is enough, entry from another field
Information Notice
The information on this page is general in nature and based on my advisory practice (last updated 31.07.2026). It does not replace an official credit transfer or recognition decision by the respective university and is not legal advice. Specific decisions are made by universities, the ZAB (Germany), the BMBWF (Austria), or the SBFI (Switzerland). I clarify binding next steps with you in the initial consultation.