The Big List of Cyber Security Competitions and Challenges

Cyber security competitions are a way for those interested in cyber security to practice their skills in realistic situations. In these competitions, participants race against the clock to fight threats, solve specific challenges, or come up with innovative cyber security strategies. The National Initiative for Cybersecurity Education promotes cyber security contests to students as young as primary school age, where participants must face simulated cyber attacks and thwart them using cyber defense tools.

During the competitions, participants may also practice working together as a cyber security team and put ethics and policy procedures into action. There is a wide variety of cyber security competitions, including cyber security contests focused on areas like secure coding, forensics, cryptography, and malware detection. Some contests allow individuals to participate, and some enable remote participation.

The rising threat of cyber attacks

Cyber attacks are an ever-increasing threat in the world. In 2018, there was a 350% increase in ransomware attacks, a 250% increase in spoofing or business email compromise attacks and a 70% increase in spear-phishing attacks in companies, IndustryWeek reports. Additionally, the average cost of a cyber-data breach rose from $4.9 million in 2017 to $7.5 million in 2018.  

Participating in cyber security competitions is a great way to network and refine your skills that can lead to career advancement in cyber security. Competitions often include participation from leading cyber security experts and can serve as recruiting opportunities for talent.

Here’s what you should know about participating in cyber security competitions.

What are the rules of a cyber security competition?

In cyber security competitions, the rules vary. Generally, there will be a limit on the number of people allowed on each attacking or defending team, a time limit on defending or attacking, and a set of parameters of what methods each team can use.

Other rules may include age requirements, experience (some contests only allow non-cyber security professionals to enter, for example), and restrictions prohibiting multi-team collaboration.

What kind of cyber security concepts should I be familiar with to compete?

The cyber security concepts you should know will depend on the competition. As an example, participants in the Collegiate Cyber Defense Competition are recommended to know concepts including perimeter security, flashing/patching, networking, UNIX, Windows, user management, services and applications, software-based firewalls, authentication, and computer system functionality. Check the rules of each contest you’re considering for more information.

What kind of security and administration tools should I be familiar with to compete?

Again, this will depend on the competition. Using the Collegiate Cyber Defense Competition as an example, participants in cyber security contests may need to be familiar with the following types of tools:

• Assessment Tools: Backtrack, Codescout, Metasploit Framerwork, Microsoft Baseline Security Analyzer
• Forensics utilities: Coroners Toolkit
• DNS utilities: Digg, Whois
• Packet analysis: Ettercap, TCPDUMP, Wireshark
• Compression utilities: Gzip, 7-Zip, Tar, Zip
• Other tools: GCC, Microsoft Update, PGP.

Can I compete alone, or do I need to be on a team?

Some competitions allow for individual competitors, and others are team-based. Some team-based competitions also require teams to have a coach.

Are there any cyber security competitions for beginners?

There are plenty of security competitions for beginners. The National Cyber League is an example of a league that features easy challenges in addition to medium and hard challenges. Beginners can also practice their cyber security skills in wargames, which are ongoing cyber security competitions organized in levels that get progressively harder as you beat them. Bandit is a wargame example designed for beginners.

Do any cyber security competitions award cash prizes or scholarships?

There are a good number of cyber security competitions that award cash prizes and scholarships. Many of the ones we’ve included in the list below.

If you’re new to cyber security competitions, it can be intimidating to jump in without some background knowledge. These websites provide practice for beginners and contain up-to-date resources for all skill levels. Great resources and tools for cyber security competition preparation include:

• Trail of Bits CTF Guide: Trail of Bits is a guide for capture the flag (CTF) competitions that measure vulnerability discovery, toolkit creation, exploit creation, and more. It includes a CTF directory and tips on how to prepare.
• Practice CTF List/Permanent CTF List: This website lists live online CTF games, downloadable offline games, and virtual machines.
• Awesome CTF: Github’s Awesome CTF is a curated list of tutorials, softwares, resources, frameworks, and libraries for CTF players, intended to help everyone from beginners to veterans.
• Vulnhub: Vulnhub is a cyber security practice zone, including virtual machines and labs for vulnerability penetration testing. They include labs specifically built for beginners on their practice zone.
• CTF Resources: This website is a resource center for CTF subjects, including references, tools, information, and explanations for beginners to veterans.
• Reddit’s SecurityCTF: This Reddit forum hosts real-time questions and answers to questions regarding CTF competitions, strategies, and more.
• Forensics Wiki: This is an international resource for information covering computer forensics, including cyber security tools and techniques, organizations, and conferences.

There are dozens of cyber security contests held by organizations throughout the world. This list contains some of the most popular options for American participants, usually with at-least annual competitions.

Here’s a list of several cyber security competitions to check out if you want to put your skills into practice and meet other cyber security enthusiasts.

Global Cyberlympics

The Global Cyberlympics is a global hacking competition with challenge categories including digital forensics, network exploitation, web applications, and service exploitation.

Competition details

• Hosting organization: EC-Council Foundation
• Competition description: Teams from around the world compete in a global online 12-hour elimination round. The two teams with the highest score from each continent will be invited to compete in the in-person Global CyberLympics World Finals event.
• Entry requirements: Teams must be four to six players, 18 years of age or older.
• Sponsor: N/A
• Awards: First place: $1,500 USD, 1 EC-Council certification course and certification exam voucher per player; second place: $1,000 USD, 1 EC-Council certification course per player; third place: $750 USD, 1 EC-Council certification course per player.
• URL: https://www.cyberlympics.org/

National Collegiate Cyber Defense Competition

The National Collegiate Cyber Defense Competition is the finalist event for the Collegiate Cyber Defense Competition system. College students compete in regional competitions to become one of the 10 finalists to make it to the national event.

Competition Details

• Hosting organization: Raytheon and CIAS
• Competition description: Student teams assume administrative and protective duties for an existing “commercial” network. Each team begins with an identical set of software and hardware and is scored on their ability to detect and respond to outside threats, respond to business requests, maintain the availability of existing services and balance security needs against business needs.
• Entry requirements: Competitors must be full-time students of the institution they are representing. Each team must have a coach, who can be a faculty or staff member from the university represented and must submit a roster of up to 12 competitors to the competition director of the first CCDC event they participate in during a competitive season.
• Sponsors: 2019 sponsors include Air Force Reserve, Uber, InfoSec, Central Intelligence Agency and ReliaQuest.
• Award: The winning team receives the Alamo Cup trophy.
• URL: http://www.nationalccdc.org/

National Cyber League

The National Cyber League provides ongoing virtual training for anyone enrolled in a high school or a collegiate institution. It hosts various gaming seasons throughout the year, which include training and individual and team competitions. Participants are placed on a public leaderboard.

Competition Details

• Hosting organizations: The National Cyber League was founded by the Cyber Security Privacy and Research Institute, Center for Systems Security and Information Assurance, CyberWatch West, National CyberWatch Center, and Mid-Pacific Information and Communication Technologies Center.  
• Competition description: Each season, there are challenges in the virtual National Cyber League stadium and exercises in National Cyber League gyms that develop and test players.
• Entry requirements: Participants pay a fee of $35, which includes access to the Gym, the Preseason Game, the Individual Game, and the Team Game. No previous National Cyber League Play is required. All participants must be at least 14 years old.
• Sponsors: 2019 sponsors include Facebook.
• Awards: Public leaderboard recognition and National Cyber League provides scouting reports on players to prospective employers.
• URL: https://www.nationalcyberleague.org/

Cyber Quests

Cyber Quests are a series of cyber security online challenges that can cover topics including vulnerability analysis, forensic analysis, and packet capture analysis.

Competition Details

• Hosting organization: US Cyber Challenge, a program of Center for Internet Security
• Competition description: Each Cyber Quest features an artifact for analysis and a series of quiz questions. Before each Cyber Quest, participants will learn the range of topics covered and tools that will be needed to solve the quiz.
• Entry requirements: High school, college, and post-graduate students are eligible to participate.
• Sponsors: 2019 sponsors include Lockheed Martin, Amazon Web Services, Accenture, AFFIRM, Cyber Ninjas, Sherman Consulting, Microsoft, Common Knowledge Scholarship Foundation, Monster Government Solutions, Homeland Security, SANS Institute, Defense Point Security, NIC, Duo, (ISC)² and CenturyLink Government.
• Awards: Cyber Quest participants can compete to qualify to earn a spot at a summer USCC Summer Camp. There may be various awards available to American participants.
• URL: https://uscc.cyberquests.org/

US Cyber Challenge

The US Cyber Challenge is the host of Cyber Quests. Its mission is to reduce the shortage in the cyber security workforce, through the facilitation of Cyber Quests competitions and camps.

Organization Details

• Hosting organization: Center for Internet Security
• Organization description: The US Cyber Challenge is supported by the Department of Homeland Security Science and Technology Directorate. US Cyber Challenge summer camps are a week of specialized cyber security training including workshops, a job fair, and a CTF competition.
• Entry requirements: To be eligible for a US Cyber Challenge summer camp, prospective participants must compete in the qualifying Cyber Quests online competition.
• Sponsors: 2019 sponsors include Lockheed Martin, Amazon Web Services, Accenture, AFFIRM, Cyber Ninjas, Sherman Consulting, Microsoft, Common Knowledge Scholarship Foundation, Monster Government Solutions, Homeland Security, SANS Institute, Defense Point Security, NIC, Duo, (ISC)² and CenturyLink Government.
• Awards: US Cyber Challenge camps end with an awards ceremony attended by cyber security industry and government experts.
• URL: https://www.uscyberchallenge.org/

NetWars: DFIR Tournament

DFIR stands for Digital Forensics, Incident Response. There are in-person DFIR NetWars tournaments held throughout the year around the globe, as well as the online learning program DFIR NetWards Continuous.

Competition Details

• Hosting organization: SANS Institute
• Competition description: The DFIR NetWars tournament is an incident simulator with challenges covering topics like forensics, malware analysis, incident response, and threat hunting. In-person tournaments last two to three days.
• Entry requirements: Entry fee amounts vary depending on the event.
• Sponsors: N/A
• Award: Top-scoring participants in the NetWars Tournament receive the NetWars Challenge Coin, an indication of great cyber security skills and capabilities. Enterprises, government agencies and military organizations view NetWars Tournament leaderboards to identify cyber security talent.
• URL: https://www.sans.org/netwars/dfir-tournament

Panoply

Panoply is a network assessment and network defense competition combined into a single event. Panoply events may be played as individual or team competitions and are held throughout the year at locations around the world. Virtual access is often enabled.

Competition Details

• Hosting organizations: CIAS and National Collegiate Cyber Defense Competition
• Competition description: Panoply is a timed competition event. In the beginning, competitors are allowed to scan, assess and penetrate common resources. Throughout the event, an automated scoring engine scans and awards points for owning resources at random intervals. The team or individual with the most points at the end wins.
• Entry requirements: Entry requirements depend on where the Panoply event is taking place. Often, entry is free and open to all.
• Sponsor: Panoply events are sponsored by various cyber security events throughout the world.
• Awards: Awards depend on the event and have included cyber security event tickets and 1 TB SSD drives.
• URL: http://www.cyberpanoply.com/

CyberPatriot National Youth Cyber Defense Competition

National Youth Cyber Defense Competition is open to all schools and youth organizations. Teams of middle school and high school students must find and fix cybersecurity vulnerabilities in virtual operating systems.

Competition Details

• Hosting organizations: Air Force Association and CIAS
• Competition description: The 6-hour competition period includes a network security challenge that involves finding and fixing security vulnerabilities in Linux and Window operation systems, and a Cisco networking challenge, which consists of an online quiz and a virtual networking exercise based on training materials. Teams are scored on how secure they make the system they’re working on. Top teams advance through the online round of the competition. Finalists advance to the in-person National Finals Competition.
• Entry requirements: Teams must consist of two to six competitors enrolled in the participating school or organization, and each team must have an adult coach approved by a participating organization. Participants must be middle school or high school students, with varying entree fees.
• Sponsors: 2019 sponsors include Northrop Grunman Foundation, AT&T, Boeing, Cisco, Capital One, and Norton by Symantec.
• Awards: Awards include hard copy certificates and scholarship grants.
• URL: https://www.uscyberpatriot.org/competition/Competition-Overview/competition-overview

PACKETWARS

PACKETWARS is a real-time cyber operations simulation, designed to simulate real-world engagements and campaigns. PACKETWARS events happen at hacker events throughout the country.

Competition Details

• Hosting organization: N/A
• Competition description: PACKETWARS takes place in games known as “battles,” where teams and individuals race to achieve objectives. Battles have time limits and other defined constraints, but the constraints are not always known to players.
• Entry requirements: Entry requirements depend on where the PACKETWARS event is held.
• Sponsors: 2019 sponsors include ERNW.
• Awards: Awards depend on the event host.
• URL: http://packetwars.com/about-packetwars

International Collegiate Cyber Defense Invitational

Ten student teams from around the world participate in this annual red team/blue team cyber competition.

Competition Details

• Hosting organization: Highline College
• Competition description: Rules are similar to the National Collegiate Cyber Defense Competition. Student teams must protect a network and use the same set of hardware and software to respond to threats.
• Entry requirements: College student teams of six to eight full-time student players, accompanied by one faculty or staff member, can participate.
• Sponsors: 2019 sponsors include CyberWatch West.
• Awards: N/A
• URL: https://iccdi.org/

Digital Forensics Security Treasure Hunt

The Digital Forensics Security Treasure Hunt is a virtual setting designed for people to practice digital forensics skills and interests. Challenges test subjects related to network forensics, disk forensics, and memory forensics.

Competition Details

• Hosting organization: Challenges have been written by members of the SANS Digital Forensics Team, US Cyber Challenge and DC3 Digital Forensics Challenge.
• Competition description: Each competition is open book and open internet, with no time limit.
• Entry requirements: Everyone is welcome to participate in the free challenges.
• Sponsors: N/A
• Awards: N/A
• URL: http://digitalforensics.securitytreasurehunt.com/

iCTF Competition

The annual iCTF competition is an international CTF security exercise that integrates attack and defense in a live setting. Teams must find and fix vulnerabilities in their hosts without disrupting services.

Competition Details

• Hosting organization: UC Santa Barbara
• Competition description: The goal of each team is to maintain a set of services so that they are available and uncompromised throughout the content. Each team may attempt to compromise other teams’ services.
• Entry requirements: The iCTF framework software infrastructure is available from the Security Lab at UC Santa Barbara. Teams must consist of college students.
• Sponsors: Past sponsors have included Adobe and Amazon.
• Awards: Various cash prizes are awarded.
• URL: https://ictf.cs.ucsb.edu/

National Cyber Analyst Challenge & Conference

Temple University hosts the National Cyber Analyst Challenge and Conference, where college student teams with faculty advisors are given a cyber security challenge they must analyze and present a solution for.

Competition Details

• Hosting organization: Center for Cybersecurity and Institute for Business and Information Technology at Temple University
• Competition description: The competition is divided into three phases:

1. Case analysis, where the cyber security challenge is analyzed and assigned proposed solutions.
2. A workshop, where participants learn how to remedy and mitigate threats.
3. Finals, where students are given challenge materials and need to solve the challenge.

• Entry requirements: Student teams must have four to five individuals and a faculty advisor for each team. The challenge is limited to schools with formal cyber programs. Undergraduate and master’s students with any major are eligible to compete. Only one team per school may participate.
• Sponsors: N/A
• Awards: The winning team will receive $4,000 per student. The runner-up team will receive $1,000 per student.
• URL: https://cyberanalystchallenge.org/phases/

CIAS

CIAS stands for the Center for Infrastructure Assurance and Security. This organization hosts several cyber security competitions throughout the country each year.

Organization Details

• Hosting organization: The University of Texas at San Antonio
• Organization description: The CIAS has been developing and conducting cyber security competitions since 2005. It currently is involved in Panoply, Collegiate Cyber Defense Competition, and CyberPatriot.
• Entry requirements: Competition requirements vary depending on the competition.
• Sponsor: N/A
• Awards: Awards depend on the competition.
• URL: http://cias.utsa.edu/competitions.html

Technology Student Association Cybersecurity Competition

The Technology Student Association’s Cybersecurity Competition is a virtual CTF competition open to affiliated Technology Student Association high school chapters.

Competition Details

• Hosting organization: Technology Student Association
• Competition description: Using an open source CTF framework, chapter teams compete in a CTF challenge. Scores are tracked on an online scoreboard.
• Entry requirements: Chapters may register up to two teams of two to six individuals per chapter.
• Sponsors: N/A
• Awards: N/A
• URL: https://tsaweb.org/competitions-programs/tsa/cybersecurity-competition

CSAW Capture the Flag

This entry-level Capture the Flag competition is held at CSAW, the largest college student-run cyber security event in the world.

Competition Details

• Hosting organization: CSAW and NYU Center for Cybersecurity
• Competition description: Teams participate in real-world scenario-modeling challenges tackling various computer security problems.
• Entry requirements: Participants can compete individually or on a team and must successfully complete an online qualification round to be considered for the in-person finals. Teams playing during finals are limited to four members each.
• Sponsors: Past sponsors have included IBM, Thales, and Capsule8.
• Awards: Monetary prizes are awarded for first-place, second-place and third-place teams from Europe, India, Israel and US-Canada regions. Prize amounts vary. For US-Canada, the first-place team receives $1,000, the second-place team receives $750, and the third-place team receives $500.
• URL: https://csaw.engineering.nyu.edu/ctf

CyberForce Competition

The CyberForce Competition is a cyber defense competition focusing on energy cyber infrastructure. Scenarios have an energy focus, on subjects like power distributors and water and power delivery systems.

Competition Details

• Hosting organization: Department of Energy
• Competition description: There are five teams in the CyberForce Competition: the Blue Team, which ensures proper IT support is administered; the Red Team, which attacks the Blue Team’s infrastructure; the White Team, which consists of IT administrators and architects of the competition; the Green Team, which tests the usability and availability of the Blue Team’s systems; and the Phish Tank, which allows Blue Team members to pitch a defense strategy. Teams are scored on creativity and innovation.
• Entry requirements: Teams of four to six undergraduate, graduate and/or Ph.D. students may enter. Students must be 18 years old or older to enter. Teams must be from an accredited higher education institution and have a university representative or faculty advisor.
• Sponsors: N/A
• Awards: N/A
• URL: https://cyberforcecompetition.com/

*The competitions highlighted above were reviewed on June 11, 2019. Competition requirements and awards may be subject to change. Check the competition’s website for the most up-to-date info.

Many of the cyber security competitions mentioned here are for students, and participating in them can give students opportunities to network and potentially be scouted for a rewarding career. According to the Occupational Outlook Handbook, the job outlook for information security analysts is expected to grow 28% between 2016 and 2026, much faster than the national average for all positions.

If you are interested in protecting against data breaches, network hacks, and other cyber crimes, you might be able to benefit from a master’s degree in cyber security. A graduate degree can help you advance your career in cyber security, gain a leadership position and work for your dream company. The Bureau of Labor Statistics reports the highest 10% of workers in information security analysis earned more than $156,580 a year.

If you’re currently working, there are online programs that provide flexibility and allow you to study from anywhere, from any connected device. Learn more about an online cyber security master’s degree.