April 2026 · White Paper
Skill or Shortcut? You Can Now Get the Right Answer Without Building the Skill
Six years of competition data from CyLab Security Academy reveals a structural shift in how students develop cybersecurity expertise, and what's getting in the way.
By Megan Kearns, Luke T. Jones, Ivan Liang, Max Yin
CyLab Security and Privacy Institute · Carnegie Mellon University
For six years, CyLab Security Academy has given us something rare: a continuous behavioral record of how hundreds of thousands of people actually develop cybersecurity skills under competitive conditions. When we looked across our 2021 through 2026 competition data, the pattern held steady for the first four years. New entrants performed at a consistent baseline, returning competitors improved, and the hardest challenges separated the field the way they were designed to.
Then 2025 showed early signs of compression, and 2026 broke the pattern entirely.
Students who came back to compete after AI tools became widely available improved at nearly half the rate of those who returned before. That gap holds even when you control for how long they’d been on the platform. Meanwhile, new entrants are arriving better prepared than any cohort we’ve seen in six years. The floor is rising. But the people who should be developing over time aren’t keeping pace.
That's not a story about access or efficiency. Those are real gains and we're not dismissing them. It's a story about a gap opening up between what someone can produce and what they actually understand.
Our data shows, at scale and for the first time, that we’ve reached a point where you can get the right answer without building the skill. That’s the problem worth solving, and it’s exactly why we built CyLab Security Academy to be an education platform first.