NIELIT launches CYBER KUSHTI 2026 to test human judgement in cybersecurity

MUMBAI: In this cyber kushti, speed is not the name of the game. National Institute of Electronics and Information Technology (NIELIT), under the Ministry of Electronics and Information Technology (MeitY), has launched CYBER KUSHTI 2026, a national cybersecurity and artificial intelligence hackathon designed to test how well participants can judge, prioritise and defend security decisions.

The competition was launched on August 15 as the official parallel technical track of the third National Conference on Cyber Security, Digital Forensics and Intelligence (NCCDFI 2026). It is being conducted with the Information Sharing and Analysis Center Foundation under the National Security Database, with CERT-In as knowledge partner.

Registrations opened on August 15 and will remain open until September 10. Participation is free and open to students and independent researchers in teams of three.

Unlike conventional cybersecurity contests that often revolve around vulnerability hunting or Capture The Flag challenges, CYBER KUSHTI is built around a different test: deciding which security findings actually matter.

Every team will receive the same deliberately imperfect Security Assessment Package, containing AI-generated findings, static analysis results, dependency and secrets scans, architecture documentation, source code and application logs.

The package will include genuine, false and duplicated findings, while some real vulnerabilities will be deliberately left out. Teams will then have to produce a corrected and prioritised assessment and defend the reasoning behind their decisions.

That means spotting a genuine vulnerability will not be enough. Participants will also score by correctly rejecting false findings and explaining why certain issues deserve greater attention.

NIELIT director general M. M. Tripathi said the competition reflects a shift in the nature of cybersecurity work, where machines can generate security findings faster than people can assess them.

He said the key skill now is determining which findings are genuine, which are important and what should be fixed first.

Since all teams receive the same tool-generated material at the same time, the format is intended to reduce the advantage of expensive cybersecurity tools. Participants can also use artificial intelligence tools of their choice.

CYBER KUSHTI 2026 will be conducted in three stages.

The first round, titled The Akhada, will take place online on September 15, with 50 teams advancing. The second round, The Dangal, will be held online on September 24 and will select 10 finalist teams.

The final, The Kesari, will take place in person on October 9 at the Dr Ambedkar International Centre in New Delhi. The 10 finalists will work under supervision before presenting and defending their assessments on the main stage of NCCDFI 2026.

The final will also feature an automated analysis of the same assessment material alongside the teams’ presentations. This will allow delegates to see where machine-generated findings match expert human judgement and where the two differ.

The finalists will be assessed by a jury jointly constituted by NIELIT and ISAC, comprising cybersecurity experts and practitioners from government, industry and academia, including National Cyber Security Scholars recognised under the National Security Database.

The winning team will receive the title Cyber Kesari 2026 and the traditional Gada. The runners-up will be recognised as Rustam and Pahalwan.

All participants in the first round will receive certificates of participation and individual scorecards. Teams advancing beyond the first round will also receive NSD recognition credits.

The competition will even reward a wrong answer, of sorts. A special award will recognise the most instructive incorrect submission, provided the reasoning is clearly documented and has educational value.

The organisers said the entire competition will take place in controlled environments. Participants will not be directed towards or permitted to interact with live systems, third-party infrastructure or public infrastructure at any stage.

The final will be held as part of NCCDFI 2026, which is scheduled for October 9 and 10 at the Dr Ambedkar International Centre in New Delhi. The conference brings together government, law enforcement, the judiciary, industry, academia, researchers and students to discuss cybersecurity, digital forensics and intelligence.

With CYBER KUSHTI 2026, NIELIT is shifting the cybersecurity contest from finding the most bugs to making the smartest calls, putting human judgement firmly in the ring with AI.