What Is CyberPatriot?
Defense, not offense — and why that distinction changes everything⏱ ~8 min
A hacker breaks into systems. A CyberPatriot competitor is the person called in after the break-in — handed a machine that's already compromised, told to diagnose it, fix every vulnerability they find, and get it healthy before time runs out. The skills overlap, but the mindset is completely different. You are the defender.
The Official Competition
CyberPatriot is the National Youth Cyber Education Program created by the Air & Space Forces Association (AFA). It is the largest youth cyber defense competition in the United States, with thousands of teams from middle school through college competing each fall and spring season.
🔗What You Actually Do in a Round
Each round, your team receives one or more virtual machine images — virtual computers pre-loaded with Windows 10, Windows 11, or Ubuntu Linux. These images are deliberately broken. The organizers planted:
- •Weak or blank passwords on real user accounts
- •Rogue administrator accounts that shouldn't exist
- •Malware and suspicious scripts set to run at startup
- •Disabled security services — Windows Defender off, firewall down, updates blocked
- •Dangerous open services — FTP, Telnet, Remote Desktop left running unnecessarily
- •Misconfigured permissions — world-writable files, unauthorized shares
Your job: find as many of these misconfigurations as possible and fix them correctly within the 4-hour competition window. A remote scoring engine checks your VM every few minutes and awards points for each correct fix. You see your score update live.
The Biggest Trap Beginners Fall Into
Competition Format — What to Expect
| Element | Detail |
|---|---|
| Season structure | Qualifying rounds in fall → State/Regional rounds → National Finals in April |
| Round length | 4 hours per round — the clock starts when the first image is powered on |
| Number of images | Typically 2–3 VMs per round (e.g., Windows 10 + Ubuntu + Windows Server) |
| Scoring | Automated engine checks every few minutes; points awarded per fix, deducted for penalties |
| Penalties | Points lost for: deleting authorized users, breaking required services, modifying off-limits items |
| Team size | Up to 6 members; teams of 3–4 tend to work most efficiently |
| Tools allowed | Built-in OS tools plus free software you download during the round (e.g., Sysinternals, Malwarebytes) — check the round's README for restrictions |
| Internet access | Allowed for research and downloading tools — but NO help from anyone outside your team (coaches included) |
Before You Touch the VM: Read the Scenario
Start Here: The Official Interactive Demo
Before touching a real competition image, run the CyberPatriot Interactive Demo — a lightweight in-browser sandbox that simulates exactly what the competition looks like. It shows you the scoring interface, introduces common vulnerability types, and costs nothing. This is step one.
🔗Pick a Lane, But Start Broad
Don't specialize on day one. Spend your first few weeks poking around both a Windows and a Linux practice image — check users and groups, see what's running, find the firewall settings. After a few weeks you'll start to notice where your instincts are sharper. Then lean into it.
- •Windows track — account management, Group Policy (gpedit.msc), Windows Defender, Event Viewer, services
- •Linux track — command line fluency, user management, ufw firewall, service hardening, log analysis
- •Cisco track — router/switch configuration via Packet Tracer; many alumni say it's the most learnable specialty for the time invested, and a great choice if Windows and Linux don't click naturally
Two Resources to Start (Not Ten)
Resist the urge to read everything at once — it's overwhelming and most of it won't stick until you've practiced. Start with just two:
- 1.Akshay Rohatgi's "How To Win CyberPatriot" — read this for mindset and team structure, not technical checklists. It explains how top teams organize and prioritize.
- 2.One checklist (the Windows or Linux section of your team's playbook) — work through it on a practice image line by line, and look up why each item matters as you go. Don't just check boxes.
Ground Rules Every Competitor Needs to Know
- •One instance only — never run the same image in two VMs simultaneously; that's a rules violation
- •Snapshots are allowed and encouraged — take one immediately after opening the image and logging in, before any changes
- •The 4-hour clock starts when the first image is powered on — coordinate your team so you don't waste time booting images you're not ready to work
- •No outside help — internet research and free tools are allowed, but assistance from anyone who isn't a registered team member (including coaches) is a violation
- •Read the rulebook — it's on the official website; rule violations can disqualify your team even if you had the highest score
The Habit That Separates Good Teams from Great Ones
What is your role in a CyberPatriot round?