Online registrations

November 3, 2025 - January 25, 2026

From November 3, 2025 it will be possible to register as participants in the eighth edition of the CyberChallenge.IT program. The registration phase for each venue will end on January 25, 2026 or as soon as all spots are filled for the venue itself. The requirements for registration are:

• Be between 16 and 24 years old as of December 31, 2025, i.e., born between 2001 and 2009 inclusive.
• Be able and available to physically reach one of the participating venues for the admission tests, training phase and local competition.
• Be available to actively participate in the 72-hour training course over 12 weeks from February to May 2026, in the local competition, and potentially in the national competition.
• Have a good knowledge of English and basic computer and programming skills.
• Complete the registration form and verify the email address correctly.
• Not having already participated in a previous edition of the project as admitted. It is possible to participate a second time only if you participated in the project as a high school student and register as a university student. Note: "participation in the project" refers to admission and attendance to the training course, there are no limits instead on the number of times you can participate in the admission test.
• If admitted to the training program, participants will be asked to upload their personal CV, which may be shared with institutions and companies supporting the program.

Registration can be done independently on the website by individuals interested in participating without any intervention needed from schools or universities.

Pretest

January 28, 2026

The first of the two participant selection phases will take place on the morning of Wednesday January 28, 2026, in person at the respective university venues. This first phase will consist of a multiple-choice test with 15 questions and a duration of 60 minutes.

The questions will cover topics in logic, mathematics, algorithms, and basic computer science. Knowledge of specific programming languages or advanced cybersecurity topics is not required to pass this phase. The tests from previous years are available, with solutions, in the training material section of the website. Completing the simulations available among the training materials is recommended in order to test the pretest platform, but it is optional and does not affect the normal course of the admission phase.

Participants must take the test using a preconfigured machine provided by their university venue, which will make available solely and exclusively a browser to access the test page.

It is not allowed to freely access the Internet or to use any additional tools other than the test website, blank sheets of paper, pens, and a standard scientific calculator. Consequently, the use of any artificial intelligence tools is also strictly prohibited.

The test will take place for everyone between 09:00 and 13:00; if the classroom capacity in some university venue is not sufficient to hold the test in a single slot, it may be organized in multiple sessions throughout the morning. Further information regarding any sessions and their schedules will be communicated later, along with any venue-specific variations that will be communicated to participants by the university venue itself.

In this phase, each correct answer is worth 1 point, up to a maximum of 15, while each wrong or unanswered question is worth 0 points. No penalty points are applied.

The first 60 participants, plus all further ties of the 60th place, will be admitted to the programming test, using only the score obtained as the sole discriminator. Particularly, the delivery time will not be considered for selection. It is possible that some university venues may reduce the number of participants admitted to the programming test due to classroom capacity limitations, and therefore they may be fewer than 60.

In cases of suspected cheating or collaboration, the organizers reserve the right to disqualify all involved participants.

Attention: between 2017 and 2020, this first selection phase was divided into "Pretest" and "Test". This single test, from 2021, replaces both of the previous ones, giving direct access to the programming test.

Programming test and admission

January 28, 2026

On January 28, 2026, for those admitted from the pretest, the second and final selection phase for the CyberChallenge.IT 2026 program will take place in person at the university venues. In this phase, participants will be presented with 4 algorithmic or implementation-oriented problems, to be solved using a programming language.

The official programming test will be available starting at 15:00 on January 28 and can be completed within a maximum duration of 3 hours, ending at 19:00. Any venue-specific variations will be communicated to participants by the respective university.

For each problem, a downloadable PDF file containing the formal problem statement will be provided, along with a set of input and output examples, and a collection of templates in some of the available programming languages that can be used as a starting point for implementing the solutions.

Participants must take the test using a preconfigured machine provided by their university venue, through which they will have access to a browser to reach the test page and the necessary tools to complete it using one of the most common programming languages, for which, if possible, documentation will be made available. More information about the machine and the software installed on it are available atthis link.

It is not allowed to freely access the Internet or any resource other than the test website and the pre-installed tools on the machine provided by the university venue. Consequently, the use of any artificial intelligence tools is strictly prohibited.

For each problem, participants are required to execute their solution code on the provided machine using the downloadable input files for each subtask of the problem, and to upload the corresponding outputs and the source code to the platform. The platform will provide immediate feedback on the correctness of the submission, assigning the indicated score. If the output is correct, the related points will be awarded; if it is incorrect, participants will be able to request a new input file and attempt another submission. The number of submissions or the time taken to write the solutions will not affect the final admission ranking.

The tests from previous years, with C++ and Python solutions, are available in the training material section of the website.

At the end of this test, a weighted average between the score of the Pretest and that of the Programming Test will be calculated. The final ranking will be compiled in descending order of score and, in the event of a tie, in ascending order of age. Each venue will select from this ranking a maximum of 20 official participants, who will form the team for the training phase, plus a maximum of 5 reserves, who can follow the lessons and step in during the training if any of the officials decide to withdraw. Reserves who have not stepped in at the end of the training phase will not take part in the local competition and may participate again in the project in subsequent years if they meet the necessary requirements.

Each admitted participant will be asked to confirm active participation in the project, i.e., the commitment to follow the training course during the 12 weeks and participate in the planned events.

Attention: the representatives of each venue have the authority to correct and possibly manually reevaluate the submissions of the programming test. Therefore, the score displayed by the platform should only be considered as an indication for the participant of the correctness of the proposed solution, but may not reflect the true score assigned by the venue.

Training phase

February 2026 - May 2026

Between February and May 2026, the training phase will take place at various sites. The program consists of 12 weeks of training, managed autonomously by each venue in terms of methods, dates, and times, mainly focusing on cryptography, hardware security, network security, software security, and web security. Each week will feature a 2-hour theoretical lesson and a 4-hour practical lesson, focusing on applying the studied techniques to solve challenges in the style of local and national competitions.

All participants will also be provided with access to the official training portal of the project, where slides, video lessons, and exercises prepared by the national coordinators and divided by topic will be uploaded, along with the challenges proposed in previous local competitions. Credentials and access methods to this portal will be communicated to the admitted after the selection phase.

If you want to train independently before the start, the training portal of the Italian Cybersecurity Olympics with various educational modules and hundreds of training challenges of varying difficulty is available at training.olicyber.it.

Attendance at the trainings, whether in person or online, is mandatory for all official participants. In the case of unexcused absence for 3 consecutive meetings, one will be considered a dropout and will not be able to participate in the local competition. Each site may make this rule more stringent by imposing a minimum number of lessons to attend.

Participation in the training course can be recognized by the individual participating universities as a FSL (Formazione Scuola-Lavoro) project for high school students or as CFU (Crediti Formativi Universitari) credits for university students. Modalities, agreements, and recognitions are at the complete discretion of the individual universities that manage the procedures.

Local competition

May 27, 2026

The local competition will take place on May 27, 2026. This phase will consist of a "Capture The Flag" (CTF) type competition in Jeopardy format, to be undertaken individually according to the modalities decided by each venue. This type of competition includes a series of practical challenges, the same type encountered during training.

Through this competition, each venue will select the 6 participants who will take part in the National Competition. More information on the conduct of this phase and the selection process will be provided to participants during the training phase.

At the end of the local competition, each venue will autonomously organize an award ceremony to celebrate the journey during the training months, to hand out participation certificates, and to award prizes to the winners of the competition.

National competition

July 2026

Following the training phase and the local final competition, the national final of the CyberChallenge.IT 2026 program will be held in July 2026. The location and exact dates are still to be defined. This phase will consist of a "Capture The Flag" (CTF) competition in Attack & Defense format, to be played in teams, with the 6 participants selected from each venue. The dates for the national competition are being defined and will be communicated as soon as possible. As in previous editions, the competition will last 4 days, including arrival and departure days.

Each university will send a team of 6 members to the national competition. For all participants, accommodation at the venue and meals for the entire duration of the event will be provided and fully managed by the organization. Travel to and from the venue must be arranged independently by all participants and will be reimbursed at the end of the event according to the specified procedures.

All participants are expected to arrive at the venue by the afternoon of the first day. In the late afternoon and evening, a short simulation will be held to test the competition room, connectivity, and game platform.

The participants will face the national final on the day after, with their own laptop, which they must bring to the competition venue. Internet connection will be provided by the organization. Generally, additional devices or accessories other than a mouse, keyboard, and PC charger are not allowed; in particular, the use of additional screens is not permitted. If a participant needs to use auxiliary devices, they must request authorization from the organizers at least 7 days before the event, who will evaluate each case and communicate their decision.

The following day will be divided into three parts. In the morning, the captains of the top 8 teams will be called to give a presentation on one of the services addressed the previous day. These presentations will be evaluated by a mixed jury composed of site representatives, sponsor company professionals, and institutional representatives and will contribute to the final score.

Mid-day will feature a recruitment fair where participants can meet and interact with professionals from the sponsor companies of the project.

In the afternoon, the award ceremony will take place, attended by the organizers, national and international authorities, and representatives of leading cybersecurity companies sponsoring the project.

The fourth and last day is dedicated to the fourth edition of the CyberChallenge.IT Workshop, whose participation is on a voluntary basis, during which a series of participants, ex-participants and invited speakers will hold a series of practical seminars relating to the world of CTF competitions. The related call-for-presentation (CFP) is expected to be published this month of May.

Further details on the competition modalities and the conduct of the event will be communicated later.

International competitions

The best participants of the CyberChallenge.IT project can compete to become part of TeamItaly: the Italian National Cyberdefender Team representing Italy in international competitions.

In Europe, ENISA organizes the European Cybersecurity Challenge (ECSC) annually to foster the exchange of knowledge and talents across Europe. The competition is open to all European countries, and each nation participating in the event competes with a team of 10 players aged between 14 and 25 years.