What is CIRCUS?
The CIRCUS Competition gives students the opportunity to demonstrate and sharpen their skills in incident response and computer forensics through a realistic client scenario.
Mission
CIRCUS (Collegiate Incident Response Competition for Undergraduate Students) is designed to bridge the gap between coursework and the real-world challenges of cyber incident response. Teams are tasked with investigating a reported breach against a fictional client, piecing together what happened, and presenting clear, defensible findings.
Students are scored on the completeness of their reports, professionalism, quality of recommendations, and their final presentations.
What Makes CIRCUS Unique?
- A strong emphasis on process — not just tools or "flag hunting".
- Focus on evidence handling, chain of custody, and defensible documentation.
- Deliverables that mirror professional work: written findings and oral presentations.
- Judging based on technical depth and clarity for legal, executive, and business audiences.
- A fun, accessible circus theme to keep the environment welcoming and engaging.
How the Competition Works
- Virtual Phase: Teams receive a statement of work and forensic images or logs from a compromised environment. They conduct analysis, document artifacts, and submit a formal incident report.
- Finals: Top teams in each division are invited to present their findings in person at the finals (currently planned to be hosted at SCALE in Pasadena, CA).
- Scoring: Scores combine artifact discovery, written reporting, and the quality of the final presentation and Q&A.
Who Should Participate?
CIRCUS is open to undergraduate students from:
- Community colleges and trade schools (Division II)
- Four-year colleges and universities (Division I)
Teams often include students from computer information systems, computer science, cybersecurity, digital forensics, networking, criminal justice, and related fields.