AP® Cybersecurity · beyond the classroom
Cybersecurity opportunities for high school students, 2026-27
Many "student" cyber internships are really for university students or citizens of one country. This page sorts what high school students can actually use: free training, competitions, programs and projects, each with its limits stated first.
Every entry was checked on the program's own website or a host's page on November 11, 2026. Deadlines and rules change, so confirm on the official page before you apply, pay or share personal information. LockInCS is not connected to any program listed here.
- Open to most students broadly available; local age rules may still apply
- Limits apply real, but limited by age, country, citizenship, school or location
- Watch for 2027 runs each year; the next dates are not posted yet
Build skills now: free and open all year
No application needed. These are the best first step for most students, wherever they live.
picoCTF practice (picoGym)
Open to most studentsCarnegie Mellon University
- Who
- Anyone 13 or older; under 18 needs parent or guardian consent
- Cost
- Free
- Status
- Practice challenges are open all year
Tip: Start with general skills, then cryptography, forensics and web exploitation. Keep a learning log of what each challenge taught you.
Cisco Networking Academy
Open to most studentsCisco
- Who
- Individual learners and schools worldwide
- Cost
- Free self-paced courses
- Status
- Available now
Tip: Go in order: networking basics, then Introduction to Cybersecurity, then a defense or junior analyst path. It matches Unit 3 of the course well.
IBM SkillsBuild
Open to most studentsIBM
- Who
- Learners from age 13, including high school students
- Cost
- Free
- Status
- Available now, in many languages
Tip: Digital badges help most when you pair them with a project that shows what you can do.
LinuxLearningLabs
Open to most studentsA small independent open-source project
- Who
- Anyone with a browser; no sign-up needed when we checked
- Cost
- Free
- Status
- Available now: dozens of guided labs with automatic checking
Tip: Practice the Linux commands from Unit 5 in a simulated shell: the file permission labs (chmod in both notations), listening ports, a server firewall and reading system logs.
Hack The Box
Limits applyHack The Box
- Who
- Users aged 13 to 17 need a signed parent or guardian consent form
- Cost
- Free tier and paid plans
- Status
- Available now
Tip: Use the beginner labs and Academy modules before harder offensive content. Every lab is a closed, authorized environment; keep it that way.
Competitions
Strong evidence of skill. Many are team-based or chosen by country.
picoCTF annual competition
Watch for 2027Carnegie Mellon University
- Who
- Teams of up to 5, age 13 or older. Prize categories have their own rules (for example, U.S. middle and high school students); everyone else can play for fun.
- Cost
- Free
- Status
- The 2026 competition ran March 9 to 19, 2026. The 2027 date is not announced yet.
Tip: Practice in picoGym now so you are ready when registration opens.
CyberPatriot
Limits applyAir & Space Forces Association
- Who
- Middle and high school teams with an adult coach
- Cost
- Registration fee per team; check the official site for fee waivers
- Status
- Registration for the 2026-27 season closed on October 1, 2026. Ask a teacher about coaching a team for next season.
Tip: Teams secure virtual computers against a clock: real practice for Units 3 and 4. Outside the United States, check eligibility first.
European Cybersecurity Challenge (ECSC)
Limits applyEuropean Union Agency for Cybersecurity (ENISA)
- Who
- National teams of players aged 14 to 24, chosen through each country's own competition
- Cost
- Depends on your country
- Status
- The 2026 final was in Bochum, Germany, October 12 to 16, 2026. Watch your country's national qualifier for 2027.
Tip: You cannot sign up for the final directly. Find your country's national cyber competition.
CyberFirst
Limits applyNCSC, the UK government's National Cyber Security agency
- Who
- Students in the United Kingdom; courses for ages 11 to 17
- Cost
- See the NCSC page
- Status
- Ongoing; check the NCSC page for current courses and competitions
Tip: A strong option for UK students, but not a worldwide program.
Work experience and scholarships (United States)
Real high school programs, but with citizenship and location limits. The limits are listed first so you can skip what does not fit.
NSA High School Work Study
Limits applyU.S. National Security Agency (NSA)
- Who
- U.S. high school juniors who live near NSA headquarters in Maryland or a listed field site, and who will join a school work-experience program in senior year
- Cost
- Paid, part-time
- Status
- Applications open each September 1; check the page for the closing date
Tip: NSA jobs require U.S. citizenship. Positions vary by site and are not all in cybersecurity.
NSA Stokes Educational Scholarship
Limits applyU.S. National Security Agency (NSA)
- Who
- U.S. citizens in senior year planning a qualifying major such as computer science or cybersecurity; minimum test scores and grade point average (GPA) apply
- Cost
- Up to $30,000 a year toward tuition and fees, plus paid summer work
- Status
- Applications open each September 1; check the page for the closing date
Tip: You must then work for NSA for at least 1.5 times the length of your study. Read the terms before you apply.
CISA Pathways internships
Limits applyU.S. Cybersecurity and Infrastructure Security Agency (CISA)
- Who
- U.S. citizens aged 16 or older, enrolled in school, with at least a 2.5 GPA
- Cost
- Paid federal positions
- Status
- Openings depend on vacancies; check each job posting for the education level it accepts
Tip: A real pathway, not a guaranteed summer job. Many postings target college students; check each posting's education level.
Summer programs
Good for hands-on learning. Dates and eligibility change every year.
GenCyber camps
Watch for 2027Host colleges and universities, funded by a U.S. federal program (one host page linked)
- Who
- K to 12 students (and teachers) in the United States; each camp sets its own grades and area
- Cost
- Camps have historically been free for students
- Status
- At least one host has announced a June 2027 camp; most post dates in winter or spring
Tip: Search for a host near you and check its own page for dates and deadlines.
NYU Tandon Cyber Security for Computer Science (CS4CS)
Watch for 2027New York University (NYU) Tandon School of Engineering
- Who
- Students in 10th or 11th grade living in listed New York and New Jersey areas
- Cost
- Free (full scholarship)
- Status
- The 2026 program ran July 13 to August 7. The 2027 dates are not posted yet; applications have opened in January.
Tip: Four weeks of capture the flag (CTF) challenges, cryptography, forensics and scripting.
Free tools professionals use
Real tools you can try now. Each one connects to a part of the course.
- CyberChefA browser tool for encoding, decoding, hashing and encrypting data, published by the UK's intelligence and security agency. Try hashing the same text twice, then change one letter and compare.Open CyberChef
- Have I Been PwnedShows whether an email address appeared in a known data breach. It is the reason password reuse and credential stuffing matter: one leak can unlock every account that shares the password.Open Have I Been Pwned
- NmapThe best-known port scanner: it finds hosts and open ports. Use it only on your own devices or a practice lab; scanning other people's networks without permission can be illegal.Open nmap.org
No program nearby? Build evidence anyway
A short project write-up shows more than a screenshot or a badge. For each one, show the question, your method, the evidence, your conclusion and what you would do differently. Each project links to the lesson it practices.
- Investigate an authentication logTake a made-up login log, find failed-login patterns, password spraying or impossible travel, and write a one-page incident summary.Lesson: 4.4 Detecting Attacks on Devices
- Harden your home networkList the devices on your own network, change default credentials, separate guest and smart devices, and explain each trade-off.Lesson: 3.3 Network segmentation
- Threat model a pretend school appInvent a learning platform. Name its assets, adversaries and weak spots, then propose layered controls. Never test a real school system.Lesson: 2.1 Cyber Foundations
- Build a phishing workbookCollect simulated messages and mark every warning sign, the social engineering principle used and the right response.Lesson: 1.1 Social engineering
- Keep a CTF learning portfolioFor each practice challenge, write the concept, the tool, your mistakes and what you would spot next time. Never publish answers to live competitions.Lesson: Glossary
- Write a small security toolA short Python program that checks passwords against a policy, hashes files to detect changes, or counts failed logins in a log.Lesson: 5.6 Detecting attacks on data
A plan for the rest of 2026-27
- November to December 2026Finish one portfolio project from the list above. Publish only cleaned, made-up data.
- January to February 2027Move from courses to challenges: picoGym, Hack The Box beginner labs (13 to 17 with a guardian consent form). Track the skills you used, not the badge count.
- March to April 2027Check the official pages for picoCTF, GenCyber hosts, CS4CS and your national competition.
- May 2027AP® Cybersecurity Exam. Then gather your evidence: a one-page resume, short project write-ups and any competition results.
- Summer 2027Go deeper in one area: log analysis, networking, forensics, secure software or ethical hacking in authorized labs.
- September 2027Eligible U.S. students: NSA Work Study and Stokes applications open September 1. Ask a teacher about a CyberPatriot team before registration closes.
Stay legal and safe
- Practice only on CTF platforms, practice labs, deliberately vulnerable machines, your own devices, or systems whose owner has given you written permission for exactly what you plan to do.
- Never scan, probe or "test" a school, employer or public system without written permission, even to learn or to help.
- Under 18? Read each platform's age rules and complete any parent or guardian consent before you sign up.
- Bug bounty programs are not a free pass to hack. Each one defines its own scope, banned techniques and age rules; a supervised lab is a better first step.
- Keep real passwords, personal data, private logs and school information out of anything you publish. Use made-up or cleaned data.
The skill is not "can I break it?" It is "can I understand the risk, stay within permission, keep the evidence, explain it clearly and make things more secure?"
Before you apply: a 60-second check
Use it every time you see a post about a "cyber internship for students".
- Student level. Does the official page say high school, or does "student" really mean university?
- Age. Is there a minimum age, such as 13, 16 or 18, or a parent consent rule?
- Citizenship and residence. Does it require a passport, residence or a school in one country or city?
- Location. Online, in person or hybrid? Is travel paid for?
- Current cycle. Are the dates for this school year, or is it an old page that search engines still show?
- Cost. Free, scholarship, paid position or a fee?
- Supervision. Do you need a parent, teacher, coach or school to sign up?
- What you leave with. A project, skills, a result, feedback or a credential, or just attendance?
- Scope and safety. If it involves testing systems, is the environment clearly authorized?
- Official source. Can you confirm all of this on the organization's own website before you give any personal information?
Questions students ask
Can high school students get cybersecurity internships?
A few, but most have strict limits. U.S. federal programs such as the NSA High School Work Study and CISA Pathways require U.S. citizenship and often living near a site. Most students build experience through free courses, capture the flag (CTF) competitions and portfolio projects instead.
What is the best free cybersecurity practice for high school students?
Year-round CTF practice such as picoGym, free courses from Cisco Networking Academy or IBM SkillsBuild, and for students 13 to 17 with guardian consent, Hack The Box beginner labs. Pair them with one documented project.
Do I need AP® Cybersecurity to do CTFs or competitions?
No. Most competitions have no course requirement. The course helps, because CTFs use the same ideas: networks, authentication, cryptography and logs.
Is it legal to practice hacking?
Only on systems you own or are clearly authorized to test, such as CTF platforms, practice labs and deliberately vulnerable machines. Scanning or testing a school, employer or public system without written permission is illegal in many places, even if you mean well.