Executive Summary
The United States faces a growing number of threats in the cyber domain, from security breaches to economic espionage and ransomware attacks, that harm both private and public entities and disrupt critical services. The cost to the U.S. economy resulting from cyberattacks is steep, and attributing, responding to, and remedying the damage is an ongoing challenge for the government and U.S. companies. In this environment, well-trained cyber talent is a strategic national asset. Today, however, nearly six hundred thousand cybersecurity positions remain vacant across the public and private sectors. To partially address this need, the National Institute of Standards and Technology has partnered with academia and the private sector to form the National Initiative for Cybersecurity Education (NICE). This initiative has highlighted the urgent need to build and develop a workforce capable of protecting U.S. public services, industries, and citizens against cyber threats. One of the initiative’s components is to use cyber competitions as a way to help its participants develop cyber skills in simulated, but realistic situations.
Cybersecurity competitions extend to the high school level––which, as this report suggests, may be an underutilized area for developing cybersecurity talent earlier in talent development pipelines. In 2021, only 11,000 students participated in the nation’s largest cybersecurity competition for high school students, which is only 0.07 percent of high schoolers. This is similar to the low percentage of students enrolled in Advanced Placement Computer Science courses, which hovers around 1 percent even after recent significant growth in student participation. For reference, the Centers for Disease Control and Prevention reports that nearly 57 percent of high school students participate in at least one team sport.
If the United States aims to outcompete other countries in critical emerging technologies, it will need a well-educated and thriving cyber talent pool. China, for example, has wasted little time in mandating both information technology education and artificial intelligence coursework at the high school level. In fact, China has even begun integrating Python, a computer programming language, into its Gaokao exam, the nationally standardized college entrance exam taken by roughly ten million Chinese students each year. When preparing the next generation of cyber experts, it becomes increasingly clear that today’s U.S. educational efforts are falling short.
To better understand these challenges, this report examines U.S. high school cybersecurity competitions, their reach, and their impact on students’ educational and professional development. Cybersecurity competitions could play a valuable role in developing future cyber practitioners, but can they be expanded to more schools and individuals? To answer this question, this report takes a close look at two of the largest and well-known U.S. high school cybersecurity competitions, finding that a cluster of schools repeatedly dominate these competitions. These same schools are often performing above the U.S. national averages when comparing factors like educational offerings, student proficiency, and socioeconomic status. To gain a sense of how these factors might affect student performance, we interviewed 12 coaches and mentors from 10 high schools.
Overall, our research presents three main observations. First, the availability of computer science (CS) and related coursework is not necessarily tied to successful student participation in competitions. At the same time, however, a second finding reveals that educator or professional mentorship is necessary to support student interest and participation in cybersecurity competitions. With a shortage of K-12 CS teachers, this may be one of the toughest challenges. Finally, support for local and regional cyber competitions can help level an unbalanced national playing field and increase participation rates.