CyberPatriot

Goals and objectives

CyberPatriot is open to high school and middle school students, offering educational opportunities and a pathway to cybersecurity careers. The program increases the awareness of cybersecurity by delivering a basic education in a competitive format that enhances leadership, communication, and cooperation skills among its competitors.

Team Composition

Teams have the following members:

• Coach: An approved adult leader—such as a teacher, parent, or designated supervisor—who completes the team's registration and provides oversight throughout the competition period.

• Verification Official: An administrator from the participating organization who is responsible for confirming the Coach’s eligibility and approval in accordance with program requirements.

• Competitors: A group of two to six students, consisting of up to five primary competitors and one alternate, who participate in the competition and complete all assigned tasks.

• Technical Mentor (optional): A qualified adult volunteer who possesses technical expertise and supports the team’s preparation by offering guidance in cybersecurity concepts and competition-related skills.

• Team Assistant (optional): An individual who aids the Coach with administrative duties related to team management and logistics throughout the competition season.

Each team is required to have a registered Coach, a Verification Official, and registered Competitors. Coach registration begins in the late spring to allow preparation over the summer. The qualification rounds of the competition are completed online at the teams' home locations from September to early January.

Competition guidelines

The competition is a tournament structure with three divisions:

1. Open High School Division: Open to all public, private, parochial, magnet, charter, home schools, and special groups such as CampFire, Boys & Girls Club, Boy Scouts, Church Youth Groups, Girl Scouts, etc.
2. All-Service Division: Open to all JROTC Services, Civil Air Patrol squadrons, US Naval Sea Cadet Corps units. The registration fee is waived for teams competing in the All-Service Division
3. Middle School Division: Open to all middle schools and junior high schools which follow the same common organizations as mentioned above in the Open High School Division.

The early rounds of the competition are done online during weekends via the Internet from teams' schools or other sponsoring organizations' facilities. Before the round, teams download virtual images of operating systems with known flaws or cybersecurity vulnerabilities. Each team is tasked to find the flaws while keeping specified computer functions, such as email, working. Team progress is recorded by a central CyberPatriot scoring system, known as the CyberPatriot Competition System (CCS).

The scores from Qualification Rounds 1 and 2 are totaled to determine which tier a team advances to.

• Platinum: Top 30% of teams. Rounds include State, Semifinals, and National Finals.
• Gold: Middle 40% of teams. Rounds include State and Semifinals.
• Silver: Bottom 30% of teams. Rounds include State and Semifinals.

In the Semifinals round, only the top 25% of teams and state wild cards will be eligible to compete. Only teams in the Platinum tier are eligible for the National Finals.

In CyberPatriot XIII, only three rounds were held, with Round 1 delayed due to COVID-19 to allow coaches additional time for recruitment, according to announcements from the Air Force Association. Round 3 determined the National Finalists teams that year.

The Challenges that teams may face include:

1. Network Security Challenge, in which teams fix vulnerabilities in "images" of Operating Systems that have been purposely tampered with, During Nationals, competitors also must protect the virtual machines (VMs) from "Red Team" which is a group of "hackers" that will exploit vulnerabilities on the competitor's machines. The Operating Systems in CP-XVII included: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Ubuntu 22, and Mint 21.
2. Cisco Networking Challenge, in which teams show their knowledge about Cisco Packet Tracer, and take a Cisco quiz.
3. CyberPatriot Web-Based Challenge, in which competitors compete in a CTF-like challenge. This challenge is currently only in the Semifinals Round.
4. Boeing Cyber-Physical System Challenge, in which teams are presented with an operational system that tracks and maintains flight information. This challenge is currently only in the Semifinals Round.

Additional competition rules are outlined below:

• The Qualification Competition begins as soon as this image is opened and ends 4 consecutive hours later, after which the score will be logged. Attempting to continue after the time limit will incur penalties. It is the coach's responsibility to ensure their team does not exceed the limit.
• Only one instance of the image can be opened at any given time. Opening multiple instances of a virtual image will result in a penalty.
• No person may compete on a team with which they are not registered, and may only be registered with one team per competition.
• During the competition, no outside assistance may be given to or received from anyone.
• No competitor may offer assistance to another after their round ends and the other begins.
• No outside communication is allowed during the competition. This includes but is not limited to verbal, electronic, written or coded.
• No offensive activity of any kind is permitted, including but not limited to hacking through programs or manual code injection, interfering with another team through social engineering, deception, and/or attaining the opposing machine.

National Finals Competition

The highest-scoring Semifinalist teams from each division, about 28 in total, are invited to participate in the in-person National Finals Competition. For example, typically the top 12 open division teams and top 3 middle school divisions qualify until a 2 team per organization limit rule was added in the 2020-2021 season. This is held annually in the spring, with all travel and lodging expenses covered by the program. For CyberPatriot IV-VII, National Finals Competitions were held at the Gaylord National Resort & Convention Center in National Harbor, Maryland in March. From the CyberPatriot VIII season through the CyberPatriot XI season, the National Finals Competitions moved to the Hyatt Regency Baltimore Inner Harbor in Baltimore, Maryland, and were held in April of each year. Beginning in the CyberPatriot XII season to CyberPatriot XVII, the National Finals Competition was held at the Bethesda North Marriott Hotel & Conference Center in Bethesda, Maryland outside of Washington, D.C., in March. However, the CyberPatriot XII In-Person National Finals Competition, the first year planned at the Bethesda North Marriott, was canceled due to the COVID-19 outbreak, and a virtual, in-home competition was held online in May, about two months after the originally scheduled in-person competition event. Currently, the competition is held in the Washington, D.C. Area. The CP-XII Virtual National Finals was held on May 2, 2020, and marked the first-ever online virtual CyberPatriot National Finals Competition. Due to the widespread outbreak of COVID-19, the CyberPatriot XIII season had modifications to accommodate the delay in team administration as well as provisions for additional procedures for competing at home. Due to continued COVID-19 restrictions in the United States, provisions were made to allow remote participation in the competition, and the National Finals that season, in 2021, was also held virtually, in which competitions competed fully remotely online.

Winning teams in the Open and All-Service Divisions receive educational grants, which can be applied to an institution of their choosing. First place teams earn $2,000 per competitor, second place teams earn $1,500 per competitor, and third place earns $1,000 per competitor. The scholarship money is provided by the Northrop Grumman Foundation. In CyberPatriot VII, for first, second, and third place, an additional $2,000, $1,500, and $1,000 were awarded to the teams, respectively, by the National Security Agency.

List of CyberPatriot National Champions