This past weekend, UT RSOC students competed in Texas Tracer FIRE 14, a hands-on forensic and incident response exercise developed by Sandia National Laboratories for the U.S. Department of Energy. By the end of the competition, one UT team had earned second place overall in a field of 29 teams representing UT, UTSA, and Texas A&M.
Tracer FIRE is not a traditional capture-the-flag event. It’s designed to simulate the pace and complexity of a real-world cyber incident. This year’s scenario placed students inside a fictional energy company, “Hydro Haven,” experiencing catastrophic security breaches. Teams were responsible for analyzing compromised systems, conducting disk forensics, reverse engineering suspicious binaries, and uncovering how the attack unfolded.
Participants relied heavily on tools such as Autopsy for disk analysis and Ghidra for reverse engineering, platforms commonly used in forensic investigations. Notably, these are not the primary tools used inside the UT RSOC environment. That meant students had to quickly adapt to new software and workflows while still maintaining investigative discipline under time pressure.
Despite operating outside their normal tool stack, David Lungu. and his teammates secured second place with 8,748 points. First place finished with 10,208 points, and third place earned 8,338; a tight margin that reflected just how competitive the event was at the top.
For many students, the experience reinforced the importance of adaptability and collaboration.
As Noah Wong shared, “A big part of it was not being afraid to ask questions and getting help when we got stuck.” He also emphasized that “Adapting and learning new things were the most important skills.”
The pace of the competition required teams to divide responsibilities strategically, correlate evidence across multiple systems, and validate findings before submission. There was little room for guesswork and every point mattered.
Reflecting on the experience, David Lungu. described it as “a fun and challenging experience where I worked through real-world scenarios using industry-grade tools.” He noted that “The fast pace allowed me to think on my feet and learn new tools quickly,” and that the exercise showed him “how important teamwork and effective communication are in the process of tackling APTs.” He added that “Learning on my own and working with my team gave me a great window into the world of cybersecurity.”
The event itself was coordinated locally by one of UT’s RSOC students, Miranda Portales who served as host coordinator for the second time. Sandia National Laboratories flew in two representatives to lead workshops and guide participants through the investigative framework and tooling environment.
Reflecting on the broader impact, the Miranda shared that “Organizing the competition is always a wonderful experience,” and that it is “especially rewarding to see the experience that fellow students get to have as they work through exercises.” She recalled one memorable moment when “one of the Sandia reps mentioned Sunday morning that one of the teams from UT had been solving problems at 3am.” Ultimately, she said that what stands out most is “getting to be a part of the cybersecurity community at UT and being surrounded by such bright and innovative minds.”
Exercises like Tracer FIRE reinforce the strength of foundational training. When students understand investigative methodology how to approach a breach, how to validate artifacts, and how to think critically about attacker behavior they can succeed regardless of the specific tools placed in front of them.
Beyond the final rankings, the competition demonstrated the depth of cybersecurity talent across Texas. Students from UT, UTSA, and Texas A&M worked through the same complex scenario, each bringing different approaches and strengths to the challenge.
Congratulations to David Lungu and the second-place team, and thank you to all RSOC students who participated and represented UT with excellence. Their performance highlights not only technical skill, but adaptability, teamwork, and the confidence to tackle complex investigations in unfamiliar environments.
Exercises like this validate the hands-on training model of the RSOC and the readiness of its student analysts.