Key Points
- Competition tests ability to reject false AI-generated security findings
- All 50 advancing teams receive identical deliberately flawed assessment packages
- Final round on 9 October at Dr Ambedkar International Centre in New Delhi
A national cybersecurity hackathon launched on 15 August will test participants on their ability to evaluate and reject flawed security assessments rather than on their speed at finding vulnerabilities, marking a shift in how India‘s technical institutions measure cybersecurity skills.
The National Institute of Electronics and Information Technology (NIELIT), under MeitY, launched Cyber Kushti 2026 as an official technical track of the 3rd National Conference on Cyber Security, Digital Forensics and Intelligence (NCCDFI 2026). Registration is open until 10 September 2026, with participation free for student and independent researcher teams of three.
The competition format differs substantially from conventional cybersecurity challenges. Each team will receive an identical Security Assessment Package containing AI-generated findings, static analysis outputs, dependency scans, architecture documentation, source code and application logs. The package will deliberately include false positives, duplicated findings and genuine vulnerabilities, while some actual security flaws will be omitted entirely.
Judgment focus
Teams must produce a corrected and prioritised security assessment and defend their decisions. The scoring rewards participants for correctly rejecting false findings as well as for identifying genuine issues.
“The most difficult part of security work has shifted. For a generation, the scarce skill was finding the problem. Today, machines generate findings faster than any team can read them,” said Prof M M Tripathi, director general of NIELIT and vice chancellor of NIELIT Deemed to be University. “What they cannot yet do reliably is tell us which findings are real, which matter most, and what must be fixed first. That judgment is now the skill our institutions must build, and it is the only thing this competition measures.”
The identical starting material is designed to neutralise advantages from expensive security tools. Participants may use any artificial intelligence tools of their choice during the competition.
“A student from a college in any part of the country can compete on entirely equal terms with a corporate team. That is deliberate,” Tripathi added. “We are launching on Independence Day because independence, in an era of increasingly capable machines, means something quite specific: the confidence to examine what one is handed, to disagree with it, and to say precisely why.”
The competition is being conducted with the Information Sharing and Analysis Center (ISAC Foundation) under the National Security Database (NSD), with CERT-In as knowledge partner.
Competition structure
The hackathon will run across three rounds with progressively smaller cohorts. The first round, called The Akhada, takes place online on 15 September 2026, with 50 teams advancing. The second round, The Dangal, follows online on 24 September 2026, selecting 10 finalist teams.
The final round, The Kesari, will be held in person on 9 October 2026 at the Dr Ambedkar International Centre in New Delhi. The ten finalist teams will work under supervision before presenting and defending their assessments on the main stage of NCCDFI 2026.
During the final presentations, an automated analysis of the same assessment material will be displayed alongside the teams’ work. This will allow conference delegates to observe where machine-generated analysis and human judgment converge and where they differ.
An eminent jury jointly constituted by NIELIT and ISAC will assess the finalists. The jury will comprise senior cybersecurity practitioners and experts from government, industry and academia, including National Cyber Security Scholars recognised under the NSD.
The winning team will receive the title Cyber Kesari 2026 and a traditional Gada. Runners-up will be recognised with the titles Rustam and Pahalwan. All Round 1 participants will receive a certificate of participation and an individual scorecard, while those advancing beyond Round 1 will receive NSD recognition credits.
By the numbers
- 50 teams
- advancing from Round 1
- 10 teams
- competing in final round
- 10 September 2026
- registration deadline
A special award will recognise the most instructive incorrect submission, rewarding clearly documented reasoning that has educational value even when the conclusion is wrong.
All competition activities will be conducted within controlled environments provided by the organisers. Participants will not be permitted to engage with any live system, third party or public infrastructure at any stage.
NCCDFI 2026, the parent conference, brings together government, law enforcement agencies, the judiciary, industry, academia, researchers and students. The third edition will take place on 9 and 10 October 2026 at the Dr Ambedkar International Centre in New Delhi.
Your Questions, Answered
What is Cyber Kushti 2026?
Cyber Kushti 2026 is a national cybersecurity hackathon launched by NIELIT that tests participants on their ability to evaluate, prioritise and correct flawed AI-generated security assessments rather than on vulnerability detection speed.
Who can participate in Cyber Kushti 2026?
Participation is free and open to students and independent researchers in teams of three. Registration is open until 10 September 2026.
When and where is the Cyber Kushti 2026 final round?
The final round, called The Kesari, will be held in person on 9 October 2026 at the Dr Ambedkar International Centre in New Delhi as part of NCCDFI 2026.
What makes Cyber Kushti different from other cybersecurity competitions?
Unlike CTF challenges that reward vulnerability discovery, Cyber Kushti rewards teams for correctly rejecting false findings in AI-generated security assessments and defending their prioritisation decisions.
