Teaching cybersecurity means teaching all possible ways how software can be attacked -- and how to fight such attacks. From the usual pedagogical viewpoint, a natural idea seems to be to teach all these ways one by one. Surprisingly, a completely different approach works even better: when the class is divided into sparring mini-teams that try their best to attack each other and defend from each other. In spite of the lack of thoroughness, this approach generates good specialists -- but why? In this paper, by analyzing a simple mathematical model of this situation, we explain why this approach work -- and, moreover, we show that it is optimal in some reasonable sense.