Grooming Tomorrow’s Cyber Defenders: Policy Challenges Forge Next-Gen Leaders
- Policy Competitions: The Cyber 9/12 Strategy Challenge tests students on cyber crisis policy, not coding.
- West Coast Debut: The Middlebury Institute of International Studies at Monterey will host the first West Coast edition on November 7–8, 2025.
- Key Players: The Middlebury Institute is partnering with the Atlantic Council, which launched Cyber 9/12 in Washington, D.C., in 2012.
- Open to All Majors: Undergraduate and graduate students from across the country can compete, with or without a cybersecurity background.
- Future Implications: The format builds leaders who understand both the technical and policy sides of cyber crises.
Cyber defense needs more than technical skill. Leaders also have to advise decision makers during a crisis, weigh policy options and explain risks clearly. The Cyber 9/12 Strategy Challenge is built to train exactly that, and in May 2025 the Middlebury Institute of International Studies at Monterey announced it will host the competition’s first West Coast edition.
What the Cyber 9/12 Challenge Is
Cyber 9/12 is a policy and strategy competition. Multidisciplinary teams tackle a realistic, evolving cyber crisis scenario and craft strategic recommendations for high-level decision makers. The Middlebury Institute is partnering with the Atlantic Council to host the event in Monterey on November 7–8, 2025, open to undergraduate and graduate students from across the country.
“This competition is not restricted to those with cybersecurity backgrounds,” said Dr. Karen Nershi, cybersecurity professor and codirector of the Institute’s Cyber Collaborative. “In fact, multidisciplinary teams will produce the unique policy solutions required to address these global challenges.”
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Not a Hackathon
Nershi stresses that the event is not a hackathon, where programmers rush to write code. Teams are judged on the quality of their policy analysis and recommendations as the scenario changes.
That makes it a different kind of training. Students practice assessing a crisis, weighing the policy implications and briefing senior officials under time pressure, the skills real cyber leaders use when an incident escalates.
Why Middlebury Is Hosting
The Institute’s students have competed in virtual and in-person Cyber 9/12 events for years. A team of four placed second out of 47 teams in the Atlantic Council’s 2019 challenge.
“The Institute is the perfect place to bring together the kind of diverse networks and interdisciplinary expertise we need to address emerging challenges,” said Dr. Allison Stanger, who has taught courses on AI and global security at the Institute and may serve as a judge.
A Global Competition
Since its launch in Washington, D.C., in 2012, Cyber 9/12 has grown into a global competition. Events are held regularly across the U.S. and internationally, including in the United Kingdom, Costa Rica and South Africa.
Competing against teams from other schools builds networks that last well beyond the event.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Connecting Students With Employers
The Institute is recruiting cybersecurity, policy and national security professionals as judges, who give students feedback and mentorship. A career fair and networking event are also planned.
“This isn’t just a competition. It is an opportunity to gain leadership experience, develop critical decision-making skills, build connections between academia, government, and industry, and strengthen the global cyber policy community,” Nershi said.
For students interested in cyber policy, registration was set to open in mid-August. It’s a chance to practice the judgment that technical training alone doesn’t teach.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.