Our history

It started in a classroom

CPTC started small, in a classroom at the Rochester Institute of Technology. Bill Stackpole, a professor of defensive and offensive security, saw a gap between the experiences that his students were getting in both the classroom and existing competitions. He wanted to close to set his students up for success after graduation. So he started calling his colleagues and friends with an idea for a competition.

Taking that classroom idea, he enlisted the help of many dedicated volunteers, spanning industry professionals, academics, and sponsors, who worked tirelessly to give that same experience to all students interested in the computing security field. From these humble beginnings the competition volunteers now generate a fictitious company annually for students to perform a professional assessment against.

Students are expected to work "in-character" as consultants for a consulting firm that is assessing the organization's security posture. Volunteers also act in-character as the client, both virtually and in-person, to provide interactions (via email, telephone, and live) that are similar to those a consultant would experience on a daily basis. This also creates a highly dynamic environment that reacts to the team's actions. Teams are scored on not just the technical aspects of the engagement, but the experience they provide to the client, the report and presentation they deliver to their client, and the professionalism they demonstrate throughout the engagement.

Growing into a global program

The first few years the competition was focused regionally, with schools from the Northeastern United States, but has grown to include schools from around the world across a set of global regions. These students gain real-life experience that benefits their eventual work environments. During global finals, competitors have discovered zero-days in commercial technologies, registered them as CVEs, and even designed patches for the most critical vulnerabilities. Many sponsors are also able to identify high quality candidates for internships, co-ops, and full time employment as they watch and interact with them in situations similar to those they would experience at their own organization.

Becoming independent

To sustain and grow the competition for the long term, CPTC is now operated by an independent 501(c)(3) nonprofit, Collegiate Penetration Testing Competition Ltd., separate from RIT. This independence lets the competition continue to grow and serve the cybersecurity community, while continuing with the strong foundation that has been built over the years.