About PISCES - PISCES International

Programs

Your Most Important Questions, Answered

Why is PISCES needed?

PISCES trains a future workforce of entry-level cyber analysts to meet the ever-growing demand for businesses to adapt to and protect against dynamic cyber threats. Municipalities and communities facing similar vulnerabilities need these services but in many cases are unable to secure the resources to meet their needs. For municipalities, collaboration with universities and students helps them meet these needs and remain protected.

What are the students' key capabilities and for what types of jobs are they prepared?

Students are trained to process large volumes of live data, particularly network flow data. They develop alerts from an embedded intrusion detection system, monitor real-time data streams, and detect irregularities. They analyze these irregularities to determine the validity of potential attacks or malicious activity and report credible threats. These qualifications prepare them for roles across various industries.

What are the incentives for getting involved?

Students gain exposure to top-tier hiring companies, increasing their job prospects upon graduation. Companies benefit from access to well-trained employees, and universities enhance their reputation and alumni employment statistics.

How sustainable is PISCES and how will you maintain the program?

The program is currently supported by volunteer efforts, grants from the Department of Homeland Security, and State appropriations. Future sustainability will rely on partnerships with public and private hiring organizations and contributions from the private sector.

Data Collection, Retention, and Security

What are you going to do with our data?

PISCES collects only packet headers and alerts from an intrusion detection system—no personal, financial, or private data. The monitoring system operates from a secure Cyber Range.

Do the communities have any insight into the data?

Yes. A community liaison oversees findings and outreach, and alerts are sent to participating communities regarding suspicious activity. Community partners may request data extractions for internal investigations.

What is the PISCES data retention policy?

Data is retained for 90 days in a first-in, first-out stack.

Do any third parties have access to the data?

No.

How is data collected from the network?

PISCES data collectors ship with a network tap to collect data, avoiding dependency on customer networking equipment. Deployment causes a brief, (~1 second) network outage. Alternatively, data may be collected through spanning ports on the network edge switch.

Can a data sharing partner get access to the intrusion detection system services or alerts?

No, but students can retrieve relevant data upon request. Beginning in 2026, community partners will also be given access to data from the on-premise device.

If the data sharing partner asked for a data retention policy to be instated, would you be amenable to adding that?

No. PISCES is not a system of record and does not set retention policies.

What about public disclosure?

No. PISCES does not originate data and is not subject to public records requests.

Does the ELK stack include anything that would actively interfere with the data sharing partner’s infrastructure?

No. Data collection is passive, and monitoring occurs off-site.

How do we maintain security of the data?

Security measures include:

Physical and virtual network isolation per state
TLS encryption and rotating TLS certificates
Hardened Docker containers
Built-in Elasticsearch protections, including encrypted communications and role-based access control
Periodic security testing by the National Guard

Academic Institution Participation and Curriculum

Who helps a new academic institution understand how to join and administer their part of the program?

PISCES International provides onboarding, answers questions, facilitates agreements, and hosts an annual academic workshop.

Who helps a new school figure out how to deliver the curriculum?

Western Washington University leads onboarding. In the future, a lead academic institution in each state will take on this responsibility.

Are there standardized performance metrics (e.g., students taught, students passed) and, if so, how are they reported?

Yes, though within privacy limits. Professors may report student completion numbers. Feedback is also collected on students’ perceived benefits and employer satisfaction.

How is the curriculum standardized and who determines what is best?

PISCES aligns curriculum with the National Institute of Standards and Technology’s cybersecurity education framework and gathers annual instructor feedback for improvements.

How is the curriculum maintained? Shared?

Western Washington University maintains the master curriculum, while schools tailor it to fit their programs. The annual academic workshop gathers input for updates. A second course is being developed based on feedback.

Technology Maintenance and Operations

How are the technology platforms maintained?

PISCES International, in collaboration Western Washington University, maintains the infrastructure and Cyber Range operations with a dedicated engineering staff.