Carnegie Mellon CyLab

What Carnegie Mellon CyLab does

Carnegie Mellon CyLab is the university-wide security and privacy institute at Carnegie Mellon University, founded in 2003, that coordinates research and education across all CMU departments through 40 core and 120+ affiliated faculty. The institute conducts foundational and applied research spanning privacy-enhancing technologies, usable security, IoT security, formal verification, AI/ML security, and cryptographic systems, producing 400+ peer-reviewed studies over the past five years and contributing open-source artifacts such as the EverCrypt cryptographic library (shipped in the Linux kernel) and a 100 Gbps intrusion detection system. CyLab's principal service and educational outputs include the CyLab Security Academy platform serving 1M+ registered users, the picoCTF competition (the world's largest hacking competition), the IoT Security and Privacy Label Generator, and the Peekaboo smart-home privacy architecture.

Its revenue mechanics are characteristic of a university research institute rather than a commercial software company. Funding flows from federal research grants (NSF, DARPA), an industry sponsorship consortium — most visibly the Future Enterprise Security Initiative anchored by AWS, Aryaka, Bosch, Cisco, Microsoft, Nokia Bell Labs, PNC, and VMware — philanthropic gifts (e.g., Craig Newmark Philanthropies), and intramural educational programming. Outputs are distributed primarily through open-access academic publications, open-source software releases, regulatory engagement (FTC, FCC, California AG, White House OSTP), and the CyLab Security Academy platform. Key stakeholder segments include students and educators, government policymakers, large enterprise technology sponsors, and consumers who benefit from downstream privacy-labeling frameworks adopted in jurisdictions such as California (CCPA) and federal IoT standards.

Name

Carnegie Mellon CyLab

Legal name

Carnegie Mellon University CyLab Security & Privacy Institute

Website

https://cylab.cmu.edu

Company type

Private

Founded year

2003

Operating status

Operating

Headcount range

5,001–10,000 employees

Short description

Carnegie Mellon CyLab is the university-wide security and privacy research and education institute at Carnegie Mellon University, coordinating 40 core and 120+ affiliated faculty. It produces peer-reviewed research, runs the picoCTF and CyLab Security Academy platforms, and shapes privacy regulation through direct government engagement.

Ownership category

akta.pro rank

Product category

Cybersecurity Research & Education

akta.pro primary industry

Secure Software & DevOps Awareness (Secure Coding Basics) (EDABAGAN)

akta.pro secondary industry

Cybersecurity Infrastructure for Campuses (Firewalls, SIEM tooling, Endpoint Mgmt) (EDAEAHAH)

Keywords

• Cybersecurity research
• Privacy research
• Security education
• IoT security
• Usable privacy

Headquarters

HQ city

Pittsburgh

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure

Revenue model

1. Government Grants and NSF Funding: Federal research funding from National Science Foundation, DARPA, and other government agencies supporting specific research initiatives.
2. Industry Sponsorship Programs: Corporate sponsors provide funding for research initiatives including Future Enterprise Security Initiative and Secure and Private IoT Initiative. Sponsors participate in proposal reviews and benefit from research outcomes.
3. Philanthropic Gifts: Donations from foundations and individuals to support research, education, and fellowship programs.
4. Educational Programs: CyLab Security Academy and picoCTF competitions provide cybersecurity education. picoCTF is the world's largest hacking competition.

Go-to-market motion1 record

Distribution channels5 records

Marketing channels10 records

Core offering

Carnegie Mellon CyLab is the university-wide security and privacy research institute at Carnegie Mellon University that coordinates and conducts cybersecurity and privacy research across all university departments. It delivers educational programs through CyLab Security Academy (1M+ registered users), picoCTF (world's largest hacking competition), and produces open-source tools including IoT Security and Privacy Label Generator, Peekaboo smart home privacy architecture, and the EverCrypt cryptographic library. The institute also engages in public policy work and industry-sponsored research initiatives.

Product overview

Carnegie Mellon CyLab is a university-wide security and privacy research institute coordinating research and education across all CMU departments. The organization operates as a collection of research laboratories and centers including the Usable Privacy and Security (CUPS) Laboratory, Biometrics Center, CHIMPS Lab, and SynergyLabs. Key educational products include CyLab Security Academy (hosting global CTF competitions for 1M+ users), picoCTF (world's largest hacking competition), and the IoT Assistant mobile app. CyLab also develops practical tools such as the free IoT Security and Privacy Label Generator, Peekaboo smart home privacy architecture, and Broadband Nutrition Label designs. Research activities span privacy-enhancing technologies, AI security, IoT security, usable security, cryptography, and public policy engagement.

Differentiator

Problem solved

Functional benefit

Products and services

• CyLab Security Academy Year-round educational platform hosting cybersecurity competitions (CTF) and learning modules, serving over 1 million registered users globally across cybersecurity, AI security, and blockchain security.
• picoCTF World's largest hacking competition hosted by Carnegie Mellon University, featuring cybersecurity challenges in reverse engineering, forensics, web exploitation, and binary exploitation for middle/high school students through professionals.
• IoT Assistant Mobile application and digital infrastructure that informs users about IoT technologies around them and what data they collect, accompanied by a cloud-based portal allowing IoT owners to register devices.
• IoT Security and Privacy Label Generator Free web-based generator allowing IoT device manufacturers to create product-specific layered security and privacy labels based on consumer-tested research.
• Peekaboo Privacy-sensitive architecture for smart home apps that ensures only essential data declared by developers is shared, mediated through an in-home hub with user controls and third-party auditing capabilities.
• PrivacyGrade Research tool analyzing Android apps' data collection practices and helping users understand privacy implications of mobile applications.
• Broadband Nutrition Labels Consumer-tested layered design system for broadband internet service labels showing cost, speed, reliability, and performance metrics, including summary and detailed versions with standardized, computer-readable format for third-party comparison tools.
• Mobile App Privacy Compliance Tool Tool developed by Norman Sadeh's research group for evaluating mobile app privacy compliance, piloted by California Attorney General's Office in 2016.

Quantifiable outcome

• Carnegie Mellon ranked #1 in U.S. News Undergraduate Cybersecurity Program for 5 consecutive years
• +5 more outcomes

Named customers6 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability8 records

Feature5 records

Partnerships

One partnership is on record.

• University of Michigan School of InformationcoreStrategic or Co-development PartnerCollaborative research partnership on privacy icon design for California CCPA, resulting in the official privacy opt-out icon adopted by California Office of the Attorney General.

Scale indicators14 records

Recent moves8 records

Expansion highlights6 records

Direct peers

• UC Berkeley Center for Long-Term Cybersecurity (CLTC): Berkeley CLTC is a university-based cybersecurity research center focused on the human side of cybersecurity, including usable security, AI governance, and policy. Directly comparable to CyLab in academic positioning, public policy engagement, and interdisciplinary research scope.
• SANS Institute: SANS Institute is a private cybersecurity training and certification organization running the largest commercial cybersecurity education portfolio, including CTF-style competitions (SANS Holiday Hack). Comparable to CyLab in cybersecurity workforce development, competition hosting, and employer-recognized credentialing.
• MIT Computer Science and Artificial Intelligence Laboratory (CSAIL): MIT CSAIL is a top-tier university computer science research laboratory that conducts fundamental and applied cybersecurity research across cryptography, systems security, and AI safety. Comparable to CyLab in mission, faculty scale, conference publication output, and industry/government engagement.
• Stanford Computer Science / Stanford Security Lab: Stanford's Computer Science department houses the Stanford Security Lab, which conducts research in usable security, applied cryptography, and systems security. Comparable to CyLab in academic standing, industry sponsorship model, and influence on Silicon Valley cybersecurity practice.
• Georgia Tech Institute for Information Security & Privacy (IISP): Georgia Tech IISP is a university-wide cybersecurity institute coordinating research across multiple schools and engaging with industry and government. Comparable to CyLab in institute structure, faculty breadth, and emphasis on both technical research and workforce development.
• Purdue Center for Education and Research in Information Assurance and Security (CERIAS): Purdue CERIAS is one of the longest-standing university cybersecurity research centers, with a similar interdisciplinary mandate spanning technical research, education, and policy. Comparable to CyLab in mission, multi-school coordination model, and external partnership program.

Broad incumbents

• RAND Corporation: RAND Corporation is a large policy research organization that conducts significant work on cybersecurity policy, AI governance, and critical infrastructure protection. Comparable to CyLab in policy research influence and government engagement, though broader in non-cyber subject areas.
• SRI International: SRI International is an established independent research institute conducting cybersecurity, AI, and computer science research with government and commercial sponsors. Comparable to CyLab in research scope and government contracting, but with a for-profit structure and broader technology portfolio.

Emerging players

• TryHackMe: TryHackMe is a venture-backed cybersecurity education platform offering gamified learning paths, CTF-style rooms, and employer-recognized credentials with several million registered users. Comparable to CyLab Security Academy and picoCTF in delivering hands-on cybersecurity training at scale, but with a commercial product and faster iteration cadence.
• (ISC)²: (ISC)² is a nonprofit member organization administering the CISSP and other widely adopted cybersecurity certifications, with strong workforce development and educational programs. Comparable to CyLab Security Academy in providing industry-recognized credentialing and shaping cybersecurity career pipelines.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/cylab
• YouTubeyoutube.com/cmuCyLab
• Facebookfacebook.com/carnegiemelloncylab
• LinkedInlinkedin.com/company/carnegie-mellon-university-cylab

Revenue estimate

Valuation estimate

Number of profiles

Profiles14 records

Subsidiaries5 records

Funding overview

Funding rounds1 record

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Carnegie Mellon CyLab