CyberPatriot Preparation: 2026-27 Schedule, Scoring, Setup

In short

CyberPatriot is a US team competition in which middle and high school students secure virtual Windows and Linux machines and complete a Cisco networking challenge in four-hour online rounds. Teams have one adult coach and two to six students, with five competing at a time. For CyberPatriot 19 (2026-27), Round 1 runs October 22 to 25, 2026, the State Round December 10 to 13, 2026, and the National Finals March 12 to 16, 2027. Modern Age Coders teaches this live online for US students, in a batch or one to one, and the first class is free.

Prepare with a teacher

Three courses for a CyberPatriot competitor

CyberPatriot rewards students who understand why a setting matters, not only where it is. These courses build that understanding, always from the defender’s side.

Cybersecurity Competitions for Teens course thumbnail

CP / 01

picoCTF and CyberPatriot prep

Ages 13 to 18. Competition skills, defensive and ethical.

Open the syllabus →

CP / 02

Cybersecurity for teens

Ages 13 to 18. Accounts, passwords, updates, safe systems.

Open the syllabus →

CP / 03

Python for teens

Ages 13 to 18. Scripts that check a system for you.

Open the syllabus →

The program

What CyberPatriot is

One program, three divisions, and a competition built around securing computers rather than attacking them.

CyberPatriot at a glance, from the official home page and Competition Overview (read 17 October 2026)
Point	What the official pages say
Organiser	The National Youth Cyber Education Program created by the Air & Space Forces Association
The contest	The National Youth Cyber Defense Competition, described as the nation’s largest cyber defense competition
The task	Find and fix security vulnerabilities in virtual operating systems; teams are scored on how secure they make them
Who can start	"CyberPatriot is designed for any student, regardless of prior cybersecurity knowledge."
Where	Online from any location, from a classroom to home, except the in-person National Finals in Bethesda, MD
Season name	CyberPatriot 19 (2026-27), often written CP-19

The three CyberPatriot divisions
Division	Who competes
Open	High school students from schools, scouting units, clubs, home school and STEM programs
All Service	High school students in JROTC, Civil Air Patrol units and Naval Sea Cadet Corps units
Middle School	Middle school students from schools, scouting units, clubs and STEM programs

Sources: uscyberpatriot.org and its Competition Overview, read 17 October 2026. Modern Age Coders is not part of CyberPatriot or the Air & Space Forces Association; we teach the underlying skills.

Who is on a team

Coach, competitors, mentors: the CyberPatriot team rules

A team is built around one adult coach. Students cannot register themselves.

Team roles, from the official Competition Overview and Join the Competition pages
Role	Rule
Coach	An adult approved by a participating organization, such as a teacher, JROTC instructor, administrator or parent. "A team can only have one coach."
Competitors	"Each CyberPatriot team must consist of between two and six competitors" from the organization; five at most compete at once, with one substitution per round
Technical mentor	An IT-experienced volunteer who must register and pass a background check (Minimum age: 18)
Team assistant	A non-technical adult volunteer, also registered and background checked (Minimum age: 18)
Student sign-up	Students do not create volunteer accounts; the coach adds them to the roster, then each completes a questionnaire
Coaches’ teams	A coach can register up to five teams

If your child missed registration

For CyberPatriot 19, teams had to be created by October 1, 2026, and "Competitors must be added to a roster no later than October 21, 2026". After that, the season’s rosters are set.

A student who missed it can still prepare for the next season, CyberPatriot 20, and ask a teacher, JROTC instructor or club leader now about coaching a team when registration reopens.

The coach is present every round

The FAQ is clear that coaches must be present to monitor students during a round and make sure the rules are followed. A mentor can stand in only through the official alternate coach request.

Coaches also control the images and passwords, so practice outside the official rounds depends on what the coach makes available.

The calendar

CyberPatriot 19 (2026-27) schedule

Unscored practice runs from summer into October, then one scored round a month. Dates below are from the official schedule; the program notes they may change.

CyberPatriot 19 training and competition rounds, 2026-27 season (official schedule, read 17 October 2026)
Round	Dates (CP-19)	Who and what
Exhibition Round	June 3 to August 24, 2026	Practice and recruiting; scores do not count
Training Round 1	September 3 to October 5, 2026	Basic images with answer keys in the ReadMe
Practice Round	October 7 to 20, 2026	Teams must test at least one image to check access
Round 1	October 22 to 25, 2026	Open and All Service teams; tests basic skills
Round 2 and Middle School Introductory Round	November 12 to 15, 2026	High school round 2 sets tiers; first round for middle school teams
State Round	December 10 to 13, 2026	All teams; high school teams start with a clean slate
Semifinals	January 21 to 23, 2027	Qualifying teams only
National Finals	March 12 to 16, 2027	In person in Bethesda, MD, for national finalist teams

Choosing your four hours

Each competition weekend, a team picks one continuous four-hour block inside the published windows, in Eastern Time: Thursday 9:00 a.m. to 10:00 p.m., Friday 9:00 a.m. to 11:59 p.m., Saturday 8:00 a.m. to 11:59 p.m. and Sunday 10:00 a.m. to 8:00 p.m.

For a team in California, our conversion: the Saturday window runs from 5:00 a.m. to 8:59 p.m. Pacific, so a 9:00 a.m. Pacific start is well inside it.

No make-up days

The FAQ says "There are no scheduled backup dates in CyberPatriot." An emergency date exists only for genuine emergencies, and the schedule page adds that scheduling conflicts are not considered emergencies.

Mark all the round weekends in the family calendar in September, before sports and travel fill them.

Inside a round

What happens in a four-hour CyberPatriot round

Two challenges share one four-hour period. Understanding the split is half the preparation.

The two CyberPatriot challenges, from the official Competition Overview and Training Materials pages
Challenge	What teams do
Network Security Challenge	Secure Windows and Linux virtual machine images; past tasks include hardening services, fixing vulnerabilities, removing malware and "Answering forensics questions"
Cisco Networking Challenge	An online quiz and a Packet Tracer exercise on assigned Cisco Networking Academy training; past topics include subnetting and IP addressing

Before the round. Image download instructions reach approved coaches on the Monday; check each download’s checksum and unzip it in advance.
Start. On Thursday the StartEx email gives the image password. The four hours begin when the first image opens, so open nothing early.
Read before you change. Go through everything the image gives you before touching a setting; training images, for example, carry a ReadMe file. Every fix should respect the scenario you are given.
Fix and check. The Scoring Report on the image desktop shows points as fixes are recognised. Note every change, so a broken image can be rebuilt quickly.
Cisco tasks. Someone on the team takes the networking quiz and the Packet Tracer exercise, which count separately.
Finish. Stop within four hours, shut the image down properly and make sure every team member deletes the images afterwards.

Our suggested split for a five-person team (ours, not an official rule): two students per operating system image and one on the Cisco tasks, with the coach keeping time and the team swapping notes at the two-hour mark.

Points

CyberPatriot 19 scoring values by round

The official Challenges and Scoring Values page lists the points available in each round. The values are subject to change.

Published points for the first three CP-19 rounds (official page, read 17 October 2026)
Round	Images	Cisco challenge	Total Possible Points (as published)
Round 1, Open and All Service (October 22 to 25, 2026)	Windows 11 100; Mint 21 100	Quiz 10; Packet Tracer 20	230
Introductory Round, Middle School (November 12 to 15, 2026)	Windows 11 100; Debian 12 100	Quiz 10; Packet Tracer 20	230
Round 2, Open and All Service (November 12 to 15, 2026)	Windows 11 100; Server 2022 100; Debian 12 100	Quiz 10; Packet Tracer 20	330

Tiers after Round 2

High school results from Round 2 divide teams into tiers for the State Round: Platinum for the top 30% of teams, Gold for the middle 40% and Silver for the remaining 30%. Middle school teams are not tiered.

For the Semifinals, the FAQ says the top 25% of Open Division teams in each tier advance, with wildcard places for unrepresented states, and the top 60% of Middle School teams advance on combined scores.

What the numbers mean for practice

Our reading: in Round 1 the two images carry most of the points and the Cisco challenge the rest, so image hardening is where most practice time belongs. From the State Round, the high school Cisco section grows, and networking deserves more time.

Scores are published 7 to 10 business days after a round ends, so a team learns its standing well after the weekend.

Penalties

Rules that cost new teams points

Most lost points in a first season come from procedure, not from skill. These are the rules the FAQ spells out.

Common penalties and procedures, from the official Competition FAQ
Rule	What it means in practice
Overtime penalty	The four-hour window "begins the moment they open the first virtual image in VMware"; opening an image early to test it starts the clock
Multiple instance penalty	There must be "no more than a single copy of the same virtual image" open at once, even on different computers
No cloud hosting	Images must not be run from vSphere or cloud hosting during rounds
No sharing between teams	Teams from the same school cannot share information from the images or the Cisco challenge
Restarting an image	A fresh copy starts at zero points, which is why notes of every change matter
Score corrections	Only through the official form, by 11:59 p.m. Eastern on the last day of the round

The overtime rule is the one we drill first with new students. In a practice session we time four hours from the moment an image opens, so the habit of not peeking early is in place before Round 1.

The computer

The computer you need for CyberPatriot 19

The program keeps the requirements modest, but a few are firm. Check them in September, not on the Thursday of Round 1.

CP-19 technical requirements, from the official Technical Specifications page
Item	Requirement
Computer	A 64-bit host computer; all teams are required to have one
Processor	Intel 64-bit i3 from the Sandy Bridge generation or better, or AMD Bulldozer or better, with virtualization enabled in the BIOS
Memory and disk	8 GB of RAM and 40 GB of free disk space
Operating system	64-bit Windows 10 with security updates after October 14, 2025, or Windows 11
Virtual machine software	VMware Workstation Pro 26H1, the standard for CP-19, a free download
Other tools	WinMD5 to verify downloads and 7-Zip to unzip images; Cisco Packet Tracer 9.0.0
Mac or Linux hosts	Allowed at the team’s own risk; problems are not grounds for appeal

Why a Chromebook will not do

The images run inside VMware Workstation Pro on a 64-bit Windows host. A typical school Chromebook cannot run it, so a student practising at home needs a Windows laptop that meets the specification.

The program recommends one host computer per image in a round; running two images on one machine makes the minimum specification inadequate.

A September checklist (ours)

Confirm 64-bit Windows under Settings, System, About. Turn on virtualization in the BIOS. Install VMware, 7-Zip and WinMD5. Open a training image once and shut it down cleanly.

Ask the school IT team to allow the sites on the official access list, such as uscyberpatriot.org and netacad.com, before the first round.

Practice, safely

Practice images and a small defensive script

Official practice images come only to registered coaches. We never distribute images or answer keys; we teach the thinking behind each fix.

Where official CyberPatriot practice comes from (Training Materials page)
Practice	What it is
Exhibition Rounds	Unscored images for recruiting and training, in summer
Training Round	Images with answer keys for guided training
Practice Round	Unscored images just before the season, to check access
Cisco Networking Academy	A content course for the quiz and Packet Tracer, plus free self-paced courses such as Linux Unhatched and Introduction to Cybersecurity

Python · check accounts against the authorized listpython

# audit_users.py (ours): compare accounts on a practice machine
# with the users the scenario says are allowed
passwd = """root:x:0:0:root:/root:/bin/bash
ana:x:1000:1000:Ana:/home/ana:/bin/bash
ben:x:1001:1001:Ben:/home/ben:/bin/bash
guest2:x:1002:1002::/home/guest2:/bin/bash
toor:x:0:0::/root:/bin/bash"""

authorized = {"ana", "ben"}

for line in passwd.splitlines():
    name, _, uid, *rest = line.split(":")
    uid = int(uid)
    if uid == 0 and name != "root":
        print(f"{name}: a second UID 0 account, investigate")
    elif uid >= 1000 and name not in authorized:
        print(f"{name}: not on the authorized list")

Output: guest2: not on the authorized list, then toor: a second UID 0 account, investigate. Our own sample lines in the format of a Linux /etc/passwd file. UID 0 means full administrator rights, so any account other than root holding it is a red flag. Run checks like this only on practice images or machines you are responsible for.

The idea behind it: least privilege

A defender’s first question is always who has access, and should they? The script automates the reading of a long account list; the decision still belongs to the student, checked against whatever the scenario says.

Never delete an account just because a script flagged it. The scenario may require it, and removing an authorized user can cost points.

A hardening checklist (ours)

Accounts and passwords, then updates, then the firewall, then services that should not be running, then software that should not be installed, and finally the forensics questions, which are worth reading first because fixes can destroy the evidence they ask about.

Write every change in a shared team note with the time. It is the only way back from a frozen image.

Twelve weeks

A 12-week plan for a first CyberPatriot season

Our plan for a new team member, about three hours a week including one class. It runs from late summer to the State Round, and repeats each season.

Twelve weeks to the State Round (ours; align the weeks with the current season’s dates)
Weeks	Focus	Finished when
1 to 2	Windows accounts, groups and password policy	Can set a password policy and audit users by hand
3 to 4	Linux basics: users, sudo, packages, services	Can find and stop an unneeded service from the terminal
5	Updates and firewalls on both systems	Both systems patched and firewalled on a practice machine
6	Networking: IP addresses and subnets	Can work out a subnet’s range by hand
7	Packet Tracer basics	A small virtual network built and tested
8	Forensics questions	Can answer file and log questions before fixing anything
9	A full timed practice	Four hours timed from first image open, notes kept
10 to 11	Weak spots from the practice	Each missed item explained and practised
12	State Round readiness	Roles agreed, computers checked, calendar set

Middle school

Windows first, with plenty of talking through why each setting protects people. Linux comes in slowly.

First-year high school

Both operating systems and basic networking, with the overtime and instance rules drilled early.

Returning competitors

Server images, deeper Linux, and the larger Cisco section of the later rounds.

Readiness

From new recruit to steady team member

Four stages we use to place a student on a CyberPatriot study plan.

CyberPatriot readiness stages (ours)
Stage	The student can
1. Recruit	Explain what an operating system image is and follow the ReadMe
2. Hardener	Fix accounts, passwords and updates on one system without help
3. All-rounder	Work on Windows and Linux images and keep clean notes
4. Lead	Plan the team’s four hours and answer forensics questions first

For parents

CyberPatriot is defense from start to finish, which makes it one of the safest ways for a teen to learn security.

The commitment is real: a four-hour block on round weekends from October to January, plus practice. Plan around it early.

For students

Read everything the image gives you before touching anything. A rushed fix can break something the scenario needed.

Learn why each fix matters. The same settings protect your own laptop and your family’s router.

The catalogue

Nine courses for future cyber defenders

Live online classes with a regular teacher, from first code in middle school to systems in high school.

I

Middle school

First foundations

CP / MID / 01

Python for kids

Ages 9 to 12, first scripts.

Open the syllabus

CP / MID / 02

Coding for kids

Logic before systems.

Open the syllabus

CP / MID / 03

Maths through coding

Binary and subnets made friendly.

Open the syllabus

II

Systems

High school

CP / SYS / 01

Backend for teens

Servers and how they run.

Open the syllabus

CP / SYS / 02

C++ for teens

Memory and how software fails.

Open the syllabus

CP / SYS / 03

Java for teens

Structured, careful code.

Open the syllabus

III

Going further

Strong students

CP / ADV / 01

Full stack web

Build, then defend, a web app.

Open the syllabus

CP / ADV / 02

Data science for teens

Logs and data at scale.

Open the syllabus

CP / ADV / 03

AI and ML for teens

Where security meets AI.

Open the syllabus

Lesson times

Practice that fits around round weekends

Weekdays or weekends, flexible: choose your batch, or for a very personalised plan choose 1-on-1 at your convenience, weekend mornings or weekdays.

Weekdays

An evening session after school, any US time zone.

Weekends

Timed practice blocks between competition weekends.

1-on-1

Fill one student’s gaps before the State Round.

Defense only

Hardening, auditing, patching.

Windows and Linux

Both systems, side by side.

Networking

Subnets and Packet Tracer basics.

Timed drills

The four-hour clock, rehearsed.

No image sharing

We teach skills, never answer keys.

Batch or solo

Fifteen to twenty, or one to one.

Student work

Projects from our learners

Defenders who can build understand systems better. Here are a few student builds, with more on the student labs page.

AI and ML

NutriLife

An AI nutrition coach that reads what you eat and works you toward a target.

by Bhavya · Open it

AI and ML

Misti

A chatbot that answers mathematics and programming questions, built and deployed by a student.

by Harshit · Open it

AI and ML

GuardianX

An assistant that helps a young person recognise unsafe situations online.

by Vivaan · Open it

Web app

SkyCast

A weather forecasting site with live conditions for any location.

by Krish

Fees

CyberPatriot sets its own team fees, which the coach handles with the program. Our classes are a separate monthly charge in US dollars, so a student can train through the season and pause when it ends.

Free first class

USD 0

no card required

A free first lesson
A quick skills check
No card details

Book it

Group batch

USD 100

a month, billed in US dollars

Fifteen to twenty learners
One regular teacher
Batch times you choose
Monthly

Start here

One to one

USD 150

a month, billed in US dollars

A teacher for one student
Built around the rounds
Weak spots first

Enquire

What families say

Rated 4.9 across 547 Google reviews

Reviews parents posted on Google, untouched.

★★★★★

"The one step solution for my son. Modern Age Coders make learning coding so simple that kids love it. The teachers explain complex concepts clearly with practical exercises and interactive content."

Ria Mukherjee

Parent

★★★★★

"Modern Age Coders has been a game-changer for me. I struggled to grasp IT concepts and coding before joining, but their classes transformed everything. I can now confidently write complex programs with ease."

Samriddha Mondal

Student

★★★★★

"One of the most wonderful education centres out there. Education is not limited to school syllabus but focuses on skill development."

Vansh Agarwal

Student

★★★★★

"My child Dhairya is really enjoying the Modern Age Coders classes. This is his first online class and he eagerly looks forward to it. I can already see his improvement, and the teachers are very cooperative."

Sonam Oswal

Parent of Dhairya

★★★★★

"Modern Age Coders have wonderful teachers who teach in a clear, easy and practical way. The teacher boosts students' confidence and inspires them to learn without hesitation."

Sonu Goyal

Parent

★★★★★

"I highly recommend this computer coding class! The teachers are incredibly knowledgeable and passionate about coding."

Ritu Kedia

Parent

Questions from families

CyberPatriot: common questions

What is CyberPatriot?

The National Youth Cyber Education Program created by the Air and Space Forces Association. Its core is the National Youth Cyber Defense Competition, where student teams secure virtual computers.

Who can compete in CyberPatriot?

High school students in the Open or All Service Divisions and middle school students in the Middle School Division, on a team from a participating school or approved youth organization.

How big is a CyberPatriot team?

Two to six competitors with one adult coach. Five students at most compete at one time in a round, with one substitution allowed each round.

Can my child sign up alone?

No. Students do not create accounts; a coach registers the team and adds competitors to the roster. For CyberPatriot 19, rosters had to be complete by October 21, 2026.

When are the CyberPatriot 19 rounds?

Round 1 is October 22 to 25, 2026, Round 2 and the Middle School Introductory Round November 12 to 15, the State Round December 10 to 13, the Semifinals January 21 to 23, 2027, and the National Finals March 12 to 16, 2027.

How long is a round?

Each team picks one continuous four-hour block in the competition weekend window, and the clock starts when the first image is opened.

What computer does a team need?

A 64-bit host with at least 8 GB of RAM, 40 GB of free disk space and virtualization enabled, running 64-bit Windows 10 with recent updates or Windows 11 and VMware Workstation Pro.

Are there practice images?

Yes, through registered coaches: summer exhibition rounds, a training round with answer keys, and a practice round in October. We do not share images or answer keys.

Does my teen need cybersecurity experience first?

No. The official overview says CyberPatriot is designed for any student, regardless of prior cybersecurity knowledge, and training materials come through the coach and Cisco Networking Academy.

When are your classes?

Weekdays or weekends, flexible: choose your batch, or for a very personalised plan choose 1-on-1 at your convenience, weekend mornings or weekdays.

How does Modern Age Coders help a CyberPatriot student?

We teach the defensive skills behind the rounds, from Windows and Linux hardening to networking and forensics questions, and rehearse the four-hour format. We never help during a round.

Elsewhere on this site

Related pages

More for US students who like to build, defend and compete.

Coding classes in the USA

All our pages for US families.

CS extracurriculars

How a cyber team fits in.

Hackathons for high schoolers

Building against the clock.

AP CS Principles

Networks and the internet, for credit.

Coding for 14-year-olds

A good age to start CyberPatriot.

Student labs

What our learners have built.

Technovation Girls guide

Technovation Girls and the 2026-27 Technovation Challenge, from the official pages.

Coding competitions for high school students

US high school coding competitions for 2026-27, from the organisers' own rules.

Coding competitions for middle school students

Middle school coding competitions for 2026-27, grade by grade.

Start here

Book a free first lesson

Tell us the division and the next round date. The teacher checks Windows and Linux basics first, then sets a plan that fits the season calendar.

To see our lesson style before booking, how we teach walks through it, and the course list carries every syllabus.

WhatsApp us · +91 91233 66161 · connect@modernagecoders.com

Classes are live online from our teachers in India, scheduled for US time zones. WhatsApp is the quickest way to reach us.

Want a class sooner? Book a priority demo

A priority demo is a full class of about 45 to 60 minutes. After the class the mentor sends a written skill report and a personal learning roadmap on WhatsApp. If you enrol, the demo fee is adjusted against your first month's fee. Share your demo Order ID with us on WhatsApp and we take it off.

Book a priority demo

Three courses for a CyberPatriot competitor

picoCTF and CyberPatriot prep

Cybersecurity for teens

Python for teens

What CyberPatriot is

Coach, competitors, mentors: the CyberPatriot team rules

If your child missed registration

The coach is present every round

CyberPatriot 19 (2026-27) schedule

Choosing your four hours

No make-up days

What happens in a four-hour CyberPatriot round

CyberPatriot 19 scoring values by round

Tiers after Round 2

What the numbers mean for practice

Rules that cost new teams points

The computer you need for CyberPatriot 19

Why a Chromebook will not do

A September checklist (ours)

Practice images and a small defensive script

The idea behind it: least privilege

A hardening checklist (ours)

A 12-week plan for a first CyberPatriot season

Middle school

First-year high school

Returning competitors

From new recruit to steady team member

For parents

For students

Nine courses for future cyber defenders

Middle school

Python for kids

Coding for kids

Maths through coding

Systems

Backend for teens

C++ for teens

Java for teens

Going further

Full stack web

Data science for teens

AI and ML for teens

Practice that fits around round weekends

Defense only

Windows and Linux

Networking

Timed drills

No image sharing

Batch or solo

Projects from our learners

NutriLife

Misti

GuardianX

SkyCast

Fees

Rated 4.9 across 547 Google reviews

CyberPatriot: common questions

What is CyberPatriot?

Who can compete in CyberPatriot?

How big is a CyberPatriot team?

Can my child sign up alone?

When are the CyberPatriot 19 rounds?

How long is a round?

What computer does a team need?

Are there practice images?

Does my teen need cybersecurity experience first?

When are your classes?

How does Modern Age Coders help a CyberPatriot student?

Related pages

Book a free first lesson

Want a class sooner? Book a priority demo

Keep exploring Modern Age Coders

Related courses and guides

Free resources

From the blog

Start here