What do you do when you are not in school?
“Some decent college” will definitely be possible. My daughters applied to universities in Canada (including McGill) which did not even ask about ECs. You should be able to get into good in-state public universities with no ECs at all.
However, almost anything that you do outside of your school work is an EC. If you have a job, that is an EC. If you help your parents with a small business that they run, or if you take care of younger siblings, that is an EC. If you tutor other students, that is an EC.
An “extracurricular activity” does not need to be associated with a club or sport at your high school.
In terms of “learn by myself about cybersecurity”, which side were you on? I have heard that there are some cybersecurity experts who are now protecting networks, but who when they were young were active on the other side – and you might not want to tell us if you did anything too notorious.