Cybersecurity Students Experiences of Capture the Flag (CtF) in an Irish Technological University

This case study explores the experiences of Irish cybersecurity students participating in Capture the Flag (CtF) activities, utilising a qualitative approach to uncover student perspectives often overlooked in existing research. Primary data was gathered through field observations and semi-structured interviews with undergraduate students in a Technological University in Ireland. Using activity theory, the research identifies and explores specific challenges that students face when engaging with CtF in an academic setting. Findings reveal five main points of tension: (1) overspecialization within CtF activities, which can limit broader learning; (2) learning restrictions imposed by the structure of CtF tasks, impacting students’ flexibility; (3) a balance between competition and learning, where competitiveness can sometimes overshadow educational objectives; (4) conflict between students’ desire for autonomy and the need for guidance in complex tasks; and (5) disparities in students’ experience levels, leading to varied engagement and outcomes. These findings provide explanatory account of the student experience, highlighting contradictions between academic requirements and the typical demands of CtF activity. The study reveals insights for cybersecurity educators in Irish higher education, proposing five recommendations to incorporate into an ’academic approach’ to CtF, to better support diverse student needs and promote a more balanced integration of CtF into academic learning environment.