What We’re Building Next: boroCTF 2027 and a CTF Club Kit for Every Chapter

Two things are taking up most of our whiteboard right now. One is a competition. The other is the thing that decides whether that competition means anything a year from now.

boroCTF 2027 is in the works

In June, we built and ran boroCTF 2026 ourselves. It was an international capture-the-flag competition that drew 2,000+ competitors across 1,000+ teams from 93+ countries, working through 100+ original challenges we wrote from scratch. Real infrastructure, running live, under real pressure.

We're doing it again.

Planning for boroCTF 2027 has started: challenge design, infrastructure, and the parts of last year's event we want to rebuild rather than repeat. We learned a lot running an event at that scale as high schoolers: what held up, what buckled, and which challenges actually taught something versus which ones just filtered people out.

We're not announcing dates or registration yet. When we do, it'll be here and in our Discord first.

The harder problem: what happens between competitions

A CTF weekend is a spike. It gets students excited, and then most of them go back to schools where cybersecurity still isn't taught.

The honest gap we keep running into is not student interest. It is that starting a cybersecurity club is hard when nobody in the building is a security expert. A teacher who's willing to sponsor a club usually can't write challenges. A student who wants to lead one usually can't get software installed on a school network. Both give up for practical reasons, not lack of will.

So we're building the thing we wish we'd had.

CTF-in-a-Box: a chapter kit, not a lesson plan

CTF-in-a-Box is a ready-to-run, roughly 2.5-hour introductory CTF curriculum designed for middle and high schoolers with zero prior experience, and, just as importantly, for the reality of a school computer lab.

The hard constraint we designed against: it has to run on a locked-down school Chromebook. That means no software installs, no VirtualBox, no Python, no Linux, and no browser developer tools, because F12 and Inspect are blocked on most managed devices. Everything is browser-native or uses a standard search engine. The web station teaches view-source with Ctrl+U instead.

It's built as five stations, each one leaving students with a single idea they keep:

Built so a non-expert can run it

That's the part that matters for chapters. Every station ships with a facilitator script, a hint ladder, and an answer key. You don't need to be a security expert to run the day. There's a setup guide for hosting the challenge files and collecting flags, whether you use a real CTF platform, a form, or honor-system check-off.

A few other decisions came out of thinking about clubs specifically:

• It's modular. Every station is a self-contained block with the same structure. Run all five, drop to two for a 45-minute club slot, or stretch it across a full afternoon.
• Flags regenerate. All the binary and image artifacts rebuild from a single dependency-free script, so a chapter can mint a fresh flag set and run the same event again next semester without students sharing answers.
• Ethics come first, not last. "Only test what you have permission to test" is taught in the opening station and reinforced at every one after it. We're teaching the locksmithing, not the burglary.

Why chapters

CyberAcad has always been three high schoolers and a platform. That scales to a point and then it doesn't. A curriculum that any student can pick up and run at their own school scales past us, which is the actual goal.

If you want to start a chapter, or you're a teacher or club sponsor who'd host a session, we'd genuinely like to hear from you while this is still being built. Early chapters shape it more than late ones.

In the meantime

The platform is free and open right now. We just published a substantial expansion of the curriculum: three courses and 37 lessons covering Linux fundamentals, networking from first principles, and an introduction to cybersecurity, with hands-on browser labs and no hardware required.

• Browse the courses. Free, and no account needed to look.
• Create a free account and start the first lesson today.
• Get in touch about chapters, class codes, or just to say you're interested.
• Join the Discord, where boroCTF 2027 news lands first.

CyberAcad is a registered 501(c)(3) public charity. Everything we build stays free for students, and donations are what make that sustainable.