“Cybersecurity matters more today than it ever has,” says Benas Buškus, a second-year Information Technology student at the Faculty of Mathematics and Informatics at Vilnius University (VU MIF) and a member of Lithuania’s national youth cybersecurity team.
From 12 to 16 October, national teams from 42 countries gathered in Bochum, Germany, for the European Cybersecurity Challenge (ECSC 2026). More than 400 participants competed in hands-on cybersecurity challenges.
The Lithuanian national team was coached by Prof. Dr Linas Bukauskas, Head of the Cybersecurity Laboratory at the Institute of Computer Science, VU MIF. Lithuania placed 29th overall and 15th in the Attack-Defense Capture the Flag (CTF) competition.
Lithuania’s national youth cybersecurity team at ECSC in Bochum, Germany. Photo: team archive.
ECSC brings together young cybersecurity enthusiasts aged 14–25 who qualify through national competitions. This year’s challenge was won by Sweden.
Prof. Bukauskas, who helped prepare the Lithuanian team, emphasizes that even qualifying for the competition is no easy feat.
“Building the team is a complex process – every year, young people have to earn their place in the national squad again. After completing all the selection stages, they hone their skills in intensive training camps and in parallel tournaments organized by other countries.”
Using brains instead of AI
“ECSC 2026 was one big test of practically every IT skill,” says Benas Buškus, member of the national team. “It covered computer architecture, procedural programming, experience with Linux, networking, digital forensics, binary analysis, and finding software and hardware vulnerabilities.”
Benas first learned about the Information Technology program while still in high school. “I was immediately hooked because it was the only program that placed so much emphasis on UNIX operating systems and networks,” he recalls. “I was already interested in IT, so I put this program as my first choice. I haven’t regretted it once.”
VU MIF Information Technology student Benas Buškus (right). Photo: ECSC.
Capture the Flag (CTF) is a gamified cybersecurity competition in which participants solve practical challenges. The tournament features two types of CTF events. In Jeopardy CTF, teams independently solve cybersecurity problems and search for special codes known as “flags”, which earn them points. Challenges span a range of areas, with points awarded based on their difficulty and how many teams solve them.
According to Benas, one of the most important rules of the competition was the ban on using artificial intelligence (AI) to automate or even speed up participants’ work. Competitors could not rely on AI tools to suggest solutions or help them identify vulnerabilities faster. They had to find flags and simulate scenarios using conventional tools.
“When we can’t use AI, we have to make all the decisions ourselves. There were no hints in the tasks, nothing pointed us in the right direction. It makes you think in a completely different way. We had to write and implement attack scenarios ourselves, conduct binary analysis ourselves, and look for vulnerabilities ourselves. It’s great – rules like these force us to use our brains and solve problems independently. It’s the best way to learn!” the student says.
Benas adds that some competing teams nevertheless used AI in violation of the rules and were penalised by losing all the points they had earned.
Better solutions through teamwork
The other part of the championship, the Attack-Defense CTF, required not only technical knowledge but also the ability to work quickly as a team. Teams had to keep their own virtual systems and services running while exploiting vulnerabilities in other teams’ systems to take over their services and capture their flags.
A moment from the tournament. Photo: ECSC.
Lithuania placed 15th in this event, finishing ahead of strong teams from Italy and France. Benas says that preparation, tools developed in advance, weekend training sessions at VU MIF and the ability to collaborate all contributed to the result.
Ten Lithuanian team members continuously shared their knowledge and ideas.
“Sometimes four of us would focus on a single task, and it was only because of that collaboration that we managed to capture the flag,” the VU MIF student recalls.
Benas says the competition reinforced his belief that individual ability alone is not enough in cybersecurity.
“These competitions taught us how important teamwork is. If team members stay in their own little circles, nothing gets solved. But when people combine their strengths and tackle a problem together, the chances of solving it increase many times over. It’s also important to keep learning, experimenting and following new developments, because technologies change, and so do vulnerabilities and security principles. No two CTF challenges are the same,” he says.
Think like a hacker, act as a defender
Strong results are built on consistent preparation. According to Prof. Bukauskas, national team members must regularly demonstrate readiness to compete. Training helps them deepen their technical knowledge while learning to collaborate and make decisions independently and quickly.
Lithuania’s national youth cybersecurity team with coach Prof. Linas Bukauskas (right) at a training camp at TalTech in Estonia.
Photo: team archive.
“Regular skills assessments and weekend challenges at the VU Faculty of Mathematics and Informatics not only improved technical abilities but also strengthened the team’s mutual understanding as they worked through genuinely difficult puzzles,” says Professor. “It is always a pleasure to see difficult tasks solved during training. Even more rewarding is watching people find a solution after lengthy discussions and repeated attempts, and then share it with one another. During training sessions and camps, participants sometimes had to continue working at home.”
Competitions and CTF challenges help future IT and cybersecurity professionals understand how hackers think.
“If we know how to break into systems ourselves and understand how vulnerabilities can be exploited, we also know what needs to be improved in IT systems,” says Benas.
Cybersecurity is a priority for the VU MIF student.
“This field is more important than ever, especially now that AI can identify critical vulnerabilities in IT systems and exploit them faster than a human can. It is a highly dynamic field that requires extensive technical knowledge across different areas of IT. Cybersecurity is not limited to programming, as people often still think. I’m also interested in systems and network administration, which are closely connected to cybersecurity.”
Opportunities for students and schools
The Cybersecurity Lab at VU MIF’s Institute of Computer Science helps organize CTF competitions and develop challenges for Cyber Sprint, aimed at young people in Lithuania, and Cyber Marathon, designed for schools.
“Cyber Marathon gives school students the opportunity to discover the world of cybersecurity while they are still in the classroom, take on challenges and develop their computing skills,” says Prof. Bukauskas.
Schools interested in a longer visit can register for the Class with a University Lecturer program („Pamoka su universiteto dėstytoju“. Researchers from the Cybersecurity Laboratory will bring equipment to schools, allowing pupils to test their skills in their own IT classrooms.
The VU MIF Cybersecurity Lab also invites students interested in participating in or helping organize CTF competitions to contact Prof. Bukauskas. Those who want to test their SQL skills can try a small CTF challenge called “SQL Detective Story“.
28 October 2026
