Rules
Online registrations
November 3, 2025 - December 12, 2026
From November 18, 2025, to December 12, 2026, it will be possible to register for the sixth edition of the Italian Cybersecurity Olympics. The only requirements for registration are:
- Being enrolled for the 2025/2026 school year in a secondary school that has joined the CyberHighSchools program
- Being under 22 years old as of December 31, 2025, meaning being born in 2003 or later
- Completing the registration form by December 12, 2026, and confirming your email. For those who participated in a previous edition, it is sufficient to confirm their participation with the existing account
Registration must be carried out independently by each student interested in participating in the program.
If your school has not yet joined the CyberHighSchools program, you can involve a teacher to have the school register for free at this link. There are no limits on the number of students registered from the same school.
School selection
December 13, 2025
Saturday, December 13, 2025, the first phase of the Italian Cybersecurity Olympics selection will take place online. This phase will consist of a multiple-choice test with 12 questions and 90 minutes duration, to be completed individually by selecting a start time within a 4-hour window from 15:00 to 19:00. The end of the test is scheduled at 19:00, no matter when you start it: people who start it after 17:30 will have less than 90 minutes to complete it. Participants can complete the test independently from home on any personal device without support from the school. All participants will receive, the day before the test, the link and information to complete the test at their registration email address.
The questions will cover topics such as logic, mathematics (up to the first two years of secondary school), algorithms, and basic computer science. Knowledge of specific programming languages or advanced cybersecurity topics is not required to pass this phase. Past tests are available, with solutions, in the training material section of the website.
In this phase, each correct answer is worth 1 point, up to a maximum of 12, each unanswered question is worth 0.25 points, while each wrong answer is worth 0 points.
The following are admitted to the next phase:
- All the previous yeas' medalists, provided they still meet all the participation requirements, indipendently from their participation and results in the school selection, who express their willing to participate by successfully registering to the new edition of the program
- The top scorer from each school, if they scored at least one correct answer
- The next highest scorers, if they scored above the national average, will be considered candidates for the next phase, up to a maximum number of students per school. The maximum number of students per school will be defined before the school selection and inserted in this page.
The national average is calculated based on all participants who scored above 0. In the case of a tie, the ranking will be ordered by age, with preference given to younger participants. In the event of a further tie (in score and date of birth), all tied students will be admitted to the next phase.
In cases of suspected cheating or collaboration among participants, organizers reserve the right to disqualify all involved students and report their names to their respective schools.
Regional selection
March 2026
During March 2026, the second phase of the Italian Cybersecurity Olympics selection will take place. This phase will consist of a "Capture The Flag" (CTF) competition in Jeopardy format, lasting 4 hours. This type of competition includes a series of practical problems (called challenges) to be solved using programming languages and/or specific tools. Each challenge will correspond to a hidden string, called a flag, through which students can demonstrate they have correctly solved the exercise. Participants will be presented with 10 to 12 challenges, each worth between 50 and 300 points. The leaderboard will be displayed anonymously in real-time throughout the competition, allowing each student to track their position.
The challenges will cover topics such as programming, network security, cryptography, web security, and software security. In the training material section of the Olympics website, there are links to introductory lessons on all these topics, while the training portal offers over 300 challenges for practice, ranging from basic to advanced levels on the various topics covered. The portal also includes past tests and simulations. Commented solutions for the 2022, 2023, 2024 and 2025 regional selection challenges are also available in the training material section.
In cases of suspected cheating, students may be required to present the procedure and/or code used to reach their solution at the end of the competition. As in the previous phase, organizers reserve the right to exclude and report all involved students to their schools.
The final leaderboard will be ordered by:
- total points earned
- the time of the last correct flag submission, with preference given to earlier submissions
Rules to access the next phase will be defined at a later point and will be inserted in this page.
National competition
April, 2026
The national finals of the 2026 Italian Cybersecurity Olympics will be held in April 2026. Like the regional selection, this competition will be an individual Jeopardy-style CTF, but it will have a total duration of 7 hours. Participants will be presented with 12 challenges of varying difficulty on the same topics as the regional selection.
All those selected from the regional selection, as well as up to one teacher from each finalist's school, are invited to the national competition. For all event participants, food and accommodation will be provided for the entire duration of the event, with management and organization fully handled by the organizers. Travel must be arranged independently by all participants and will be reimbursed after the event according to the guidelines communicated to the finalists.
On the late afternoon of the first day, a brief simulation will be held to test the competition room, connectivity, and gaming platform.
The participants will take the test using their own laptops, which they must bring to the competition venue. Internet connection will be provided by the organizers via Wi-Fi or Ethernet cables. In general, additional devices or accessories other than a mouse, keyboard, and laptop charger will not be allowed; specifically, the use of additional screens will not be permitted. If a participant needs to use auxiliary devices, they must request authorization from the organizers at least 7 days before the event. The organizers will evaluate such requests on a case-by-case basis and communicate their decision.
As in previous phases, the organizers reserve the right to exclude from the competition and report to the respective schools all students involved in cases of suspected cheating or unauthorized external assistance.
Unlike the regional selection, the challenges of the national competition will not have predefined scores. Instead, a dynamic scoring system will be adopted: each challenge will start at 500 points at the beginning of the competition, and its score will adjust automatically as the challenge is solved. At the end of the competition, challenges solved by more competitors will be worth fewer points, down to a minimum of 50, while the least solved ones will be worth more points, not exceeding 500 points. The score (in points) of the various challenges will be updated in real time and made available to participants throughout the competition.
The competition leaderboard will remain visible only for the first 5 hours, while in the final 2 hours, participants will only know their own score. At the end of the competition, the final ranking will be drawn up according to the same criteria as the regional selection but will be kept secret until the award ceremony the following day. In the hours after the competition, the organizers will give a brief presentation of the problems and their solutions.
On the following day, the award ceremony will take place. Along with the organizers, national and international authorities and representatives from leading cybersecurity companies sponsoring the program will attend. During the ceremony, the top 40 competitors will be awarded, divided as follows:
- 1st to 5th place: gold medal
- 6th to 15th place: silver medal
- 16th to 40th place: bronze medal
International competitions
The top participants in the Italian Cybersecurity Olympics may join TeamItaly: the Italian Cyberdefender Team, and represent Italy in international competitions, such as the International Cybersecurity Olympiads, held in Sydney in 2026, and the European Cybersecurity Challenge (ECSC).
ECSC is organized by ENISA every year, to promote the exchange of knowledge and talent across Europe. The competition is open to all European countries, with each nation competing with a team of 10 players aged 14 to 25.