Tonight you work the night shift at a pretend company. Real-style alerts. Real detective work. Zero real people harmed — because that is the whole point. Finish your shift and you walk away with something priceless: stories you can tell in a job interview. 💼
There is one rule in this clubhouse that matters more than every other lesson put together. Read it twice. Then say it out loud.
Not your school's WiFi. Not your friend's phone. Not your neighbour's router. Not even to show off — and not even if you're sure you wouldn't break anything.
Touching a computer you don't have permission to touch isn't just unkind — in Nigeria and almost every country on Earth, it's a crime, even if you break nothing and take nothing. Nigeria's Cybercrimes Act covers exactly this. The very same click is completely legal on a practice range, because the owners of that range have written down, in advance: "Yes. Come in. Try things. That's what it's here for."
Permission is the whole difference. Same keyboard, same skill, same click — one is a career, the other is a criminal record. 🚪
Every defender makes this judgement a hundred times. Make it fast, make it right.
Reading "brute force attack" teaches a child four syllables. Watching a robot hammer 400 keys at a door while a human tries two — that lodges in the memory for years. Press play on each one. Watch it twice.
📶 Why these are drawings and not videos: every animation on this page is built from a few kilobytes of shapes and text — the whole lot weighs less than a single photo. A child on a ₦100 data bundle can watch them all, over and over, on a slow phone, with no buffering and no YouTube. That's deliberate. Learning shouldn't cost data.
Jollof Foods is pretend. Invented. Made of nothing but this web page. That's exactly why you're allowed to defend it as hard as you like. Six alerts will land on your screen tonight. For each one you decide: false alarm, or real attack?
Nobody gets hired for saying "I'm interested in cybersecurity." People get hired for saying "Here's an incident I investigated…" — and then telling the story. Every alert you solve tonight hands you one. Collect all six.
Everything below is a genuine practice range built by real security people, and every one has a free way in. But read the age tags carefully — some of these were built for grown-ups, and joining those needs a parent beside you.
Start here. Made by security professors at Carnegie Mellon University specifically for middle and high school students — it is the biggest free hacking competition in the world for people your age. The picoGym section is open all year round and is the gentle, no-pressure way in: puzzles about secret codes, hidden files and web tricks, every single one built to be legally broken. Free forever, no payment, no card.
The beginner defender path everyone recommends — rooms that walk you through logs, phishing and incident response in your browser. Plenty of free rooms. But: their own rules say they don't knowingly accept accounts from children, and a parent must set it up and agree to the terms. They also run a separate Classrooms version made for teachers — the right door if your school wants in.
The closest thing to tonight's shift, but for real: you sit at a working SOC console and handle real-style alerts on invented companies, exactly like a Tier 1 analyst. Has a free plan. Built for working adults, so a parent should create it and sit with you the first few times.
Defender challenges and full investigations — you're handed evidence from a pretend break-in and asked what happened. Free challenges available. Adult platform, so same rule: grown-up first.
These platforms are legitimate, widely used, and legal — they exist precisely so young people can build these skills without going anywhere near someone else's system. That said, most were designed for adults and ask for an email address and agreement to adult terms.
Our recommendation: start your child on picoCTF / picoGym. It was purpose-built for school-age learners by a university, it's free, and it needs nothing more than curiosity. For the adult platforms, please create the account yourself, keep it in your name, and sit with your child for the first few sessions. That way the one rule that matters — we only practise where we're invited — is something they learn from watching you, not just from reading it here. 💛
"I practise where I'm invited. I protect people who never find out my name.
That's what makes me a defender."