CYLAB SECURITY ACADEMY

Learners

From your first CTF to your hundredth, CyLab Security Academy is built for you.

Learn cybersecurity, at your own pace

CyLab Security Academy offers 490+ hands-on challenges across cryptography, forensics, web exploitation, binary exploitation, and more — created by security experts at Carnegie Mellon University.

No experience needed to start. Sign up free and begin solving puzzles today, or browse our resources first to get a feel for what’s here.

Get Started Explore the Platform

Learning paths

Learning paths are curated collections of challenges (sometimes with readings or games) designed to help you learn a particular topic at your own pace.

Academy platform · Learning path

A few examples of currently-available paths:

  • Beginner’s Guide to the Challenge Library: our most approachable problems, touching every challenge category but focused on General Skills.
  • Cryptography & Challenge Library Intro: play the PicoLock puzzle game and tackle Caesar Ciphers, RSA, and side-channel attacks.
  • Low Level Binary Intro: meet Mochi’s Tale, a videogame that introduces assembly, debuggers, and Python exploitation in a hands-on learning path.

Practice spaces

Open environments for self-paced learning, available year-round.

CTF Primer

CTF Primer

Refresher readings on the shell, crypto, and core security principles used in our competition challenges. Authored by the education team — no additional software needed.
Challenge Library

Challenge Library

Hundreds of challenges from past competitions and fresh never-before-released ones, in a safe practice environment. Whether you’re a professional or new to CTFs, there’s something to chew on.

Video lectures

Carnegie Mellon educators walk through core cybersecurity concepts — the same material we use to train our competition writers and ambassadors.

Get started

Your path forward

Three steps to go from account creation to competing.

01

Sign up

Create an account on CyLab Security Academy. You’ll receive a confirmation email with a verification link to activate it. Sign Up
02

Learn and practice

Start with the CTF Primer for refreshers on the shell, crypto, and core concepts. Then follow a guided Learning Path or jump into the Challenge Library to put them to work.
03

Compete

CyLab Security Academy hosts mini-competitions and an annual US middle/high school competition throughout the year. You’ll see all upcoming events in the Events tab once logged in.

Teams and classrooms

Most learning happens solo, but the platform supports group play too: player-formed teams for competition, and teacher-managed classrooms for school participation.

Forming a team

After registering for a teamplay-enabled competition, the My Team page lets you create or join a team. Share your Team Invite Code with potential teammates. Teams may consist of 1–5 players from different schools. To be eligible for prizes, all players on a team must be eligible — see each scoreboard’s rules.

Joining a classroom

From the Classrooms page, request to join by entering your teacher’s Classroom Invite Code. Your teacher can post Assignments bundling specific challenges and learning paths with due dates, and the classroom scoreboard tracks your progress against your peers. You can join multiple classrooms — one for your CS class, one for your club, one for your school.

Academy platform · Classroom, student view

General FAQ

What is hacking?
Hacking is about curiosity, exploration, and deeply understanding how something works. Most people who identify as hackers are working hard to protect people and make technology safer to use. Career-wise, people skilled in hacking are in high demand and often paid six-figure salaries.
What is a CTF?
CTFs (Capture the Flag) are computer security competitions. Contestants solve challenges that test creativity, technical skills, and problem-solving. Each solved challenge yields a string (the flag) submitted to a scoring service. CTFs are a great way to learn security skills in a safe, legal environment, and are played by many security groups around the world.
What is CyLab Security Academy?
A year-round cybersecurity learning platform created by trusted experts at Carnegie Mellon University. It teaches enough security to pique curiosity, motivates learners to explore on their own, and helps them better defend the systems they rely on.

Learner FAQ

What will I need to know to get started?
Minimally, how to think critically. Some familiarity with programming helps, but many participants have played with no programming experience and learned along the way. Exposure to Python, HTML, JavaScript, and C is ideal — but not required.
What software do I need?
Many challenges can be solved with only a web browser and the provided webshell; some require additional tools. Players are free to use any desired tools.
What network domains do I need access to?

Many schools and workplaces firewall sites by default. If you’re having trouble loading challenges, ask your network administrator to allowlist these domains:

  • cylabacademy.org (HTTPS)
  • learn.cylabacademy.org (HTTPS)
  • webshell.cylabacademy.org (HTTPS)
  • artifacts.picoctf.net (HTTPS)
As a college student or non-student, can I play?
Absolutely. Everyone is welcome. Some competitions limit prize eligibility to US middle/high school enrollment, but everyone is encouraged to play.
How much time do I need?
There’s a range of difficulties. You can log in any time and spend as much or as little time as you like during a competition. Outside of competition, Challenge Library is always open for self-paced practice.
Do I compete individually or in a team?
Each player registers individually. Some events are solo-only; others let you form a team of up to 5 members from the My Team page once you’ve registered.

Beyond the Academy

Want to go further?

These resources are not affiliated with CyLab Security Academy, but our problem and education developers find them very useful for learners who want to explore beyond the platform: