Competing in the National Cyber League: A Student’s Perspective

Disclaimer: I am not sponsored in any way by Cyber Skyline or The National Cyber League. I am not receiving compensation in any way for this blog post. They did not contact or reach out to me to make this post.

Introduction

So, as a cybersecurity student, finding the time outside of classes and work to sit down and actually do some productive training can be hard, like, really hard. So it’s always nice when you are able to find some structured content that just lets you practice new skills while giving you the opportunity to get help if needed. Now, some of you might be wondering, “but wait, isn’t that what TryHackMe and HackTheBox do?”, and yes, you’d be correct. You 100% can do TryHackMe and HackTheBox until your fingers fall off, and your hard drive refuses to keep spinning, but what good is all that practice if you don’t have anywhere to showcase it?

Yes once again those same readers from before are now saying “Well both of those sites run their own CTFs, and you can always participate in other CTFs too.”, and just like last time they are correct. But if I was here to talk about TryHackMe or HacktheBox, then wouldn’t I have put them in the title of this post instead?

The National Cyber League

What is the NCL?

The National Cyber League (NCL), is a bi-annual cybersecurity competition designed for high-school and college students to apply what they were leaning in class to actual practical experience¹. The competition is made of two parts, a team game and an individual game, which seem pretty self-explanatory as far as what they are. The NCL is powered by Cyber Skyline, a cybersecurity training company that also provides CaaS (Competition as a Service)². This is the platform that the NCL is built off of. It’s similar to a jeopardy style CTF, where you have categories and then challenges within those categories, but usually in the NCL there are multiple questions per challenge as well.

Okay… so what?

As a student, it’s super easy to only think about the things you learn in class only during class and while you’re doing the homework for it. Some students just don’t have the time, money, or energy to spend constantly building up a home lab, working on the newest exploit, and learning all things cyber. In a perfect world, it’d all be achievable, but alas, we don’t live in a perfect world.

However, the NCL gets pretty darn close to that.

The Gym

You see, the way that they structure the competition is fantastic. A few months before the game, they open up a gym for you to practice with the platform, challenges, and tools you’ll be needing to solve challenges. This makes it super easy for a new competitor to get the feel of the site, and begin to dive into the vast trove of challenges in order to sharpen up their skills. I can’t tell you the number of times over the last semester that I learned something new in the gym, and had the opportunity to actually use it later on in the actual competition.

The Competitions

The Individual Game

Now is the time we’ve all been waiting for, time to showcase your skills, wow your friends and family, and… probably not get enough water and sleep for the weekend (please drink water and sleep during the games, it helps your performance). From Friday at noon CST to Sunday at 20:00 CST, you go and try to solve as many challenges as you can, by yourself. While yes in the grand scheme of things cybersecurity is a team effort, you need to be able to pull your own weight, plus it is an amazing way to help you gauge where you have improved, and what you still need to work on.

The Team Game

Alright, so after your hopefully amazing individual performance, you get to band together with up to 6 other students, and then play the same game as the individual game, just with harder challenges to really put your team’s abilities to the test. Not only are you going to be up against harder challenges that require a stronger understanding of the fundamentals of cybersecurity, but you also are going to need to work together to split up the tasks amongst your team members for maximum efficiency. Remember, you only have the weekend to finish all the challenges, and finishing them all is a tall task in the first place. But, this is where your school can really shine, and showcase that they have trained an elite team of future cyber professionals.

Pros and Cons:

Pros

Now, I’ve played my fair share of different CTFs and competitions, and I think what sets the NCL apart from the rest is the following:

• After every game you get a score report that highlights everything you did, not only does it aesthetically look great on a resume, but it’s a conversation starter for sure.
• The Power Rankings³ are great for a school to track their success and growth as a program, allowing both the teachers and students to learn and grow from the competition.
• The Community. The NCL discord is alive and always active during the competition season, and everyone there is eager to help others learn and succeed.

Cons

These are some of the things that might make other competitions more appealing:

• You need to pay to register
  • While I believe that it’s a great value for what you get, it’s hard to deny the fact that not having to pay to compete would be more appealing
• You can’t access the challenges outside the competition, and aren’t allowed to post writeups anywhere
  • Again, I understand that with how the structure works, this is something they do to protect their IP, since you need to pay to access it, but I can’t help but feel a twinge of sadness that I cannot post writeups to the challenges to this blog.
  • I think an interesting angle they could maybe consider in the future is having a writeup category, where students can submit writeups for certain challenges to try and receive points.
  • However, I can not say that I like how after the competition ends you can not go back and retry challenges the right way after seeing the answers. I think that having that ability would help students immensely so they are able to see what would’ve worked and why their solutions might not have worked.

Footnotes

_{citations are generated with Purdue Owl}

1. Our Mission, National Cyber League, nationalcyberleague.org/about/mission. Accessed 16 Apr. 2025. ↩︎

2. Cyber Skyline, Cyber Skyline, cyberskyline.com/. Accessed 16 Apr. 2025. ↩︎

3. “Cyber Power Rankings.” Cyber Skyline, National Cyber League, cyberskyline.com/data/power-ranking/. Accessed 16 Apr. 2025. ↩︎