Why CTF Competitions May Be More Important Than Ever

Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.

As artificial intelligence squeezes early-career learning opportunities, capture-the-flag contests could be one way to help pick up the slack.

Artificial intelligence may be gobbling up entry-level jobs and learning opportunities for security practitioners, but it can't erase the value of hands-on experience with enterprise systems and security tools.

No matter how much agentic action cybersecurity teams embed in their security operations center (SOC) and the rest of their programs, there's got to be smart people backstopping that work. And the only way that these "humans-in-the-loop" can do that capably is if they build up the kind of judgment that's best learned from the school of hard knocks.

The problem is that with SOC tier 1 analysts becoming an endangered species and bug bounty programs on the ropes from a glut of AI submissions, the chances are dwindling for newbies to rack up real-world experience.

What's the security industry to do? There's no great fix to this career pipeline problem just yet, but some of the answers might be found in one of the industry's age-old mechanisms for both camaraderie and skill-building: the trusty capture-the-flag (CTF) competition.

"CTFs give passionate talent the opportunity to grow and learn in ways that they might not have at their day jobs," says Jason Walker, a security engineer by day at SaaS firm Five9. An avid CTF competitor, he won the Sentinels League competition, sponsored and run by SentinelOne, beating two other finalists from a field of thousands of competitors worldwide. Besides street cred, Walker picked up a $5,000 prize for his efforts and a $10,000 donation in his name to his charity of choice, Trans Lifeline.

The livestreamed event offered the spectacle and fun of an esports competition, but it may hold deeper clues about how the industry can keep refreshing its talent pool in the coming years. As Walker puts it, CTFs are the ultimate way to expose both new and experienced cyber professionals to a wider range of problems and technologies.

"CTFs have helped me be a lot more versatile. Because if your company is running well and your program is mature, you aren't going to necessarily be firefighting new things every week. You're not going to be exposed to every new technique and threat," he says. "Doing capture the flag events and other hands-on training is a really important way to make sure you can stay up to date."

State of CTF Today

CTF competitions come in many shapes and sizes, but fundamentally challenge players to find hidden pieces of data called "flags" buried inside intentionally vulnerable systems. Most fall into one of two formats. Jeopardy-style events, the kind Sentinels League runs, hand out standalone puzzles across categories such as web exploitation, forensics, and cryptography, with points awarded per solve. Attack-defense events ask each team to defend its own vulnerable network while trying to break into everyone else's.

The attack-defense format took shape at DEF CON's CTF, which began in 1996 and remains the event most closely associated with it. It has sprung forth a wellspring of CTF formats that range from grassroots industry events to big vendor-sponsored competitions like the Sentinels League.

Sentinels League grew out of ThreatOps, a set of internal games SentinelOne's solutions engineers have run since 2020 to teach customers how to hunt through telemetry for hidden flags. This year's championship built on that with four games — Endpoint, Cloud, SIEM, and AI — spread across 12 weeks of qualifiers between June and October

The opening player pool of 2,236 entrants came from more than 100 countries and competed for a total prize pool of $100,000. Smaller prizes are dispensed across the qualifier and regional events, with the bigger prizes kept in reserve for the final, which was held in conjunction with SentinelOne's annual OneCon event.

Ryan O'Grady, director of SE operations at SentinelOne, says the firm invests money in the prizes and the considerable logistics of running such a big event as a way to give back to the community, build expertise and exposure to its platform, and serve as a recruiting tool.

Whether motivated for the prizes or the training, the appetite for the event just keeps growing. This year's drew enough interest that the company had to get a bigger ballroom to accommodate spectators.

Sentinels League is just one example of what a CTF looks like, across a much broader spectrum of competitions available out there. On CTFtime, the volunteer-run archive that tracks the hobbyist side of the scene, last year's calendar alone listed more than 200 individually organized events, with active teams from countries spanning every populated continent.

DEF CON CTF, often called the World Series of hacking, pulled 673 teams through its 2026 qualifiers before finals in Las Vegas this August. The National Cyber League, a nonprofit circuit O'Grady competes in himself, drew more than 7,500 students from 670 schools and universities this spring. Kaspersky continues to run its own wildly popular SAS CTF out of Bali.

Other, more academic events like New York University's CSAW and Carnegie Mellon's picoCTF run student-focused versions. Larger consulting firms, such as KPMG, use the format to scout for corporate recruits.

Won't AI Kill CTFs, Too?

In spite of the obvious demand for CTFs, as evidenced in the number of events held worldwide and the thousands of participants willing to sink their personal time into these pursuits, many security pundits worry about what AI will do to the purpose and the purity of these competitions.

CTF organizers are thinking deeply about what this means for their rulebooks and how they enforce them. RITSEC's 2026 rules ban using AI to autonomously solve challenges outright, calling it against the spirit of the competition. Meantime, NYU's CSAW has leaned into AI, this year creating an entire track built around using large language models (LLMs) to solve past CTF problems.

DEF CON CTF's 2026 qualifier split the difference. It barred fully autonomous AI teams but let human competitors use AI tools as long as a person stayed meaningfully in charge, and it required every team to label itself No AI, Low AI, or Human-Led AI on the public scoreboard.

A recent study of hundreds of Hack The Box machines released between 2017 and 2025 found solve times dropping roughly 16% a year, with the steepest declines after 2022. The hardest tier of challenges went from a 15-hour median solve down to about five, according to penetration tester Jacob Krell of Suzu Labs, who did the analysis.

He's not the only one worried. An academic study earlier this year from IBM Research and The College of William & Mary pitted 41 participants in a live, on-site CTF against four autonomous AI agents. It found that those agents placed second overall, ahead of most of the human teams competing.

Findings like these are enough to get firms like OtterSec, a blockchain security firm, to make noise about how to "save" CTFs. This summer the firm launched a $100,000 "Save CTFs Fund" to bankroll new formats that stay meaningful as AI keeps improving.

Why CTFs Matter More Than Ever

O'Grady doesn't buy the death-of-CTFs talk. In his view, AI just forces organizers to redesign CTFs so they still force a human to think laterally, AI assistance or not.

AI may not be killing creative CTFs anytime soon, but it is definitely making cybersecurity's career ladder wobble. In the process, it may actually be making CTFs even more crucial.

SANS Institute polled nearly a thousand security leaders and found that unclear career progression was one of the top hiring challenges. It was cited by 32%, more than triple the rate last year. Only a quarter of organizations say they have a clearly defined career path, and entry-level jobs that used to train the next generation of defenders are diminishing. SOC and security analyst roles lead the AI-driven cuts, down 32%. Threat intelligence analysts are next at 26%, with incident responders close behind at 22%.

Bug bounty programs are buckling under AI's pressure. At the start of the year, maintainers of the open-source project Curl shut their program down after a massive influx of junk AI submissions. HackerOne paused its Internet Bug Bounty program in April after a wave of low-quality, AI-assisted reports flooded in. And this month, Google Bug Hunters similarly paused its open-source bounty program due to similar problems.

These are all blows for cyber career progression, as bug bounty problems were another great place for security professionals to flex their skills publicly and for newcomers to gain a foothold into the industry.

As long as CTF organizers can keep their competitions relevant, these events will remain a valuable puzzle piece in the skills-training picture for the industry, alongside other important hands-on challenges like cyber ranges.

"With LLMs basically sweeping the table on bug bounties, it's become even harder than it already was for people to get out there, show off their skills, and get their name out there," O'Grady says. "AI has only increased the importance of CTF events like this."

Thoughts from a CTF-Runner

Ryan O'Grady offers insights into how building CTF games is a distinct discipline, and how CTF designers can begin adapting to AI.

• Running a CTF isn't for the faint of heart: "It's a long process of building the games, testing them, getting the games out there and in the hands of the players, making sure everything keeps running, and then making sure everyone's playing fair."

• O'Grady's team sorts challenges into difficulty tiers and tests each flag internally: "Sometimes we create a challenge that I think should be doable in five minutes, and it turns out it takes 30 minutes."

• The toughest flag challenges are the most fun and most difficult to design: "To come up with a flag that is extremely challenging, I have to think laterally [to] force players to go through multiple steps or to think about things in a different way.

• Using LLMs should be built into CTFs: "It adds a wrinkle to competition, and people often ask, 'Is that cheating?' That's just something we have to think about and design for as creators."