capture the flag

Overview

The first widely recognized cybersecurity CTF was held at DEF CON in 1996. Early DEF CON competitions used custom vulnerable services on a shared system and primarily tested offensive security skills; later attack-defense competitions required teams to protect their own services while attacking identical services operated by other teams.

The two most common formats are jeopardy and attack-defense. In a jeopardy CTF, teams solve independent challenges worth a fixed or dynamically adjusted number of points. Common categories include cryptography, digital forensics, web exploitation, binary exploitation, and reverse engineering. Solving a challenge reveals a flag that is submitted to a scoring system. In an attack-defense CTF, teams are given equivalent vulnerable services and must keep their own services available, patch vulnerabilities, and repeatedly exploit opposing teams to obtain flags. Mixed competitions combine jeopardy challenges with attack-defense targets.

CTFs can cover a broad range of technical skills, including software exploitation, password cracking, network analysis, programming, and incident response. A study of 15,963 published CTF solutions found that challenges emphasized technical topics, particularly cryptography and network security, while human-centered subjects such as social engineering and cybersecurity awareness were comparatively underrepresented.

Educational applications

CTFs are commonly used in cybersecurity education because they combine hands-on exercises with competition and gamification. Reviews of cybersecurity competitions have found that well-designed CTF activities can increase engagement and provide opportunities to practice technical problem-solving, although their educational value depends on factors such as challenge design, learner preparation, guidance, and feedback.

Educational CTF platforms target a range of audiences. PicoCTF, organized by Carnegie Mellon CyLab, was created to introduce middle- and high-school students to computer security. Pwn.college, maintained by a team at Arizona State University, provides free challenge-based material and supports parts of the university's cybersecurity curriculum.

CTF-style exercises have also been integrated into university courses. One documented example used jeopardy-style CTF assignments in an introductory information-security course at the National University of Singapore.

CTF and related cyber-range exercises are also used by military academies and government training programs. The National Security Agency's NSA Cyber Exercise is a year-round education and training program that culminates in a competition for students from United States service academies and military colleges.

Competitions

Many organizers register competitions with the CTFtime platform, which maintains an event calendar, archives challenges and write-ups, and calculates seasonal ratings for teams and events.

Community competitions

CTFs are organized by security conferences, universities, companies, and independent community teams. Conference-associated events include the DEF CON CTF, HITCON CTF, competitions held at Security BSides events, and SANS Institute NetWars tournaments.

The DEF CON CTF is one of the longest-running major CTF competitions. It has been described by media outlets as the "World Series of hacking" and the "Olympics of hacking". Teams generally qualify through a separate qualification event before competing in the in-person finals. In 2026, DEF CON selected the Benevolent Bureau of Birds to organize the competition for a four-year term. The group brings together members of Carnegie Mellon University's Plaid Parliament of Pwning, the University of British Columbia's Maple Bacon, and The Duck, a team associated with the cybersecurity company Theori. Before becoming organizers, the three groups competed together as Maple Mallard Magistrates and won four consecutive DEF CON CTF titles from 2022 through 2025. Plaid Parliament of Pwning had participated in nine winning DEF CON CTF teams overall by 2025, the most in the competition's history.

The New York University Tandon School of Engineering hosts Cybersecurity Awareness Worldwide (CSAW), a student-run cybersecurity event whose competitions include a jeopardy-style CTF. The 2021 qualification round recorded more than 1,200 teams with at least one point.

Many community teams are associated with universities and organize their own events. Examples include Carnegie Mellon University's Plaid Parliament of Pwning and the University of California, Santa Barbara team Shellphish, which has organized the International Capture The Flag competition.

Some community events are online and open to a broad audience. Examples include the SANS Holiday Hack Challenge, which combines guided cybersecurity exercises with a CTF track, and TryHackMe's beginner-oriented Advent of Cyber challenge series.

Government-supported competitions

Government-supported competitions include the DARPA Cyber Grand Challenge, in which autonomous systems played a machine-only CTF in 2016, and the ENISA-supported European Cybersecurity Challenge.

In 2023, the United States Space Force-sponsored Hack-A-Sat 4 finals used Moonlighter, an operational satellite in low Earth orbit. Space Systems Command described it as the first CTF hacking competition conducted on an operational satellite.

Corporate-supported competitions

Corporations and other organizations use CTFs for workforce training, recruitment, and skills evaluation, as well as sponsor public competitions. Google, for example, operates a public online jeopardy competition and related experimental events.

Artificial intelligence and the decline of traditional CTFs

The increasing ability of large language model-based systems to solve cybersecurity challenges has prompted debate over the future of capture-the-flag competitions, particularly the jeopardy format. AI agents can analyze challenge files, invoke security tools, generate and test exploits, retrieve flags, and produce written explanations with limited human involvement. In a 2026 study of 41 participants in a live, on-site CTF, competitors delegated increasingly large subtasks to an AI assistant as the event progressed; when four autonomous agents were separately evaluated on the same previously unreleased challenges, the best-performing agent placed second overall and outperformed most participating human teams.

Competitive teams have also developed specialized CTF-solving systems. Squid Proxy Lovers, one of the first to develop an agent, reported that its Squid Agent framework solved 46 of 50 challenges in the CTFTiny benchmark, while remaining less reliable on novel, large, or long-context challenges.

The adoption of these systems has raised questions about what conventional leaderboards measure. Participants may obtain flags or complete solutions without understanding the underlying vulnerability, and differences in access to models, computing resources, or inference budgets may influence results. Researchers studying AI-assisted cybersecurity competitions have proposed measures such as separate autonomy levels, traceable submissions containing agent logs or code, and scoring criteria designed for human & AI collaboration.

Competition organizers have responded through restrictions and disclosure requirements. The rules for the 2026 DEF CON CTF Qualifier prohibited fully or primarily autonomous teams but allowed human competitors to use large language model-based tools when humans remained meaningfully involved in directing the work. Teams classified their AI use as No AI, Low AI, or Human-Led AI, with those classifications displayed on the public scoreboard.

Alongside conventional jeopardy challenges, the qualifier included King of the Hill (KoTH) and LiveCTF challenges. These formats repeatedly evaluated submitted programs or strategies instead of awarding points only when a team retrieved a single static flag.

In popular culture

In Mr. Robot, a CTF tournament is depicted in the third-season premiere, "eps3.0_power-saver-mode.h". The technical advisers for the series said the scene was based on real-world CTF events and used a challenge adapted from a previous security competition.

In The Undeclared War, a CTF is depicted in the opening scene as a recruitment exercise used by GCHQ.

Go Go Squid!, a Chinese television series, centers partly on characters training for and competing in fictionalized international cybersecurity competitions.