Regional Competition Roadmap
Purpose
Section titled “Purpose”Regional competitions are the entry point into WorldSkills Cyber Security. This roadmap defines the baseline competencies you need to qualify for nationals.
Focus: Breadth over depth. Demonstrate foundational skills across all four competition areas.
Time commitment: 3-6 months of structured practice for complete beginners.
How This Stage Runs in the UK
Section titled “How This Stage Runs in the UK”In the UK this roadmap covers the first two stages of the UK pathway (Technical Handbook 2026):
- Pre-qualifier (the handbook’s entry stage): a theory test covering digital forensics, penetration testing methodologies, malware analysis, data security, security legislation and common tools. Expect short-answer questions, multiple choice or a demonstration.
- Regional (the handbook’s qualifier, or live heat): a one-day, two-session capture-the-flag event for you and your partner, on site or remote. It usually tests social engineering, vulnerability scanning, web application exploitation, client system exploitation, system hardening and firewall configuration.
The top ten competitors across the UK go through to the national final.
Regional Expectations
Section titled “Regional Expectations”At the regional level, you are expected to:
- Complete clearly signposted tasks with explicit instructions
- Use common tools with basic flags (no advanced customisation)
- Identify obvious vulnerabilities (no complex chains or edge cases)
- Produce basic documentation (screenshots + short explanations)
You will NOT be expected to:
- Perform advanced exploitation requiring custom scripts
- Reverse engineer obfuscated binaries
- Handle complex AD environments with trusts
- Write forensic timeline analysis from scratch
Infrastructure hardening and secure coding
Section titled “Infrastructure hardening and secure coding”What you need to know
Section titled “What you need to know”| Topic | Anchor Link | Priority |
|---|---|---|
| Linux system hardening basics | Linux Hardening | HIGH |
| Windows firewall configuration | Windows Hardening | HIGH |
| Basic secure coding (input validation) | Secure Coding Fundamentals | MEDIUM |
| SSL/TLS certificate deployment | Web Server Security | MEDIUM |
Competency checklist
Section titled “Competency checklist”- Disable unnecessary Linux services (telnet, FTP)
- Configure UFW/iptables to block specific ports
- Create Windows firewall rules (inbound/outbound)
- Fix basic SQL injection in provided code (parameterised queries)
- Deploy a self-signed SSL certificate on Apache/Nginx
- Harden SSH (disable root login, key-based auth)
Time allocation
Section titled “Time allocation”- Spend most of your infrastructure hardening practice on Linux and Windows hardening
- Spend 30% on secure coding reviews
- Spend 10% on certificate/web server tasks
Digital forensics
Section titled “Digital forensics”What you need to know
Section titled “What you need to know”| Topic | Anchor Link | Priority |
|---|---|---|
| Disk forensics with Autopsy | Disk Forensics | HIGH |
| Windows Event Log analysis | Log Analysis | HIGH |
| File carving and recovery | Data Recovery | MEDIUM |
| Basic memory analysis with Volatility | Memory Forensics | LOW |
Competency checklist
Section titled “Competency checklist”- Extract deleted files from disk image using Autopsy
- Identify when a user logged in from Windows Event Logs
- Recover a deleted image/document using Foremost or PhotoRec
- Find running processes in a memory dump (Volatility
pslist) - Extract browser history from forensic image
Time allocation
Section titled “Time allocation”- Spend 50% on disk forensics (Autopsy workflow)
- Spend 30% on log analysis
- Spend 20% on file recovery (this is often a quick flag)
Offensive operations (red team CTF)
Section titled “Offensive operations (red team CTF)”What you need to know
Section titled “What you need to know”| Topic | Anchor Link | Priority |
|---|---|---|
| Basic SQL injection (error-based, auth bypass) | SQL Injection | HIGH |
| Nmap scanning fundamentals | Network Reconnaissance | HIGH |
| Basic privilege escalation (sudo -l) | Linux PrivEsc | MEDIUM |
| Web directory enumeration (gobuster/dirb) | Web Reconnaissance | MEDIUM |
| Common crypto challenges (base64, Caesar) | Basic Cryptography | LOW |
Competency checklist
Section titled “Competency checklist”- Bypass login with
' OR 1=1--SQL injection - Run nmap and interpret open ports (22, 80, 443, 3389)
- Use gobuster to find hidden admin pages
- Exploit sudo misconfiguration to get root (e.g.,
sudo /bin/bash) - Decode base64 and recognise it’s not encryption
Time allocation
Section titled “Time allocation”- Spend 40% on web exploitation (SQLi, directory brute-forcing)
- Spend 30% on infrastructure recon (nmap, basic enumeration)
- Spend 20% on privilege escalation
- Spend 10% on crypto challenges (these are often quick flags)
Defensive operations (blue team)
Section titled “Defensive operations (blue team)”What you need to know
Section titled “What you need to know”| Topic | Anchor Link | Priority |
|---|---|---|
| Incident response triage | IR Fundamentals | HIGH |
| Basic log correlation | SIEM Basics | HIGH |
| Patch deployment (Windows Update) | Patch Management | MEDIUM |
| Firewall rule creation under pressure | Live Firewall Response | MEDIUM |
Competency checklist
Section titled “Competency checklist”- Identify compromised user from login logs
- Block malicious IP in firewall (iptables/Windows Firewall)
- Deploy security update via Windows Update or apt
- Write basic incident report (who, what, when, how contained)
- Recognise common attack patterns (brute force, scanning)
Time allocation
Section titled “Time allocation”- Spend 50% on incident identification and triage
- Spend 30% on containment actions (firewall rules, blocking IPs)
- Spend 20% on patch deployment and write-ups
Study Strategy
Section titled “Study Strategy”Month 1-2: Foundations
Section titled “Month 1-2: Foundations”- Set up a home lab (VirtualBox/VMware with Kali, Ubuntu, Windows)
- Complete all HIGH priority tasks from each day
- Use official practice materials from WorldSkills website
Month 3-4: Tool Mastery
Section titled “Month 3-4: Tool Mastery”- Practice with the tools until commands are muscle memory
- Complete all MEDIUM priority tasks
- Time yourself - regional tasks should take 5-15 minutes each
Month 5-6: Mock Competitions
Section titled “Month 5-6: Mock Competitions”- Simulate full 4-day competition under time pressure
- Focus on documentation quality (screenshots, write-ups)
- Identify your weak areas and drill those topics
Common Mistakes
Section titled “Common Mistakes”Progress Tracking
Section titled “Progress Tracking”Use this checklist to track your readiness:
- Completed all HIGH priority competencies
- Completed 50%+ of MEDIUM priority competencies
- Can complete a full mock infrastructure hardening task in 4 hours
- Can complete a full mock digital forensics task in 4 hours
- Can complete a full mock offensive (CTF) task in 4 hours
- Can complete a full mock defensive operations task in 4 hours
- Documentation meets evidence requirements (timestamps, payloads visible)
- Comfortable with Linux CLI and Windows GUI navigation
Next Steps
Section titled “Next Steps”Once you’ve completed this roadmap:
- Compete at regionals and gain real competition experience
- If you qualify for nationals, progress to: National Competition Roadmap
- Continue drilling weak areas identified during competition
Unofficial study guide, not endorsed by WorldSkills International or WorldSkills UK. Topics are example areas to prepare for, not the content of any test project: competition tasks are confidential, competitions are closed book, and formats change between competitions. More about this site.