CyLab Security Academy (formerly picoCTF)

What it is, and a naming note

picoCTF began as Carnegie Mellon University's free capture the flag competition for school students and grew into a year round practice platform used by learners of every age. In 2026 the platform was relaunched as CyLab Security Academy, run by the same team at CMU. The official site says plainly that picoctf.org is now CyLab Security Academy, and that accounts created before May 8, 2026 carried over with progress, achievements and history intact. The picoCTF name lives on as the competition.

What it covers

The practice area offers a large library of challenges across general skills, cryptography, web security, forensics, reverse engineering and binary analysis, sorted by difficulty from complete beginner upward. Hints are available when you get stuck, so it teaches rather than just scores. Each challenge is a small, self-contained puzzle that ends in a "flag", a string you submit to prove you solved it.

The annual competition

Once a year the team runs a free, timed, team based picoCTF competition with fresh challenges and a live scoreboard. It is aimed particularly at students from school through university, but anyone can take part. The site states that it has hosted 16 competitions to date, and it is one of the most common first CTFs for people who have never competed.

Free versus paid

Completely free. The site describes itself as "Always free, for everyone", built by security experts at Carnegie Mellon, with no paid tier.

Time needed and prerequisites

You can solve a first challenge in under an hour with no background. Progress beyond the easiest level depends on some comfort with the Linux command line and basic scripting in Python, which you pick up as you go. An hour or two a few times a week is enough to make steady progress.

What you can do afterwards

Working through the practice challenges builds the habits every security role needs: reading unfamiliar data carefully, searching documentation, and writing down how you solved something. Those write-ups are also useful evidence of learning to share on GitHub. From here, learners often move to CTFtime to find their next competition.

Ethics and scope

Every challenge is built to be solved, so practising here is legal and safe. Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme. Skills from a CTF are not permission to test real websites or networks.

Common questions

Is it only for school students? No, it is open to anyone despite its outreach origins. Do old picoCTF accounts still work? Yes, the site says accounts created before May 8, 2026 carried over. Do I need to wait for the competition? No, the practice challenges are available all year.