Students from across the globe are gearing up for the 11th annual picoCTF capture-the-flag competition

According to a recent report by MIT professor Stuart Madnick, more than 360 million people were impacted by ransomware attacks from January to August of 2023, representing a stark increase in reported cyberattacks from 2022.

And with emerging technologies such as generative AI making ransomware attacks more efficient, and cybercriminals increasingly accessing third-party vendors and software to gain access to valuable personal user data, the need for innovative cybersecurity solutions is greater than ever.

Unfortunately, that need is not currently being fulfilled. In the U.S. alone, there were more than 750,000 unfilled cybersecurity jobs in 2023. And as cyber risks increase in volume and complexity, so does the talent gap of knowledgeable and experienced cybersecurity professionals who are ready to take on these challenges.

For more than a decade, CyLab’s picoCTF has been working to help close that gap by introducing cybersecurity to the future workforce through its annual online hacking competition. Geared toward college, high school, and middle school students, the competition offers a gamified way to practice and show off cyber skills.

picoCTF’s 11th annual hacking competition will take place from March 12 through March 26. Students interested in participating can register now by signing up for a free account at picoctf.org.

“picoCTF's annual competition serves as a vibrant arena where learners can apply theoretical knowledge and showcase their advancing skills,” said Megan Kearns, picoCTF program director. “It's a space that challenges participants to stretch their limits, encouraging not just learning but also the practical application of their cybersecurity insights. This competition highlights the evolving talent in the field, underscoring the importance of hands-on experience in the journey of skill development and innovation in cybersecurity.”

Since its launch in 2013, picoCTF has grown exponentially, becoming the world’s largest student-focused hacking competition, with more than 18,000 competitors in 2023.

And as more students participated in the competition each year, organizers realized the annual event alone wasn’t enough to achieve the mission of closing the crucial talent gap in cybersecurity professionals. So in 2020, picoCTF expanded, implementing a year-round learning platform where anyone, not just students, can learn and develop cybersecurity skills for free.

“Cybersecurity skills gained through platforms like picoCTF could expand opportunities to youth from across the globe and help increase the pipeline in the field to address the global shortage in cybersecurity talent,” said Hanan Hibshi, an assistant teaching professor at CMU’s Information Networking Institute (INI) and research advisor for picoCTF. “Learning cybersecurity requires lots of practice, or otherwise it would be reciting theory without knowing how to apply it in practical applications. Our picoCTF team worked hard on making the platform available year-round for students around the world at any location, regardless of economic status, to be able to use the platform.”

Today picoCTF offers learning guides and produces a monthly YouTube lecture series to help introduce cybersecurity principles, such as cryptography, web exploitation, forensics, binary exploitation, and reversing. The picoGym allows users to practice what they’ve learned, providing access to newly released challenges, as well as challenges from past picoCTF competitions.

With more than 550,000 active users worldwide, the free platform is a gateway into the world of cybersecurity, enabling anyone with access to a computer and internet to start building their skills.

“We try to keep the barrier to entry to a minimum, where students can utilize picoCTF using basic machines that do not require state-of-the-art specifications,” said Habib. “Teachers with minimal cybersecurity resources in their local communities can use the picoCTF platform year-round as exercise or activities in classrooms. Students with no access to cybersecurity education or CS education in their communities can also benefit from pico.”

In addition, picoCTF offers programs and resources for teachers looking to incorporate cybersecurity education into their curriculum. CMU students serve as picoCTF ambassadors in Pittsburgh and surrounding areas, visiting classrooms to help onboard students to the picoCTF platform and review basic security engineering concepts, methods, and terminology.

“The importance of providing continuing education opportunities to cybersecurity educators cannot be overstated,” said Kearns. “By equipping our educators with the latest knowledge and tools, we not only enhance their teaching capabilities but also ensure that the next generation of cybersecurity professionals is prepared to face the challenges of tomorrow. It's about creating a sustainable ecosystem of learning and growth that benefits everyone in the cybersecurity field.” 

Furthering its community outreach effort, picoCTF and the National Security Agency (NSA) are teaming up to offer the Second Annual picoCTF for GenCyber Teachers program. The camp, designed for 10th- through 12th-grade high school teachers and district technology officers, will launch this summer, offering tips and resources for incorporating online capture-the-flag problems and competitions into the classroom, aiming to foster interest in cybersecurity careers. 

“We hope to attract more students to pathways for cybersecurity and privacy careers through their early interest in the field when introduced to picoCTF,” said Hibshi. “Students who complete picoCTF challenges are already gaining skills in cybersecurity and privacy that are considered skills of graduate students in the field. Combining this acquired practical knowledge with foundations they learn in their four- or two-year education could help open doors to successful careers in their future, and at the same time, help address the global shortage in cybersecurity careers.

“Even if a student chooses a career outside of cybersecurity, we are hoping that picoCTF is helping us to move towards a more cyber-aware population, where people in any profession have an understanding of cyberthreats so they practice more caution when dealing with systems and data.”