Students put cybersecurity skills to the test in TribeCTF

The clock was ticking and the pressure was mounting to hack into computer systems, crack encrypted codes and uncover hidden vulnerabilities.

This wasn't a cyberattack – it was TribeCTF, William & Mary's annual cybersecurity competition, where breaking into systems is all part of the challenge.

Working for just over 24 hours straight the weekend of Oct. 3-4, students representing eight Virginia colleges and universities put their technical skills, creativity and problem-solving abilities to the test. The competition challenged students to think like hackers while developing the skills needed to defend against real-world cyber threats.

Capture the flag, or CTF, competitions challenge participants to solve cybersecurity puzzles, ranging from breaking encryption to analyzing malicious code, to uncover hidden strings of text known as "flags." The competitions simulate the types of challenges cybersecurity professionals encounter when identifying vulnerabilities and protecting computer systems.

“Historically, it's most often used as a training exercise for cybersecurity professionals,” said Asher Montague, a Computer Science Ph.D. student and a member of the organizing committee. “In a lot of cases in the real world, what a hacker or a red-teamer is doing is going into some system and trying to extract some sort of data. The CTF is essentially trying to simulate that.”

Organized by members of W&M's CyberSecurity Center, TribeCTF brings together students, faculty and industry collaborators to promote ethical hacking, strengthen technical skills and build connections among students interested in cybersecurity. The annual competition, which previously took place alongside W&M's &hacks hackathon, was held as a standalone event for the first time this year.

“It's also great because there are many students here at William & Mary who would love to do both the hackathon and the CTF, so now they have that opportunity,” said Lily Gloudemans, another Ph.D. student on the organizing committee.

A competition for every experience level

While the competition attracted experienced hackers, organizers emphasized making TribeCTF accessible to students at all skill levels, including those with little or no cybersecurity experience.

“An easy challenge should be solvable by somebody who's maybe taken a class or maybe has a little bit of experience, or in some cases, even somebody who has no experience whatsoever,” said Montague.

This year's competition featured 30 challenges of varying difficulty, giving participants opportunities to build confidence while tackling increasingly complex problems. By the end of the event, teams had captured 324 flags, while five challenges remained unsolved.

Taking on the CAGE

One of the biggest additions to this year's competition was the introduction of the CAGE, a new component designed to test participants' cybersecurity skills without relying on artificial intelligence.

Inside a monitored room, teams worked at four designated computer stations without access to personal devices or AI tools. The environment challenged participants to rely on their technical knowledge, problem-solving abilities and familiarity with computing systems to complete a series of cybersecurity tasks.

“We live in the world of AI now,” said Gloudemans. “One of our major challenges this year specifically was how can we make the CTF still very fun, both for people who really want to use AI and who have a lot of skills in cyber using AI to help, and also for people who really don't have much interest in AI and are just interested in solving cybersecurity challenges.”

The CAGE proved to be a popular addition. Eighteen of the 25 teams participated, completing 82 sessions and logging a combined 70 hours at the four stations. The component featured eight exclusive challenges, five of which were solved by at least one team.

For organizers, the format offered a way to balance the growing role of AI in cybersecurity with the importance of developing foundational technical skills.

“We want to sort of restore the competitive experience [for experienced competitors],” said Montague. “Then for the people who are less experienced, we want to preserve that idea of it being a real learning experience where you can learn real cybersecurity skills.”

Takashi Idobe, a non-degree-seeking student with approximately eight years of experience in the cybersecurity industry, said CAGE reflected the technical demands professionals face in the workplace.

“It's very useful, I would say, for learning how operations work, which comes up a lot in the industry, like maintaining servers, et cetera,” said Idobe.

Zachary Bowden ‘27, the restrictions encouraged a more deliberate approach to solving problems.

“You're forced to actually think through the problem,” Bowden said. “That improves your critical thinking for anything cyber related.”

Learning beyond the classroom

Beyond the competition itself, TribeCTF provided students with opportunities to apply classroom knowledge in a collaborative, hands-on environment.

Unlike traditional coursework, where students often work through problems with established solutions, cybersecurity competitions require participants to experiment, adapt and develop creative approaches to unfamiliar challenges.

For Elijah Gilliam ‘27, that practical experience is one of the event's greatest benefits.

“CTFs like this are definitely a way to kind of extend beyond what you do in the classroom,” Gilliam explained. “These competitions definitely help get more hands-on experience.”

The event also connected students from across Virginia who share an interest in cybersecurity, creating opportunities to learn from peers with different backgrounds and levels of experience.

As AI continues to transform the cybersecurity landscape, organizers hope TribeCTF will continue to evolve and provide meaningful challenges for experienced competitors while remaining welcoming to newcomers.

“Everyone likes a good puzzle, and there’s a whole bunch of different types of CTF-like puzzles that you can have,” said Gloudemans. “Almost anyone can find some level of enjoyment in this, so I encourage everyone to just try.”