NSA Codebreaker Challenge Holds Lessons for Embry-Riddle Student

Embry-Riddle Aeronautical University student Michael Boehm had attempted the National Security Agency’s Codebreaker Challenge every year since his freshman year.

Each time, he got further. This year, he solved it.

“I kind of think of cyber investigations like murder mysteries,” he said. “You get a new clue, and you have to go back and re-evaluate everything.”

A senior pursuing a degree in Cyber Intelligence and Security, Boehm became the first Embry-Riddle student to complete all seven tasks of the challenge, which requires students to take on the role of an NSA Cyber Response Team member defending military networks from a sophisticated adversary.

More than 7,000 students from over 500 institutions competed in the 2025 NSA Codebreaker Challenge. Students compete separately and collaboration is prohibited, but overall scores for schools are tallied. Thirty-six Embry-Riddle participants contributed to the university earning a No. 10 national ranking in Division 2. Boehm was the top scorer for Embry-Riddle.

“It takes a lot of persistence, a lot of grit, a lot of determination to keep on working on it,” Boehm said. “They try to make it difficult.”

The competition unfolds like a simulated cyber investigation. Across seven tasks, competitors move through forensics, network analysis, reverse engineering, cryptanalysis and exploitation. They must build on previous discoveries during the investigation.

“It’s chronological,” Boehm said. “You’re only allowed to work on one problem at a time. Once you complete that, you get a new problem.”

Early challenges required analyzing a compromised Linux system, tracing malicious network traffic and deobfuscating malware.

Progress depended less on brute force than on recognizing subtle weaknesses, Boehm said. For example, Boehm identified a flaw in the implementation of an encryption algorithm that reduced the number of possible combinations.

The final task — reverse-engineering a custom Android application and exploiting a vulnerability to gain remote access to a simulated adversary device — tested everything he had, Boehm said.

“I had never touched the technology,” he said. “There were multiple eight-hour sessions of looking at it like, ‘Nope, that didn’t work. Nope, that didn’t work.’”

While earlier tasks took Boehm hours or days to complete, the final challenge stretched for two months. At times, he stepped away entirely.

“I gave up a few times on task seven. I kept thinking, ‘I don’t know what I’m doing. This is for someone else.’”

Each time, he returned.

Eventually, he identified and exploited a flaw in the application’s file-handling logic, completing the challenge on Dec. 17. Of the 7,000 students who entered the 2025 NSA Codebreaker Challenge, only 82 completed it.  

“Michael’s achievement reflects the rare combination of technical depth, persistence and intellectual curiosity that we strive to cultivate in our students,” said Dr. Krishna Sampigethaya, professor and chair of the Cyber Intelligence and Security Department. “Completing the NSA Codebreaker Challenge — something only a small fraction of participants nationwide accomplish — demonstrates not just mastery of cybersecurity concepts but the resilience to tackle unfamiliar problems.”

Embry-Riddle’s Cyber Intelligence and Security program is designated as a National Center of Academic Excellence by the NSA and the Department of Homeland Security. Boehm said his coursework provided a foundation for taking on the challenge, but success required extensive self-directed learning.

Now he is preparing to graduate under the National Science Foundation CyberAICorps Scholarship for Service program, which positions him for a career with U.S. government, including local, state and tribal agencies.

“I’ve been trying to solve Codebreaker since I was a freshman," he said. "Senior year, I finally did it.”