On March 13–14, 2025, the ’s Cyber Statecraft Initiative hosted its flagship Cyber 9/12 Strategy Challenge in Washington, DC—marking the fourteenth consecutive year of its cyber policy and strategy competition in the United States. Held in partnership with both American University’s School of International Service and Washington College of Law, the competition welcomed over forty teams from across fifteen states and five countries (the United States, United Kingdom, Canada, Botswana, and Ghana) to tackle an escalating cyber crisis with implications for rural healthcare infrastructure.
Throughout the scenario, students examined challenges in addressing vulnerabilities in rural healthcare infrastructure during a scenario in which a Russia-based cybercriminal group launched a ransomware attack on a fictional healthcare provider. The scenario prompted students to consider third-party vendor risks, supply chain weaknesses, and broader geopolitical implications while crafting strategic and actionable policy responses for the under-resourced organizations impacted in this scenario to a panel of judges playing the role of the United States National Security Council.
As cyber threats increasingly require cooperation across technical, legal, and policy domains, competitions like Cyber 9/12 have become a testing ground for students to hone their interdisciplinary skills and launch careers in law, national security, public policy, and engineering. During the competition, students had opportunities to connect with seasoned experts from across the national security workforce, representing the public sector, academia, and industry, who served as judges and mentors.
To better understand how the 2025 DC Cyber 9/12 Strategy Challenge is shaping cyber talent in the United States, we spoke with participants about their experience navigating the scenario, lessons learned, and what it means to solve cyber crises in the nation’s capital.
How has participating in Cyber 9/12 shaped your team’s career goals at the intersection of cybersecurity and public policy?
Cyber 9/12 has been integral in taking the lessons we have learned in the classroom and applying them to the real world in a meaningful way. Playing the role of a senior policymaker has helped us view issues through an interdisciplinary lens, requiring the coordination of multiple stakeholders, including state and local governments, international partners, the federal government, and the private sector. This perspective reflects the nature of many issues facing our society today and will help us craft more effective solutions in our future careers. Additionally, the ability to gain feedback from industry professionals has been an integral part of our professional development. Cyber 9/12 has provided our team with ample opportunities to network, find job opportunities, and identify topics within cybersecurity that align with our interests. No matter what sector we end up in, the Cyber 9/12 Strategy Challenge has provided us with meaningful expertise that will help us become more impactful professionals in the workforce.
—W0LV3R1NES of Utah Valley University
Judges at Cyber 9/12 come from a range of sectors, such as government, academia, and industry. How did the different professional perspectives you encountered impact the way your team approached the scenario or refined your policy responses?
Competing at Cyber 9/12 gave us invaluable experience through a real-world crisis scenario. Briefing experts from government, academia, and industry meant we couldn’t rely on one-dimensional answers—we had to clearly define legal authority, ground our proposals in sound policy and logic, while also ensuring each recommendation could realistically be implemented in both public and private sector contexts. The variety of questions we faced exposed gaps we hadn’t seen and pushed us to tighten our analysis. Ultimately, this experience helped us craft more cohesive and actionable responses that reflect the complexity of real-world cyber crisis management.
Sentinel Won, Patrick Henry College
What unexpected challenge did your team encounter during the competition, and how did you adapt your strategy in response to it?
An unexpected challenge we faced during Cyber 9/12 was managing tornado warnings in Illinois the night before our team’s semifinal and final round presentations. As a virtual team working across time zones, we suddenly had to face concerns about safety, connectivity, and communication. With only hours to review materials and prepare, pressure mounted. Our team adapted by assigning roles based on connectivity, preparing talking point templates, and documenting everything clearly so other team members could step in if needed. Despite the stress, we communicated clearly and remained composed, delivering strong responses on day two of the competition. The experience highlighted our team’s resilience and the importance of adapting quickly—just as Cyber 9/12 scenarios require.
—ILLuminati, University of Illinois Urbana-Champaign
What’s one strength that your team members leveraged during the competition, and what’s one area for growth your team has identified after the experience?
Our team’s greatest strength was our ability to recognize and leverage each member’s unique capabilities beyond the context of a Cyber 9/12 competition. Our comprehensive understanding of the scenario, including key players, resources, and institutions, provided us with a significant advantage throughout the competition. This knowledge enabled us to navigate a complex scenario with confidence and strategic insight. After reflecting on our experience, we identified our primary area for growth would be to develop more intentional collaboration strategies in the weeks preceding the first round of the competition. More structured preparation would have enhanced our teamwork and readiness, allowing us to maximize our collective potential from the beginning of the competition.
—COOR 6607, Arizona State University
Cyber 9/12 challenges participants with new and evolving cybersecurity scenarios each year. What new topic or issue in cybersecurity did this year’s competition expose your team to, and how did it shape your thinking about that particular issue?
We came into the competition with essentially no knowledge of how cybersecurity works within the healthcare industry, even though we all have backgrounds in cybersecurity. The competition made us think about the parts of the healthcare sector’s resilience that are different from the applications we’ve studied – what agencies are involved, which goals we need to prioritize and de-prioritize, and how technical requirements match resources. We came away with a better appreciation for the tradeoffs that healthcare cybersecurity practitioners make, and how to consider those tradeoffs in our own work going forward.
—Chat APT, University of Texas at Austin
Mentorship is a key part of Cyber 9/12. How do you think mentors can best support students in developing not just strong recommendations in response to a scenario, but also critical thinking and collaboration skills?
No one really knows what it’s like to be in these types of crisis scenarios until you’re the one in the seat of responsibility for your organization. Sure, we can read about such scenarios in our various programs of study; but, as they say, “everyone has a plan until you get punched in the face.” That is precisely why Cyber 9/12 and the mentorship available in this community is so critical for emerging leaders. When it’s your turn to face the music and take on the new mantle of leadership in cyber crises, current established leaders are going to want to hand the baton to emerging leaders who they trust have been there before, in fictional crises or real, and have the support network, mentorship, training, and grit to weather the storm.
—Andrew Seligson, Cyber 9/12 Strategy Challenge Judge and Alumnus
If you could give one piece of advice to a first-time Cyber 9/12 competitor, what would it be and why?
It sounds cliche but try and enjoy yourself! Yes, the competition will feel stressful, but the judges are excited to get to work with you and learn from you. The more you can view this as a full experience, rather than a means to an end, the more you’ll end up getting out of it. I was impressed by every team I saw, by their passion, engagement, and eagerness to make the world a better and safer place. Take as many opportunities as you can to ask questions and get to know the other participants, be they judges, volunteer organizers, or the other competitors. The more time I spend in this field, the more I end up meeting and interacting with some of the same great people (I actually ran into a colleague on one judging panel who I hadn’t seen in years!). We really are a community: sometimes we may be on opposing sides of an issue, or be at odds over the best solution, but the more we can work together toward the same common goal, the better off we will be.
—Taylor Grossman, Cyber 9/12 Strategy Challenge Judge and Director for Digital Security, Institute for Security and Technology
About Cyber 9/12
The Cyber Statecraft Initiative’s Cyber 9/12 Strategy Challenge is an annual cyber policy and strategy competition where students from across the globe compete in developing policy recommendations tackling a fictional cyber catastrophe.
Explore the Program
The ’s Cyber Statecraft Initiative, part of the Technology Programs, works at the nexus of geopolitics and cybersecurity to craft strategies to help shape the conduct of statecraft and to better inform and secure users of technology.
