Learning by doing shouldn’t depend on luck.

After finishing my diploma and joining engineering college, I expected to explore cybersecurity much more deeply.

We did study networking, cybersecurity, and digital forensics. But most of the learning was lectures and theory. We rarely got to work with the technologies and environments we were reading about.

Then I got an internship that exposed me to industrial cybersecurity. I worked with industrial firewalls from five or six different vendors, and operational technology (OT) devices from around seven vendors, including Siemens and Rockwell. I also worked with a digital twin of a thermal power plant, and with the security tools built to protect and understand that environment.

It was the first time I could see how an industrial system operates, how its parts interact, and how the concepts from class turn into real work. I learned by trying things, breaking them, and troubleshooting, on technology students normally only meet in slides.

Being able to touch real devices and realistic environments changes how you understand a subject. A diagram of a firewall rule and a firewall that blocks your own traffic teach different things.

What stayed with me wasn’t only how much I had learned. It was that most of my classmates hadn’t had the same chance.

We went to the same college, studied the same subjects, and paid the same fees. Yet our opportunities to practice were completely different. So I kept asking myself: why should a student’s chance to learn by doing depend on getting lucky enough to find an internship?

So we started talking to faculty, wanting to understand why colleges couldn’t routinely offer deeper practical experiences. What we found was that it usually wasn’t a lack of willingness. It was the work behind it:

• Creating labs for different technical subjects.
• Configuring and maintaining technical environments.
• Managing resources for an entire batch of students.
• Repeating setup and reset between practicals.
• Finding time to maintain infrastructure alongside teaching.
• Adapting existing open-source environments to the curriculum.
• Supporting students with very different levels of technical knowledge.

We also saw that some freely available labs expect students to understand virtual machines, Docker, or complex configuration before the lesson starts. Experienced students move through familiar exercises quickly, while beginners can struggle before the learning even begins.

Students and faculty both needed an easier way to run practical technical education.

HackTheFort makes practical cybersecurity learning part of the normal college curriculum and scheduled practical sessions. Labs run in the browser, in isolated environments, so students don’t have to install and configure complex software. Faculty can assign curriculum-aligned exercises, monitor progress, and manage the session.

Today that includes labs in networking, security scripting and automation, and digital forensics, and we have run them with students in a pilot at SAKEC. The industrial environments from my internship are what inspired this work. They aren’t something HackTheFort offers colleges today, and our OT/ICS work is a separate track.

We don’t want to replace professors or traditional teaching. We want to remove the infrastructure and operational barriers that stop practical teaching from happening consistently.

We believe learning by doing shouldn’t depend on luck.