Computer science freshman makes U.S. Women’s Cyber Team

Ally Petitt, 18, is the youngest member of the first-ever team

By California State University, Bakersfield

November 22^nd, 2024

Within the span of four years, Ally Petitt taught herself how to code, moved onto self-studying cybersecurity, secured five internships and a full-time role performing vulnerability research and joined the U.S. Women’s Cyber Team.

At 18 years old, Petitt recently became the youngest member of the first-ever U.S. Women’s Cyber Team, a group of 11 who make up the national women’s team in a cybersecurity e-sport. The California State University, Bakersfield freshman computer science major made the minimum age limit by just one month.

“The primary goal of the organization, U.S. Cyber Games, is to use immersive cybersecurity challenges to train the next generation of cybersecurity professionals, and since cybersecurity by nature is very hands-on, gamifying certain types of cyber challenges is a great way to develop and strengthen industry skills,” Petitt said. “By virtue of being a team e-sport, competitions also foster soft skills such as collaboration that are vital to any profession.”

The U.S. Women’s Cyber Team, which started earlier this year, competes in “Capture the Flag” (CTF) tournaments, a series of cybersecurity puzzles that test competitors in a variety of real-world scenarios. Each woman on the team was chosen for their expertise in cybersecurity domains, such as attack and defense, vulnerability management, patch management and forensics.

Following her curiosity

Joining the team lets Petitt test herself on all that she has learned on her own at home since she was 14. As a student at Centennial High School, Petitt excelled in her classes but wanted to take control of her education and challenge herself beyond the standard curriculum.

“I just was very curious about the world, and I wanted to understand how the world worked,” Petitt said. “Sometimes that meant exploring scientific disciplines, other times it meant doing introspection and understanding my motivations and values.”

Petitt eventually landed in the realm of technology. She was drawn to coding because it was something she could start right away in her bedroom with just a laptop, fully taking advantage of the free time and access to the internet available to her. Teaching herself how to code required a lot of patience and perseverance, however. Petitt gave herself 20 hours to learn as much as possible about coding, and if she didn’t like it, she could give it up.

“It was very frustrating sometimes, but it was also that much more rewarding when I did figure it out,” she recalled. “I really liked the feeling of being able to take education into my own hands and not necessarily have to rely on an external criterion. I could go at it at my own pace in the way that was most suited for my interests and goals.”

With her newly honed skills in coding, Petitt landed an internship at MK Analytics, where she first learned of the concept of cyber-attacks. This was the catalyst for her investigation into the world of offensive security that led her to create a technical blog at ally-petitt.com, setting up home labs, and attempting to find security vulnerabilities within them. She eventually put her skills to the test in the real world, discovering 18 security vulnerabilities in digital infrastructure relied upon by several thousands of people, including that of the Department of Defense, and responsibly disclosing her findings for them to be secured.

The creativity of using an application’s own logic in an unexpected way fascinated her. The vast world of cybersecurity was one that appealed to Petitt, who has always followed her curiosity.

“There’s a constant learning curve, and I love that it’s so broad that I would always have something more to learn,” she said of the field. “I tend to enjoy exploring different ideas, so if I ever get stale of one area, I could just transition a millimeter over and there’s an entirely new world to investigate.”

Petitt has worked in five internships since March 2021, including ones for MK Analytics, Tech for Good Inc., Smart Course, the City of Bakersfield and Chameleon Consulting Group. Just before the city internship, Petitt earned a highly regarded certification in the industry — the Offensive Security Certified Professional (OSCP) — at just 16 years old, after passing a rigorous 48-hour hands-on assessment simulating a real-world network security assessment, becoming one of the youngest globally to attain it.

Currently, Petitt is a vulnerability researcher at Chameleon Consulting Group and does contract security research on the prestigious Synack Red Team, joining at the age of 17 and reaching the top 14% of 1,500-plus researchers on the platform within six months of joining.

Even though she’s already working in her field, Petitt wants to earn her degree in computer science to formalize her qualifications. Although she chose CSUB because of its affordability and proximity to home, the autodidact will cut her time on campus short after just one term to resume her college education at Western Governors University, an online school where she can finish classes at an accelerated pace and earn her degree within six months to a year.

Sylvia Petitt has had a front-row seat for all her daughter’s success in the world of cybersecurity. The proud mom said she could talk about her all day long.

“It's been an exciting journey to see her explore cybersecurity, blossom and find her passion,” she said. “It totally took me by surprise, as she wanted to be a doctor as a child. At first, I thought she was just trying new things, like teenagers do. I didn't know this would be her passion and she would be so good at it. My daughter a famous hacker!”

Petitt's set-up for the Kunoichi Cyber Games CTF in Tokyo

Making the team

Among her busy work and school schedule, Petitt also commits anywhere between two to 12 hours a week to the U.S. Women’s Cyber Team. Petitt was invited to apply to the team after participating in the U.S. Cyber Open Capture the Flag competition. If it was initially daunting to be the youngest member of the team, Petitt has already found her footing.

“It was initially intimidating due to the expectations that come with being on a national team, but I also knew that I have the skill to contribute,” she said of making the team as a binary exploitation and attack and defense specialist. “Being on the U.S. Women’s Cyber Team goes beyond myself. This team is one step towards a cultural shift that can help to attract more talent into cybersecurity, foster skill development through competition, create a pipeline for those entering the field, and ultimately enhance our national security as a result. It’s also a great source of motivation because I know that I am doing something that’s for a purpose larger than myself. So, while formidable, I have chosen to rise to the occasion.”

Cybersecurity — especially when working remotely as Petitt has — can be a solitary pursuit, but the team has connected her to a group of young women to work with and learn from, something that has already proven valuable.

“We’re a good skillset match and we all have something to learn from each other,” she said. “We do a sister mentorship type of program where we meet twice a week and we teach each other something new, because we each have our own areas of expertise. Everyone is highly motivated. I really feel like I’ve found my crowd of people, and the women’s cyber team members are remarkable.”

While some events and tournaments are held remotely, being on the team has already taken Petitt to Turin, Italy and Tokyo, Japan on nearly back-to-back trips this fall.

In October, Petitt attended the ENISA Cybersecurity Boot Camp in Italy, where she had the opportunity to complete hands-on hardware hacking challenges and learn about nuances of Windows heap exploitation.

Earlier this month, she and the team competed at the 2024 Code Blue Conference in Japan where Petitt collaborated with US Women’s Cyber Team members Shiloh Smiles, Gwen Vongkasemsiri, Lauren Delwich, Lily Gross, Eliza Hall and Carolina Hatanpaa to secure a second-place win in the Kunoichi Cyber Games CTF.

Prior to the competition, Petitt had the opportunity to partake in a traditional Japanese tea ceremony with teams from the UK, Europe and Japan. Following this, she visited a local middle and high school to give a brief talk about cybersecurity and guided the students in solving a cryptographic challenge. The team also had the chance to explore the city, visiting the Sensō-ji Buddhist temple and the Shibuya crossing, the busiest intersection in the world.

A park near the 2024 Code Blue Conference in Tokyo, Japan, where Petitt's team competed in the Kunoichi Cyber Games.

A slide from the Code Blue Conference explains the value of women's teams in cybersecurity sports.

Petitt explained that the reason U.S. Cyber Games has a separate team for women isn’t because those women couldn’t compete at the same skill level as men — in fact, the US Women’s Cyber Team has historically outperformed many male-dominated teams, she said. Rather, having an all-female team fosters additional opportunities for women to join cyber and creates a group of ambassadors for women in cyber to inspire the next generation.

“This is a hypothesis based on the historical observation that creating women-only teams in traditional athletics has led to a larger female presence within them,” she said. “Cybersecurity needs more talent, and by not catering to half of the population, the nation is ultimately missing valuable talent in the field.”

On the topic of being of woman in science, technology, mathematics and engineering, Petitt said it actually wasn’t something she thought about until people mentioned that she was in the minority in her profession.

“While the tech industry can be male-dominated, I’ve been fortunate to work with incredibly supportive colleagues,” she said. “I’m proud to be part of a team that values talent and dedication over gender. It’s inspiring to see more people, regardless of gender, breaking into this field and shaping the future of technology.”

Petitt said she’s often asked how to break into a career in cybersecurity. She credits her own success so far to doing what she could with what she had available to her. Setbacks are inevitable, she said, so the focus should be less on perfection and more on taking initiative to find a way to continue moving forward in your current situation. She believes that every moment presents an opportunity. It may not be the opportunity that is desired, but it is essential to be able to identify what you have available to you and create a course of action from there.

Whether it’s cybersecurity or something else, Petitt encouraged people to follow their curiosities and not suppress or ignore them.

“You don’t necessarily have to be the best or pursue it, but even just going out and researching something — and I don’t mean TikTok — it can be very insightful and lead you down some very interesting paths,” she said. “Case in point: me.”