This article was originally reported in November 2025.
Cybersecurity students often face a catch-22: employers want hands-on experience, but they are reluctant to give inexperienced interns access to sensitive systems. Researchers at Carnegie Mellon University and the Community College of Allegheny County (CCAC) in Pittsburgh have built a simulation, Cyber SimLab, to give students that experience in the classroom. CMU described the project in November 2025 (CMU News, Nov. 24, 2025).
Why real-world experience is hard to get
“A cybersecurity employee has high-level access to extremely sensitive information and systems,” said Lee Branstetter, the James M. Walton Professor of Economics and Public Policy at CMU’s Heinz College, explaining why companies hesitate to offer internships to students who have never defended a real network. In an earlier paper published in the proceedings of the 56th ACM Technical Symposium on Computer Science Education (2025), Branstetter and colleagues argued that most college-level cybersecurity teaching focuses on technical knowledge, with too little attention to non-technical skills such as communication and understanding business consequences. They also noted that certification exams tend to shape course content, so students often work in idealized environments (Heinz College, 2025).
How Cyber SimLab works
Cyber SimLab is the backbone of CCAC’s Ethical Hacking Lab, a one-credit lab course taken alongside ethical hacking classes. It was designed by Rotem Guttman, a Ph.D. student in CMU’s Human-Computer Interaction Institute, working with CMU master’s student Will Nichols, and was rolled out to students in late 2024. The team also included CCAC faculty Matthew Kisow and James Winyard, CMU professors Lauren Herckis and Carolyn Rosé, and researcher Judeth Oden Choi.
- A fictional company: the simulation is built around a company with competing departments and employees who run into security problems that students must find, contain and resolve.
- Realistic attacks: in one storyline, an employee falls for a spear-phishing email that appears to come from CMU and opens a weaponized receipt on her work computer. Students access the machine remotely and triage the problem with the same kinds of tools used by security firms, scanning machines and finding and testing vulnerabilities.
- Reporting to “management”: students work in small groups, assess how serious each vulnerability is, draw up a change-management plan and present their findings to “management,” played by representatives of Pittsburgh-area employers, before making changes to the network.
- Tracking progress: “In the system we built, we can track their interactions and see what they’re struggling with,” Branstetter said.
Students who complete the course receive a document stating that it is recognized by CMU. Larry Luther, who earned an associate degree in cybersecurity at CCAC, called the course extremely hard and said “the lab probably taught me the most in the least amount of time.” Branstetter said the approach lets students “simultaneously build technical, social and human skills,” and said he hoped to offer the course again in 2026 and build it into an ecosystem that can grow over time (CMU News).
The research was supported by the National Science Foundation, the Richard King Mellon Foundation and a regional Build Back Better initiative in southwestern Pennsylvania. Co-author Guttman said the shared teaching resources are “especially useful for under-resourced cybersecurity programs” (Heinz College).
What it means for students
The project points to skills that employers look for beyond certifications: triaging an incident under pressure, judging how serious a vulnerability is, and explaining technical risks to non-technical managers. Students who cannot land an early internship can build some of this experience through simulation-based labs, capture-the-flag competitions and course projects, and should be ready to describe that work in interviews.
For international students
- Community college route: CCAC’s Office of International Students issues I-20s for F-1 students. Applicants submit the CCAC application plus the international student application, translated and evaluated transcripts, TOEFL scores if living outside the U.S., and sponsor bank statements from the most recent four months showing at least $32,000 in available funds (plus $2,000 for each dependent) (CCAC International Students). Ask the office whether your intended cybersecurity program is open to F-1 students before applying.
- Carnegie Mellon: CMU is No. 14 in the 2027 U.S. News Best National Universities ranking and No. 1 in the 2027 undergraduate cybersecurity ranking (Forward Pathway; Forward Pathway schools and majors rankings).
- Work authorization: internships during studies usually require Curricular Practical Training (CPT). In August 2026, SEVP told schools to approve CPT only when the training is required for every student in the program; the guidance is being challenged in federal court (NAFSA). Check with your school’s international office how this affects internships in your program.
References
- Real-World Cyber Experience Is Hard To Get. This CMU Program Could Change That. – CMU News, Nov. 24, 2025
- Cybersecurity educators should share resources to teach students important technical and non-technical skills – CMU Heinz College, 2025
- International Students – Community College of Allegheny County
- Legal Defense: CPT – NAFSA
- Carnegie Mellon University – Forward Pathway