Global Collegiate Penetration Testing Competition (CPTC)

What Global Collegiate Penetration Testing Competition (CPTC) does

The Global Collegiate Penetration Testing Competition (CPTC) is an all-volunteer, non-profit organization that runs an annual cybersecurity competition simulating real-world penetration testing engagements for collegiate teams. Founded in 2015 by RIT professor Bill Stackpole and now led by Global Director Justin M Pelletier, the organization is operationally hosted at Rochester Institute of Technology's ESL Global Cybersecurity Institute in Rochester, NY. Each year, volunteers construct an immersive themed mock organization (covering verticals such as hospitals, finance, energy, hotels, social media, and maritime/cruise operations) with realistic applications, infrastructure, OSINT content, and characters; teams act as consulting firms, producing professional reports and executive presentations scored on both technical findings and communication quality.

The competition scales through an online qualifier, 7 regional events anchored at host universities (University of New Haven, Baldwin Wallace University, Tennessee Technological University, Augusta University, Stanford University, Coastline College, and RIT Dubai), and a Global Finals at RIT's GCI where multiple zero-days have been discovered and registered as CVEs. CPTC10 introduced AI-driven challenges (LLAMA-based helpdesk chatbot exploitation, prompt injection with Scale AI, AI vishing with ScamGuardian), and a public research data repository at cptc.rit.edu supports academic collaborations including MITRE ATT&CK classification and attack behavior modeling.

The business model is sponsorship-driven: student participation is free, and revenue is generated through corporate sponsors across Premier (IBM Security since 2015), Gold (Black Hills Information Security), Core, and Support tiers, with sponsors gaining access to emerging talent via the Sponsor Faire. There is no pricing for student participation, no equity, and no venture funding.

Name

Global Collegiate Penetration Testing Competition (CPTC)

Legal name

Global Collegiate Penetration Testing Competition (CPTC)

Website

https://cp.tc

Company type

Private

Founded year

2015

Operating status

Operating

Headcount range

11–50 employees

Short description

The Global Collegiate Penetration Testing Competition (CPTC) is an all-volunteer non-profit that runs an annual collegiate penetration testing competition across 7 global regions with 100+ competing schools, funded by corporate sponsors and hosted at RIT's Global Cybersecurity Institute.

Ownership category

akta.pro rank

Product category

Cybersecurity Education

NAICS

Investigation and Security Services (5616), Testing Laboratories and Services (541380)

akta.pro primary industry

Penetration Testing & Red Teaming (BPAKADAE)

akta.pro secondary industries

Penetration Testing & Red Teaming (BPAKAHAF), Penetration Testing, Red Team & Ethical Hacking (EDAOAIAH)

Keywords

• Penetration testing competition
• Cybersecurity skills training
• Collegiate cybersecurity education
• Vulnerability assessment simulation
• Security talent pipeline

Headquarters

HQ city

Rochester

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Technology or R&D, Operations, Infrastructure, Personnel, Marketing or Sales

Revenue model

1. Sponsorship Revenue: CPTC is funded through corporate sponsors who support the competition financially. Sponsors include IBM Security (Premier Partner since 2015), Black Hills Information Security (Gold Partner), and other organizations. Sponsors benefit from access to talent via Sponsor Faire where students receive job offers.

Go-to-market motion2 records

Distribution channels3 records

Marketing channels6 records

Core offering

CPTC organizes an annual themed penetration testing competition in which collegiate teams act as professional consulting firms performing vulnerability assessments on immersive mock enterprise environments (e.g., cruise line, social media platform, hotel, factory). Teams deliver technical findings, write professional reports, and present to executive judges. The competition progresses through an online Vendor Security Assessment qualifier, Regional Events at 7 university host institutions, and a Global Finals championship at RIT's ESL Global Cybersecurity Institute.

Product overview

CPTC is a competition-based educational platform (not a traditional software product) that offers annual penetration testing competitions for college students globally. The core offering is the Collegiate Penetration Testing Competition itself—a simulation of real-world pentest engagements featuring annual theme-based mock organizations (such as Maritime/Cruise Ops, Social Media, Hotels, etc.). The platform includes Regional Events across 7 global regions, Global Finals at RIT's Global Cybersecurity Institute, and supporting resources including a Knowledge Base, Research Data Repository, and Report Examples on GitHub. Teams compete as consulting firms, delivering technical findings, professional reports, and executive presentations.

Differentiator

Problem solved

Functional benefit

Products and services

• Collegiate Penetration Testing Competition (CPTC) Annual themed penetration testing competition for collegiate teams, where teams act as consulting firms performing assessments on immersive mock enterprise environments, delivering professional reports and presentations to industry executive judges.
• Regional Events In-person regional competitions held across 7 global regions (New England at University of New Haven; Great Lakes at Baldwin Wallace University; Central at Tennessee Technological University; Southeast at Augusta University; Western at Stanford University; Southern California at Coastline College; International at RIT Dubai), where teams compete to advance to the Global Finals.
• Global Finals Championship event held at RIT's ESL Global Cybersecurity Institute in Rochester, NY. Top teams spend 2 full days testing in the client's environment, then deliver reports and live presentations to industry executive judges. 15 teams compete at the finals.
• Vendor Security Assessment (Online Qualifier) Online qualifier competition mimicking how vendors engage with clients in the real world, taking forms such as RFP responses or vendor security audits. Teams must qualify through this stage before advancing to Regional Events and the Global Finals.

Quantifiable outcome

• Over 100 students attended tryouts for some teams during 2019-2020 and 2020-2021 cycles
• +2 more outcomes

Named customers5 records

Segments1 record

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature4 records

Partnerships

16 partnerships are on record, tiered premier, gold, core and support.

• IBM SecuritypremierStrategic or Co-development PartnerIBM Security has been the Premier level sponsor of CPTC since its inception in 2015. IBM has a passion for education in the cybersecurity field and provides essential support for the competition. Without IBM's support, the competition would not be where it is today.
• Black Hills Information Security (BHIS)goldStrategic or Co-development PartnerBHIS is a Gold Partner that strives to strengthen customers' information security through penetration testing, consulting, and defensive security services. Companies of all sizes have entrusted BHIS with their security needs since 2008.
• Security Risk Advisors (SRA)coreStrategic or Co-development PartnerSRA is a volunteer partner and highly-specialized consulting firm that continually develops solutions to cybersecurity's emerging problems. Lucas Morris serves as Senior Manager at SRA while volunteering for CPTC.
• SalesforcecoreStrategic or Co-development PartnerSalesforce is a volunteer partner that provides support for the competition. Their team includes professionals who believe in investing in the next generation of cybersecurity professionals.
• Crowe LLPcoreStrategic or Co-development PartnerCrowe LLP is a volunteer partner contributing to CPTC's operational success.
• Hurricane LabscoreStrategic or Co-development PartnerHurricane Labs is a dynamic Managed Services Provider that unlocks the potential of Splunk and security for diverse enterprises. Meredith Kasper serves as SOC Technical Account Manager at Hurricane Labs while contributing to CPTC.
• PeratonsupportStrategic or Co-development PartnerBronze level supporter contributing to CPTC's success.
• ScamGuardiansupportTechnology or IntegrationScamGuardian provided AI-powered vishing simulation technology for CPTC10's Social Media security challenges, enabling realistic voice-based automated social engineering attack exercises.
• Scale AIsupportTechnology or IntegrationPartnered with CPTC for prompt injection challenge in CPTC10, focusing on manipulating language models to reveal restricted information.
• University of New HavencoreChannel Partner/ Reseller/ DistributorRegional host for US New England region, organizing and coordinating regional CPTC competitions.
• Baldwin Wallace UniversitycoreChannel Partner/ Reseller/ DistributorRegional host for Great Lakes region, coordinating regional CPTC competitions.
• Tennessee Technological UniversitycoreChannel Partner/ Reseller/ DistributorRegional host for Central region, organizing regional CPTC competitions.
• Augusta UniversitycoreChannel Partner/ Reseller/ DistributorRegional host for Southeastern region, coordinating regional CPTC competitions.
• Stanford UniversitycoreChannel Partner/ Reseller/ DistributorRegional host for Western region, organizing regional CPTC competitions.
• Coastline CollegecoreChannel Partner/ Reseller/ DistributorRegional host for Southern California region, coordinating regional CPTC competitions.
• RIT DubaicoreChannel Partner/ Reseller/ DistributorRegional host for International region, coordinating global CPTC competitions across multiple countries.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• SANS Institute: SANS is a major cybersecurity training and certification provider offering courses, NetWars competitions, and GIAC certifications. It overlaps with CPTC as a talent pipeline and training platform for the same corporate sponsors and security professionals, though at a paid, broader scale.
• OffSec (Offensive Security): OffSec is the provider of OSCP and other well-known penetration testing certifications, as well as the OffSec CTF and Proving Grounds practice environments. It competes for the same sponsor-aligned promotion of pentest talent pipelines and offers practice labs that overlap with CPTC's training mission.

Emerging players

• HackTheBox: HackTheBox is an always-on, gamified cybersecurity training and competition platform with a strong university and individual learner base. Its constantly refreshed challenges and academy offerings compete with CPTC for student attention and for sponsor visibility in the pentest training market.
• CyberSkyline (NCL Powershell + CTF hosting): CyberSkyline is the platform that powers the National Cyber League and other scoring engines for cybersecurity competitions. It serves as a B2B technology peer by providing the competition infrastructure that many CPTC alternatives use, making it an adjacent competitor in the competition-platform space.
• TryHackMe: TryHackMe is a hands-on cybersecurity learning platform that combines guided learning paths with CTF-style challenges. It targets the same novice-to-intermediate student audience as CPTC, with a low-friction, subscription-based model that competes for early-stage student mindshare.

Others

• Cybereason / IBM Security (sponsor and recruiter): IBM Security is CPTC's Premier sponsor and also a major recruiter of cybersecurity talent. While not a direct competitor, IBM's broader security training programs, apprenticeship programs, and talent academies overlap with CPTC's pipeline role and represent a strategic partner rather than a peer.

Direct peers

• CyberPatriot (Air Force Association): CyberPatriot is the national youth cyber defense competition run by the Air Force Association, spanning high school and some college divisions. It competes for the same student feeder pool, university program attention, and corporate sponsors in the collegiate cybersecurity education market.
• Collegiate Cyber Defense Competition (CCDC): CCDC is a long-running U.S. collegiate competition where teams defend network infrastructure against a live Red Team. While CPTC emphasizes offensive pentesting and reporting, both compete for the same pool of university cybersecurity talent, faculty advisors, and corporate sponsors.
• National Cyber League (NCL): NCL is a U.S.-based collegiate cybersecurity competition focused on individual and team performance across CTF-style challenges. Like CPTC, it targets college students and is sponsored by cybersecurity vendors seeking talent, making it a direct competitor for student participation and sponsor dollars.
• picoCTF (Carnegie Mellon University): picoCTF is a free, large-scale cybersecurity competition for high school and college students run by Carnegie Mellon. It competes with CPTC for student mindshare, university partnerships, and educational sponsor funding in the collegiate cybersecurity space.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/globalcptc
• YouTubeyoutube.com/channel/UCWMSVYHrdtFS7lxTAPHPs-w
• LinkedInlinkedin.com/company/globalcptc

Revenue estimate

Valuation estimate

Number of profiles

Profiles16 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Global Collegiate Penetration Testing Competition (CPTC)