Rules
Online registrations
November 3, 2025 - December 12, 2026
From November 18, 2025, to December 12, 2026, it will be possible to register for the sixth edition of the Italian Cybersecurity Olympics. The only requirements for registration are:
- Being enrolled for the 2025/2026 school year in a secondary school that has joined the CyberHighSchools program
- Being under 22 years old as of December 31, 2025, meaning being born in 2003 or later
- Completing the registration form by December 12, 2026, and confirming your email. For those who participated in a previous edition, it is sufficient to confirm their participation with the existing account
Registration must be carried out independently by each student interested in participating in the program.
If your school has not yet joined the CyberHighSchools program, you can involve a teacher to have the school register for free at this link. There are no limits on the number of students registered from the same school.
School selection
December 13, 2025
Saturday, December 13, 2025, the first phase of the Italian Cybersecurity Olympics selection will take place online. This phase will consist of a multiple-choice test with 12 questions and 90 minutes duration, to be completed individually by selecting a start time within a 4-hour window from 15:00 to 19:00. The end of the test is scheduled at 19:00, no matter when you start it: people who start it after 17:30 will have less than 90 minutes to complete it. Participants can complete the test independently from home on any personal device without support from the school. All participants will receive, the day before the test, the link and information to complete the test at their registration email address.
The questions will cover topics such as logic, mathematics (up to the first two years of secondary school), algorithms, and basic computer science. Knowledge of specific programming languages or advanced cybersecurity topics is not required to pass this phase. Past tests are available, with solutions, in the training material section of the website.
In this phase, each correct answer is worth 1 point, up to a maximum of 12, each unanswered question is worth 0.25 points, while each wrong answer is worth 0 points.
The following are admitted to the next phase:
- All the previous yeas' medalists, provided they still meet all the participation requirements, indipendently from their participation and results in the school selection, who express their willing to participate by successfully registering to the new edition of the program
- The top scorer from each school, if they scored at least one correct answer
- The next highest scorers, if they scored above the national average, will be considered candidates for the next phase, up to a maximum number of 15 students per school. The exact list of people who advance to the next phase will be published in the weeks following the school selection.
The national average is calculated based on all participants who scored above 0. In the case of a tie, the ranking will be ordered by age, with preference given to younger participants. In the event of a further tie (in score and date of birth), all tied students will be admitted to the next phase.
In cases of suspected cheating or collaboration among participants, organizers reserve the right to disqualify all involved students and report their names to their respective schools.
Regional selection
March 17 2026
The second selection phase for the Italian Cybersecurity Olympiad will be held on Tuesday, March 17, 2026. This phase will consist of a "Capture The Flag" (CTF) competition in Jeopardy format, lasting 4 hours. This type of competition includes a series of practical questions (called challenges), to be solved using programming languages and/or specific tools. Each challenge will require obtaining a hidden string, called a flag, through which students can demonstrate that they have correctly solved the exercise. Students will be offered between 10 and 12 challenges, each with a score ranging from 50 to 300 points. The ranking will be displayed, anonymously, in real time for the entire duration of the competition, so that each student can always check their position.
Unlike previous editions, this phase of the program will take place in person at some territorial venues identified from a series of candidate schools. Participants admitted to the regional selection will be individually assigned a territorial venue, which will be published on the personal profile page and communicated via email.
Participants admitted to this phase will be asked to physically arrive at the assigned territorial location well in advance, on the morning of Tuesday, March 17, 2026. The test will take place simultaneously for all venues and for all participants from 10:00 am to 2:00 pm.
Participants will be asked to bring an identification document and a personal laptop with its charger to the territorial venue. In general, additional devices or accessories other than the mouse, keyboard, and PC charger will not be permitted; in particular, the use of additional screens will not be permitted. If a participant has specific needs for the use of auxiliary devices, they must request authorization from the organizers at least 14 days before the event. The organizers will evaluate each case and communicate their decision.
Each venue will provide participants with a dedicated workstation, a power connection, and wired or wireless internet connectivity.
Further information on logistics and specific participation methods will be provided later by the individual local venues.
Transportation to and from the local venue must be arranged independently, possibly with the assistance of a designated teacher or additional companion. Transportation costs will not be reimbursed and are the responsibility of the participant or their institution.
The challenges will focus on programming, network security, cryptography, web security, and software security. The teaching materials section of the Olympics website contains links to introductory lessons on all these topics, while the training portal offers more than 300 challenges for training, from basic to advanced levels, on the various topics covered. The same portal also contains tests and simulations from previous years. The commented solutions to the challenges of the 2022, 2023, 2024, and 2025 regional selections are also available in the teaching materials section.
In case of suspected copying, students may be asked, at the end of the competition, to show the procedure and/or code used to arrive at the solution. As with the previous phase, the organizers reserve the right to exclude from the competition and report to their respective schools any students involved in these cases.
The final ranking will be ordered by:
- number of points obtained
- time of the last correct flag sent, giving priority to those who reached the solution first
Advancing to the final phase are:
- the first place winner from each region, if their score is higher than the national average
- the next place winners with scores higher than 0 points, for a total of a maximum of 100 students
Just like the previous phase, the national average will be calculated on the students who have scored at least one point. If the number of 100 students with scores higher than zero is not reached, there will be no repechages among the students who have obtained 0 points.
National competition
April 17 - 19, 2026
The national final of the Italian Cybersecurity Olympics 2026 will be held from 17 to 19 April 2026 at the Grand Hotel Salerno.. Like the regional selection, this competition will be an individual Jeopardy-style CTF, but it will have a total duration of 7 hours. Participants will be presented with 12 challenges of varying difficulty on the same topics as the regional selection.
All those selected from the regional selection, as well as up to one teacher from each finalist's school, are invited to the national competition. For all event participants, food and accommodation will be provided for the entire duration of the event, with management and organization fully handled by the organizers. Travel must be arranged independently by all participants and will be reimbursed after the event according to the guidelines communicated to the finalists.
On the late afternoon of the first day, a brief simulation will be held to test the competition room, connectivity, and gaming platform.
The participants will take the test using their own laptops, which they must bring to the competition venue. Internet connection will be provided by the organizers via Wi-Fi or Ethernet cables. In general, additional devices or accessories other than a mouse, keyboard, and laptop charger will not be allowed; specifically, the use of additional screens will not be permitted. If a participant needs to use auxiliary devices, they must request authorization from the organizers at least 7 days before the event. The organizers will evaluate such requests on a case-by-case basis and communicate their decision.
As in previous phases, the organizers reserve the right to exclude from the competition and report to the respective schools all students involved in cases of suspected cheating or unauthorized external assistance.
Unlike the regional selection, the challenges of the national competition will not have predefined scores. Instead, a dynamic scoring system will be adopted: each challenge will start at 500 points at the beginning of the competition, and its score will adjust automatically as the challenge is solved. At the end of the competition, challenges solved by more competitors will be worth fewer points, down to a minimum of 50, while the least solved ones will be worth more points, not exceeding 500 points. The score (in points) of the various challenges will be updated in real time and made available to participants throughout the competition.
The competition leaderboard will remain visible only for the first 5 hours, while in the final 2 hours, participants will only know their own score. At the end of the competition, the final ranking will be drawn up according to the same criteria as the regional selection but will be kept secret until the award ceremony the following day. In the hours after the competition, the organizers will give a brief presentation of the problems and their solutions.
On the following day, the award ceremony will take place. Along with the organizers, national and international authorities and representatives from leading cybersecurity companies sponsoring the program will attend. During the ceremony, the top 40 competitors will be awarded, divided as follows:
- 1st to 5th place: gold medal
- 6th to 15th place: silver medal
- 16th to 40th place: bronze medal
International competitions
The top participants in the Italian Cybersecurity Olympics may join TeamItaly: the Italian Cyberdefender Team, and represent Italy in international competitions, such as the International Cybersecurity Olympiads, held in Sydney in 2026, and the European Cybersecurity Challenge (ECSC).
ECSC is organized by ENISA every year, to promote the exchange of knowledge and talent across Europe. The competition is open to all European countries, with each nation competing with a team of 10 players aged 14 to 25.