A CTF, short for capture the flag, is a cybersecurity competition in which participants solve security challenges to retrieve hidden strings of text called flags. Organizers plant those flags inside deliberately vulnerable programs, websites or systems, so reaching one takes real security knowledge. Points scale with difficulty, and whoever collects the most before the clock runs out wins.
In 2025 our team finished first in Latin America and ninth worldwide at the HTB Business CTF, against 795 corporate teams and 4,549 participants. We also run our own CTF, now four editions in.
This page covers what a CTF is, the two formats you will meet, the challenge categories behind them, how scoring and rankings work, and where to compete. It also covers what a CTF score says about someone's security skill, and what it does not.
What is a CTF?
A CTF is a contest where participants solve challenges to catch flags hidden by the organizers. A flag is just a string. It may look like flag{you_found_me} or follow whatever format the organizers publish, and it only appears once the work is done: the injection exploited, the cipher broken, the binary understood.
Participants play alone or in teams, inside a window that runs from a few hours to several days. Each challenge carries a point value tied to its difficulty. The individual or team with the most points at the end wins, sometimes with cash prizes, sometimes with nothing but the ranking.
Scoring is rarely as static as it looks. Platforms such as CTFd support dynamic values, where a challenge starts high and decays as more players solve it, so the board reprices difficulty by what the field actually did rather than by what the organizer guessed. Ties break on time: when two players finish level, the earlier solve ranks higher. A CTF can come down to who got there first by a minute.
What a CTF is not is a penetration test. Every task on the board is built to be solvable, and the flag confirms you got there. A real target has no flag, no guarantee that a vulnerability exists at all, and nobody to tell you when to stop looking. The techniques overlap. The conditions do not.
Types of CTF competitions
CTF events fall into two formats, and the format changes what the event actually measures.
Jeopardy-style
A Jeopardy-style CTF presents a board of independent challenges sorted by category and difficulty. You pick one, solve it, submit the flag, and move on. Nothing you do affects other players, so the event rewards breadth and individual depth. Most online events use this format, and it is the one beginners should start with, because you can choose tasks that match your level. Google CTF, PlaidCTF (run by Carnegie Mellon's Plaid Parliament of Pwning), HITCON CTF and 0CTF are long-running examples.
Attack-Defense
An Attack-Defense CTF puts every team on the same vulnerable infrastructure. You patch your own services while exploiting the identical flaw on everyone else's, and you lose points if your service goes down. That last rule is what makes the format hard: a patch that breaks functionality costs you as much as the exploit you failed to block. Organizers check availability throughout the game, which turns every fix into a timed decision rather than a clean one. The DEF CON CTF finals are the best-known example, and RuCTF, organized by HackerDom, is another.
Some events mix both, running a Jeopardy board during qualifiers and switching to the defensive format for the final. That progression is deliberate: qualifiers need to scale to thousands of online players, while the finals need a format that can only be played well by a team sitting in one room.
| Jeopardy-style | Attack-Defense |
Infrastructure | Central server hosting independent challenges | Identical vulnerable services on every team's network |
How you score | Flags captured, weighted by difficulty | Flags stolen, services kept alive, patches that hold |
Typical length | 12 to 48 hours, often online | 8 to 10 hours, usually on site |
What it rewards | Breadth across categories, individual depth | Coordination, triage under pressure, defensive judgment |
Best for | Learning and skill building | Teams that already specialize |
The format decides what the event measures: a Jeopardy board tests range, a live defense game tests how a team holds up when it is being attacked back.
CTF challenge categories
A CTF board covers a wide spread of security disciplines, and the spread is deliberate. Real security work rarely fits one box.
Web exploitation tasks hand you an application and ask you to find the flaw that gets you in, from SQL injection to cross-site scripting. Cryptography challenges give you a cipher, a protocol or a badly used primitive to break. Reverse engineering gives you a binary with no source and asks what it does. Binary exploitation goes one step further: understand the memory bug, then turn it into code execution. Forensics and steganography hand you a memory dump, a packet capture or an image, and the flag is hidden inside.
Three of those staples map directly onto weaknesses we document from real client engagements.
CTF challenge category | Weakness in our catalog | What it looks like in a real engagement |
Web exploitation | Dynamic queries built by concatenating untrusted input, with no parameterization | |
Binary and system exploitation | External input reaching an OS command, letting an attacker run unauthorized code | |
Client-side injection | Web content generated dynamically from a source the application never validates |
The categories on a CTF board are not invented puzzles. They are the same weakness classes our pentesters report to clients.
The difference is how much of the work the board hands you for free. In Fluid Attacks' benchmark of 36 third-party AppSec tools against a target with 1,201 vulnerabilities across 105 CWE categories, a pentester reported 1,076 true positives, 89.6% recall at 100% precision, over 49 days. Of those, 743 findings, 61.9% of the total, were reported by the pentester and by nobody else. On a CTF board, a task exists because someone put a flag in it. In production, most of the finding is deciding where to look, and the categories give you no map.
This is also why category labels are a weak proxy for skill. Two tasks filed under the same heading can sit three difficulty tiers apart, and a player who clears every easy web task has not demonstrated the same thing as a player who cleared one hard one. Read a scoreboard by what was solved, not by how many headings it touched.
CTFs at Fluid Attacks
We compete, we host, and we built the math that ranks the results. Each of those gives a different view of what a CTF can and cannot tell you.
What we run, and under what rules
The Fluid Attacks CTF is an individual competition open to security professionals, pentesters, students and enthusiasts, mostly across Latin America. Participants exploit challenge scenarios, submit flags on the platform and watch the leaderboard move in real time. Four editions have run so far.
Edition | Date | Length | Prize pool | Players | Challenges |
2025-1 | October 11, 2025 | 24 hours | USD 1,000 | 73 | 20 |
2026-1 | January 24, 2026 | 24 hours | USD 1,000 | 299 | 20 |
2026-2 | July 4, 2026 | 12 hours | USD 3,500 | 267 | 21 |
2026-3 | September 26, 2026 | 12 hours | USD 4,000 | 139 | 20 |
Four editions of the Fluid Attacks CTF. The event is registered on CTFtime and the Hall of Fame carries scores across editions.
The Hall of Fame tracks accumulated scores across every edition, not just the most recent one.
Competing, not just hosting
In 2025 our team entered the HTB Business CTF, a Jeopardy-Cloud-Fullpwn event that ran for 96 continuous hours across 16 categories. Simon Correa, our Head of Research, describes it as "a competition where participants work in teams to solve challenges sorted by category and difficulty." Against 795 corporate teams and 4,549 participants, 14 of our people logged 754 hours between them and solved 59 of the 66 challenges. Correa's summary:
"We ranked #1 in Latin America and #9 worldwide."
That did not happen in one jump. The same team placed #80 worldwide in 2021 and #35 in 2024. Go deeper: how our team prepared and what each category demanded.
Scoring groups fairly
Ranking individuals on a leaderboard is arithmetic. Ranking the organizations they belong to is not. As Michael Rivera, our Chief Data & AI Officer, puts it:
"The central issue of group evaluation […] is how to aggregate the results of participants."
A plain average rewards the company that sends only its three best people and punishes the one that sends forty. Taking the average of a group's top three fixes that incentive, but a larger group still has more chances of containing a high scorer.
Our answer is Top 3 over Expected with Bayesian shrinkage: divide a group's observed top-3 average by the top-3 average a group of that same size would be expected to reach, with the expectation drawn from a Monte Carlo simulation of 1,000 repetitions over the real score distribution of the 2025 edition. Shrinkage then pulls small groups back toward the mean, with a critical mass set at five participants. Go deeper: the full algorithm, with the simulations.
Competing with and without AI
Our recent editions split the prize pool in two. The AI-prohibited track pays USD 1,800, 900 and 500 for the top three places; the AI-permitted track pays 400, 300 and 100. It is the same board of challenges, scored in two separate races.
The split exists because the two tracks answer different questions. The AI-prohibited track measures what a person knows without assistance. The AI-permitted track measures something closer to the job most security engineers now do. Collapsing them into one leaderboard would have made both unreadable.
Recent editions score the same challenges twice: once for players working unassisted, once for players using AI.
What a CTF score does not measure
The board rewards reaching the flag. A security engagement rewards reaching the flag, then reproducing it, writing it up, rating its severity and explaining it to the developer who has to fix it. None of that is scored.
That gap is measurable. A 2026 psychometric analysis of five editions of a national CTF event, covering 94 challenges, 58 teams and 1,393 submission attempts, found reliability estimates between 0.72 and 0.82, but also that ethics, communication and risk management did not appear in the competency coverage at all, and that author-assigned point values correlated only weakly with observed difficulty. The authors' conclusion is blunt: "reliability alone does not establish validity."
We act on that internally. Candidates for our pentesting roles do face a practical interview with challenges across several categories, among them secure code review and web and mobile testing. But the challenges are one part of the evaluation, not the evaluation. A strong result tells us someone can find the bug. It does not tell us they can hand it to a client in a form the client can act on.
Why CTF competitions matter
A CTF is the cheapest legal way to practice offensive security against a system you are allowed to break. That matters more than it sounds: ethical hacking skills are hard to build without a target, and most people do not have one.
Institutions treat the format as workforce development, not recreation. NIST, through its NICE initiative, lists CTF events among the competitions it tracks and notes that they "have become an increasingly popular way for students to learn more about cybersecurity and develop and refine their hacking skills." ENISA runs the European Cybersecurity Challenge on the same reasoning, won by Sweden in Bochum in 2026, and co-organizes the International Cybersecurity Challenge, where Team Europe has now taken five consecutive titles.
Our pentester Óscar Uribe, who competed in the ICC, is direct about how a team is built for that level:
"The idea of there being several people on the team is that they are good at different things […] Ideally, each person should be a specialist."
Elite events bear that out. Carnegie Mellon's 2025 DEF CON CTF win, its fourth consecutive and ninth overall, came out of a field of more than 2,300 teams narrowed to 12 finalists, and the team's own account credits coordination as much as technique: "DEF CON CTF involves a lot of teamwork and communication."
There is a hiring angle too, and it cuts both ways. Security firms do scout at the larger events, and a visible ranking gives a career changer something concrete to point at when they have no professional history yet. But the signal is narrow. A CTF result tells a recruiter how someone performs on a bounded problem with a known answer, over a weekend, usually alone.
The honest limit: the evidence links participation to engagement and confidence more reliably than to demonstrated competence on the job. Treat a strong finish as a signal worth investigating, not as a credential.
Where to find CTF competitions
CTFtime is the index. It lists upcoming events with their format, dates and registration links, and assigns each one a weight that feeds its team rating. By CTFtime's own rating formula, that weight depends on the tasks, the organizers' track record, the teams that showed up and public voting, so it is a proxy for how strong the field was, not a difficulty label the organizer picked. Sorting by it is the fastest way for a newcomer to find an event they can actually finish, and the running team ranking is a better reference than any static top-ten list.
For practice between events, CyLab Security Academy (formerly picoCTF, run by Carnegie Mellon), TryHackMe and Hack The Box offer challenges you can work through at your own pace. Treat those platforms as the gym and a live CTF as the match: the platforms let you retry forever, which is exactly what a timed event removes. Working through a category there before entering an event that features it is the cheapest way to avoid spending a whole competition stuck on a technique you have never used.
Major conferences host flagship events: DEF CON and BSides draw competitors worldwide. In Latin America, look at Ekoparty in Argentina, JCUN and DragonJARCON in Colombia, PWNEDCR in Costa Rica, 8.8 across the region, and the Fluid Attacks CTF, which is open to pentesters, red teamers, students and anyone who wants the practice.
Conclusions
A CTF is a competition in which you solve security challenges to capture hidden flags, in one of two formats: a Jeopardy board that measures range, or a live defense game that measures how a team performs while under attack. A CTF board is not invented puzzles either. Its categories, among them cryptography, reverse engineering, binary exploitation and forensics, map onto weaknesses that show up in real applications, including the SQL injection and command execution flaws we report to clients every week.
What a CTF measures well is technical reach under time pressure. What it does not measure is everything that happens after the flag: reproduction, documentation, severity, and the conversation with the person who has to fix it. Institutions from NIST to ENISA back the format as workforce development, and the research backs it as practice. Neither backs it as proof of competence.
So compete, host a CTF if you can, and study how the scoring works before you trust a leaderboard. Just do not mistake the scoreboard for the job.
Frequently asked questions
What is a CTF in cybersecurity?
A CTF is a competition where participants solve security challenges to find hidden strings called flags. Organizers hide those flags in deliberately vulnerable programs, websites or systems. Each task is worth points based on difficulty, and the player or team with the most points when time expires wins.
What is the difference between a Jeopardy-style and an Attack-Defense CTF?
A Jeopardy board gives everyone the same set of independent challenges; the defensive format gives every team identical vulnerable services to patch and exploit at once. Jeopardy rewards breadth across categories and suits beginners. The second format rewards coordination and defensive judgment, since a service you break while patching costs you points.
Are CTF competitions good preparation for a cybersecurity job?
They are useful preparation, not a credential. The format builds hands-on technique in a legal environment, and recruiters do watch the major events. But a 2026 analysis of 94 challenges across five editions of one national event found that ethics, communication and risk management did not appear in the competencies measured at all. Those are the parts of the job that follow the flag.
How can an event rank organizations of different sizes fairly?
By comparing each group against what a group of its size would be expected to score, not against other groups directly. Fluid Attacks uses Top 3 over Expected with Bayesian shrinkage: the average of a group's three best players, divided by the expected top-3 average for that group size from a 1,000-repetition Monte Carlo simulation, with small groups pulled back toward the mean.
Does Fluid Attacks run its own CTF?
Yes. The Fluid Attacks CTF has run four editions, the most recent in September 2026, with a USD 4,000 prize pool across 20 challenges. Recent editions split prizes between an AI-prohibited and an AI-permitted track. Our team also competes: in 2025 it placed first in Latin America and ninth worldwide at the HTB Business CTF, among 795 corporate teams.
Put your skills against a real attack surface
Our pentesters and scanners test your applications the way a CTF player tests a challenge, except the flags are real vulnerabilities in production code and there is nobody guaranteeing they are there. Start free trial · Contact us.
Get started with Fluid Attacks' PTaaS right now
