Over five years, pwn.college evolved from a demanding upper-division cybersecurity elective into a global, continuously running learning ecosystem—free and open to the world—with more than 50,000 learners having solved at least one challenge. As participation expanded beyond a single university cohort, the curriculum itself stopped functioning as a semester-bounded artifact and became a continuously lived experience, with learners engaging year-round and improvements propagating immediately. At this scale, thousands of learners effectively ''playtest'' the platform and its curriculum in real time, surfacing issues invisible in conventional courses and creating a feedback loop that improves the material our university students use. Voluntary global participants often persisted longer than enrolled students, became the most active mentors, and contributed significantly to refining both content and infrastructure. This ecosystem is anchored by incremental, education-first CTF challenges delivered through DOJO and supported by Twitch instruction, YouTube archives, and near-real-time peer help on Discord. Yet an always-on, openly archived curriculum also introduces tensions, including a form of ''digital archaeology'' in which past debugging sessions become both learning scaffolds and tempting shortcuts. Opening a CTF-based cybersecurity course to the world did not merely scale enrollment—it fundamentally changed the curriculum, how students learned, and how instructors taught.

The modern educational landscape faces the challenge of maintaining effective, personalized mentorship amid expanding class sizes. This challenge is particularly pronounced in fields requiring hands-on practice, such as cybersecurity education. Teaching assistants and peer interactions provide some relief, but the student-to-educator ratio often remains high, limiting individualized attention. The advent of Large Language Models (LLMs) offers a promising solution by potentially providing scalable and personalized guidance. In this paper, we introduce SENSAI, an AI-powered tutoring system that leverages LLMs to offer tailored feedback and assistance by transparently extracting and utilizing the learner's working context, including their active terminals and edited files. Over the past year, SENSAI has been deployed in an applied cybersecurity curriculum at a large public R1 university and made available to a broader online community of global learners, assisting 2,742 users with hundreds of educational challenges. In total 178,074 messages were exchanged across 15,413 sessions, incurring a total cost of 1,979--comparable to that of a single undergraduate teaching assistant but with a significantly wider reach. SENSAI demonstrates significant improvements in student problem-solving efficiency and satisfaction, offering insights into the future role of AI in education.

This paper introduces DOJO, a state-of-the-art, open-source learning platform for hands-on cybersecurity education that aims to minimize barriers for both students and instructors. DOJO draws insight and inspiration from the Capture The Flag (CTF) community, which has pioneered the use of hands-on challenges to teach cybersecurity concepts. DOJO improves upon the accessibility and usability of existing platforms by making available a pre-configured, full-featured learning environment immediately accessible from any device in the browser. Students are able to write code, interact with a shell, explore complex network configurations, debug processes and kernel modules, and more, all from the browser. Instructors can easily deploy DOJO to their own servers with a single "docker run" command, or use our already-deployed instance to host their own challenges or already existing challenges with a single "git push" command. DOJO has been successfully used in multiple university courses and workshops, and is available for free to the world, with more than 10,000 students from around the world having already benefited from using DOJO. In this paper, we discuss the infrastructure, design, implementation, and effectiveness of DOJO, and compare it to related work.

We address the pressing need for effective and scalable cybersecurity education methodologies for undergraduate students. While Capture The Flag (CTF) challenges have been instrumental for some learners, for many novices CTF challenges are simply too difficult and too intimidating to be pedagogically effective. By dissecting and individually presenting these concepts through modularized challenges, we introduce a progressive learning curve that allows students to master complex vulnerabilities, even culminating in crafting advanced end-to-end exploits through both userspace and the kernel. Recognizing the learning barriers imposed by debugging and introspection tools, our method uniquely offers self-guiding challenge variants, effectively decoupling problem-solving from tool mastery. Drawing from five years of curating around 400 systems security challenges, this paper details our insights and experiences, emphasizing the pivotal role of an education-first approach over traditional CTFs. Our methodology's success is underscored by our survey results, with an overwhelming majority of participants acknowledging its pivotal role in deepening their cybersecurity understanding. Furthermore, we have successfully leveraged this material as the foundational content for a follow-on vulnerability research course, where freshly-trained students successfully identified 0-day vulnerabilities in real-world software. As a commitment to global education, we make all challenges and accompanying lecture materials discussed herein freely, and easily, accessible to the world.