CyberPatriot
CyberPatriot National Youth Cyber Defense Competition
Teams defend deliberately broken computer systems against a clock, from middle school upward.
Run by Air and Space Forces Association
Key facts
- Eligible grades
-
High school and middle school, plus accredited homeschooling programmes. Three independent divisions: Open Division for high school students fielded by a public, parochial, home, private, magnet or charter school, scouting unit, state-chartered virtual school, Boys and Girls Club or YMCA/YWCA; All Service Division for high schoolers fielded by Army, Marine Corps, Navy or Air Force JROTC, US Naval Sea Cadet Corps or Civil Air Patrol, with Space Force JROTC competing under AFJROTC; and Middle School Division. not yet checked against the official source
You cannot pick your division freely: it follows the organisation that fields your team. Teams remain in their assigned division once they have competed in a qualification round, except to correct an administrative error. Source note: the only reference found for this was a third-party listing or encyclopedia, not the organiser. Eligibility must come from the organiser, so this is marked unconfirmed until a first-party page confirms it.Source, checked 2026-09-02
- Official divisions
-
A Middle School Division plus Open and All Service divisions for high school. Your division follows the organisation that fields your team, not your choice.
Based on the organiser's own divisions.
- Eligible ages
-
Not confirmed. This organiser may set eligibility by grade rather than age. We do not convert one into the other.AFA sets divisions by school level and fielding organisation, not age.
- Individual or team
- Team · Teams of 2 to 6 students plus an approved adult coach, with optional team assistants and technical mentors. There is no limit to the number of teams an organisation may host within a division.
- Where it runs
- Online · United States, Canada, International divisions
- Entry cost
- A per-team registration fee, with fee waivers availableNot published on the pages checked, and it varies by division and organisation. Civil Air Patrol states there is NO charge for any CAP squadron team, and at least one JROTC-hosted programme provides all materials, training and equipment at no cost to participants through sponsor support. Open Division teams should ask their organisation, since AFA has historically charged Open Division registration while waiving it for others.
- Registration deadline
- Set locally, not published as a single national date CP-19 dates were not confirmed on the pages checked. For reference, CP-18 registration ran 1 April to 1 October 2025. Civil Air Patrol describes the annual pattern as registration opening the first part of April, the practice competition beginning in September, and team registration closing the first week of October, with individual team members addable until late October. That late-October window is useful: you can register the team before you have finalised who is on it.
- Competition dates
- Qualification rounds run from autumn through winter, with national finals in the spring.
- Difficulty
- CompetitiveSerious preparation over a season. Advancing past the first round separates prepared students from unprepared ones.
- Prizes
- Teams advancing to the National Finals receive all-expenses-paid travel to Bethesda, Maryland, plus certificates and sponsor gifts. Scholarships are awarded at the National Finals, including through the Cisco NetAcad Challenge.National finalists receive scholarships and an all-expenses trip to the finals event. Amounts vary by year; confirm on the official site.
What CyberPatriot is
CyberPatriot is a defensive cybersecurity competition. Teams are given virtual machines riddled with vulnerabilities and misconfigurations and score points by finding and fixing them within a fixed window. It is the opposite of a capture-the-flag: nothing is attacked, everything is hardened. The programme runs through school and community clubs and includes an Elementary School Cyber Education Initiative for younger students.
How the competition works
Teams act as newly hired IT professionals managing the network of a small company, finding and fixing cybersecurity vulnerabilities in virtual images while maintaining critical services. Online qualification rounds lead to state, regional and national rounds. The National Finals add a Red versus Blue defence session and a Cisco Networking Challenge.
Eligibility notes
Open teams and JROTC, Civil Air Patrol and Naval Sea Cadet divisions run in parallel. Teams need an adult coach, who does not need technical expertise.
Is CyberPatriot right for you?
- Experience needed
- None required, though it helps. Training materials are provided.
- Time commitment
- A season of practice rounds.
- What you actually do
- Your team is given deliberately insecure virtual machines and a few hours to find and fix vulnerabilities while keeping services running.
A good fit if
- You want hands-on system administration rather than puzzles
- Your school can form a team with a coach
- You are interested in defensive security
Probably not for you if
- Students wanting individual competition, who should try picoCTF
Common mistakes
- Breaking a required service while hardening it, which loses more points than the fix gains.
- Not reading the scenario README, which lists what must keep working.
- Practising only on one operating system when rounds cover several.
How to register
- Find an adult willing to act as coach. This can be any teacher, parent or club leader; technical expertise is not required.
- The coach registers the team on uscyberpatriot.org during the registration window and applies for a fee waiver if eligible.
- Work through the free training materials and practice images that CyberPatriot provides to registered teams.
- Compete in each round from your own computers on the scheduled dates.
What skills you need
- Windows and Linux administration
- User and permission management
- Reading security policy
- Working under time pressure as a team
- Documentation
Recommended resources
-
CyberPatriot official site
Registration, rules, fee waivers and the official training modules provided to registered teams.
-
OverTheWire Bandit
Free Linux command line training that transfers directly to the Linux images.
Frequently asked questions
Do we need a technical coach?
No. CyberPatriot is explicitly designed for coaches without a technical background and provides training materials for teams to work through themselves.
How is it different from picoCTF?
CyberPatriot is defensive: you harden broken systems and are scored on vulnerabilities closed. picoCTF is offensive: you find hidden flags by exploiting deliberately vulnerable targets. The skills overlap but the mindsets differ.
Reviews, tips and resources from other students
Posts are public. Do not share your full name, school, address or contact details.
Something out of date?
If a deadline, fee or eligibility rule on this page no longer matches the official site, flag it and it goes into the review queue.
You might also look at
- Grades6 to 12
- CostFree
- Grades6 to 12
- CostFree
- Grades1 to 12
- Cost$125 to $175
- Grades6 to 12
- Cost$50 to $500