Learn Cybersecurity by Breaking Things: A Hands-On Approach

Cybersecurity education is undergoing a significant transformation, moving away from passive lectures toward immersive, hands-on learning. A recent study conducted by Airbus Cybersecurity and Dauphine University demonstrates that student engagement increases dramatically when courses place learners directly into realistic scenarios involving structured hacking, social engineering, and competitive games. This approach makes the abstract principles of digital defense feel immediate and tangible.

Traditional cybersecurity training often focuses heavily on tools, frameworks, and technical controls. The research highlights a persistent gap: many real-world security incidents still stem from human behavior. Phishing emails, weak passwords, policy shortcuts, and misplaced trust continue to be the most common entry points for attackers. Conveying the risks associated with these vulnerabilities through theory alone proves challenging. Engagement improved markedly when students were asked to assume roles like attacker, analyst, and incident responder, working through exercises based on actual attack techniques and organizational weaknesses. Each scenario concluded with a reflective discussion, encouraging students to analyze the sequence of decisions rather than just the final outcome.

The course structure began with concise foundational lessons on systems, cryptography, and security lifecycles, but quickly transitioned to practical application. Initial exercises had students mapping potential attack paths against a simulated organization. They identified exposed services, problematic user behaviors, and flawed security assumptions, emphasizing that strategic planning often matters more than specific tooling. Subsequent sessions moved learners into threat intelligence roles, where groups dissected published attack reports to understand how adversaries operate, connecting abstract threat names to concrete, documented techniques.

A culminating technical scenario introduced digital forensics. Students examined digital evidence from a fictional kidnapping case, where hidden metadata, encrypted content, and planted clues required meticulous analysis instead of brute-force methods. Instructors noted that student confidence and persistence grew over time, with participants becoming more willing to experiment and test their ideas as the exercises progressed.

A substantial portion of the curriculum addressed insider risk, categorized into unintentional actions, intentional but non-malicious behavior, and deliberate misuse. One exercise immersed students in a lab environment flooded with phishing emails. They identified elements that made messages seem trustworthy or suspicious, then used those same signals to design their own phishing campaigns. Another session staged a policy conflict, pitting a group playing security leaders against another role-playing as employees seeking workarounds. This revealed how overly rigid controls often inspire predictable and risky shortcuts.

The final insider exercise tasked students with designing future attack scenarios that could exploit trusted users. Groups outlined potential attack paths and then brainstormed detection and response strategies. These activities sharpened awareness of social influence and ethical boundaries, giving learners a clearer picture of how ordinary actions can unintentionally escalate into full-blown security incidents.

The course culminated in a capture-the-flag challenge spanning both physical and digital domains. Students worked to unlock devices, decode clues, and interact with consenting staff members, blending technical skill with observation and persuasion. Researchers observed intense collaboration and healthy competition during this phase, with some groups finding multiple flags through persistence and adaptive thinking. Post-exercise debriefs focused on the techniques used and how similar real-world attacks could be prevented, reinforcing the lesson that security failures typically involve both technical and human elements.

The study relied on qualitative feedback, and student responses were consistently positive. Participants described the course as challenging yet highly engaging. Many cited the deep satisfaction of independently uncovering clues and piecing together incomplete information. Group discussions grew more animated as the course continued, and collaborative problem-solving often extended well beyond scheduled class time. This experience aligns with external research on hackathons, where a majority of participants cite learning as their primary motivation, confirming that challenge-driven formats powerfully resonate with how people are motivated to learn.

(Source: HelpNet Security)