Key takeaways
- Jeopardy is the default for college fests, beginner-heavy events and anything with more than a few dozen teams. It scales easily, is forgiving, and tests breadth.
- Attack-defense tests depth under pressure: exploitation, patching, monitoring and teamwork, all at once. It needs more infrastructure, more staff and stronger teams.
- The most common hybrid is a jeopardy qualifier followed by an A/D final for the top teams. King of the hill sits between the two.
- Pick the format by audience and goal first. Budget and infrastructure come second.
How a jeopardy CTF works
A jeopardy CTF is a board of standalone challenges grouped by category and point value. Each challenge hides a flag, a string like CTF7{This_is_an_example_flag}. Players find it and submit it for points. The challenges don't depend on each other, so a team can skip crypto entirely and spend the whole event on web.
Typical categories are web exploitation, cryptography, binary exploitation (pwn), reverse engineering, forensics, OSINT and misc. Our CTF categories guide covers what each one involves. A well-balanced board has a few easy warm-ups in every category, a solid middle tier and one or two hard challenges that separate the top teams.
Static vs dynamic scoring
With static scoring, a challenge is worth the same points no matter how many teams solve it. It's simple and predictable, but it relies on the author guessing difficulty correctly. With dynamic scoring, a challenge loses value as more teams solve it, so the board sorts out real difficulty on its own. A common decay curve looks like this:
value = max(minimum,
((minimum - initial) / decay²) × solves² + initial)
# initial = 500, minimum = 100, decay = 20
# 0 solves → 500 points
# 10 solves → 400 points
# 20 solves → 100 points (floor)Scores are usually recalculated for everyone, including teams that solved early. Tiebreaks go to whoever reached the score first. Many events also add bonus points for the first team to solve a challenge and hints that cost points. For decay formulas, tie-breaks and hint pricing in more depth, see how CTF scoring works.
How an attack-defense CTF works
In an attack-defense (A/D) CTF, every team gets an identical vulnerable machine or network segment, called a vulnbox, running the same set of services. Those might be a custom web app, a binary daemon or an API. The game runs in ticks, usually a minute or a few minutes long. On every tick, a checker (the gameserver's bot; see checker and SLA) does two things for each team:
- Plants fresh flags in each service's flag store, such as a database row, a file or a user's private note.
- Runs SLA checks, using the service the way a legitimate user would to confirm it still works and still returns the flags planted earlier.
Teams find the bugs in their own copy of each service, patch them without breaking functionality, and write exploits that steal flags from every other team's copy. Stolen flags are only valid for a limited number of ticks, so exploitation has to be automated and continuous.
A typical A/D scoring model
Scoring formulas vary by organizer, but most combine three components per service:
- Offense. Points for every valid flag you steal and submit, often weighted so that stealing from a strong team is worth more.
- Defense. Points lost, or not earned, for every flag of yours that other teams steal.
- SLA. The share of ticks in which your service passed the checker. Many games multiply the total by this ratio, so a team that "patches" by switching a service off ends up with close to nothing.
That SLA multiplier is the core of A/D. It turns the game into a tradeoff between security and availability, which is exactly the tradeoff real operations teams live with.
Rule of thumb: if most of your registrants have never solved a CTF challenge, run jeopardy. A/D punishes beginners hard. They get exploited from the first tick and spend the event watching their score drain.
Skills each format tests
Both formats reward offensive skill, but they measure different things.
- Jeopardy measures breadth and problem-solving. Can you recognize a padding-oracle bug, carve a file out of a PCAP and reverse a crackme in one weekend? It works well for individuals and loosely coordinated teams.
- Attack-defense measures depth, speed and operations. That means code auditing, exploit automation, hot-patching, reading network traffic to steal other teams' exploits, service hardening and division of labor under time pressure. It's much closer to red-team and incident-response work.
If defensive skill is your main goal, like alert triage, log analysis and incident reports, a dedicated SOC simulation tests it more directly than either format.
Infrastructure, staffing and cost
This is where the formats differ the most.
Jeopardy infrastructure is a scoreboard, static files and, for web and pwn, some challenge containers. Static challenges cost almost nothing to host. Container-based challenges need per-team or shared instances. Two or three people can run a jeopardy event for hundreds of players if the challenges were tested beforehand.
A/D infrastructure is a full network: one vulnerable host per team, a VPN or isolated network so teams can reach each other, a gameserver with checkers for every service, flag rotation, and traffic capture if you give teams PCAPs. Every service needs a working exploit and a working checker before the event. A broken checker wipes out SLA points for everyone. Expect a dedicated infrastructure lead, a service author per one or two services, and someone watching the checkers throughout the game.
Side-by-side comparison
| Factor | Jeopardy CTF | Attack-defense CTF |
|---|---|---|
| Structure | Independent challenges on a board | Identical services per team, played in ticks |
| Scoring | Static or dynamic points per solve | Offense + defense, often multiplied by SLA |
| Beginner friendly | Yes, with an easy tier | Rarely |
| Participants | Scales to hundreds or thousands | Usually 10–40 teams |
| Online or on-site | Both, easily | Both, but needs VPN/network design |
| Duration | 6 hours to several days | Typically 6–10 hours of live play |
| Prep effort | Moderate (challenges + testing) | High (services, exploits, checkers, network) |
| Spectator value | Leaderboard races | Live attacks, patches and SLA swings |
| Best for | Fests, qualifiers, training, hiring screens | Finals, experienced teams, red/blue training |
Decision matrix: which format fits your audience?
College fest or freshers-heavy audience
Run jeopardy. Put 30–40% of the board in easy challenges so everyone solves something in the first hour, and use dynamic scoring so you don't have to calibrate points perfectly. For budgets, approvals and timelines, see our college CTF playbook.
Experienced teams or a flagship final
Run attack-defense, or a jeopardy qualifier that feeds an A/D final. Teams that already play on CTFtime often regard A/D as a demanding showcase format, and a well-run final is memorable.
Corporate security team training
Use A/D if you want red and blue skills in one exercise with realistic tradeoffs. If the focus is detection and response, a SOC simulation is the better fit. For internal teams, a smaller A/D with 4–8 squads often teaches more than a large public one.
Hiring and skills assessment
Use jeopardy, or report-based formats like Raw Ops. Individual scores are easier to attribute, candidates can take part remotely, and challenges map neatly to role skills. A/D mixes individual contribution into team results, which makes candidates hard to compare. Our guide to hiring with CTFs goes deeper.
Hybrid formats: the best of both
- Jeopardy qualifier → A/D final. An open online jeopardy round filters hundreds of teams down to the top 10–20, who then play A/D, on-site or online. You get reach and depth, and only the finalists need A/D infrastructure.
- King of the hill. Teams compete for control of shared machines. They break in, plant their marker and defend it. It has A/D's live, adversarial feel without building a service per team. See king of the hill.
- Jeopardy with a live round. Keep the board open all event and unlock a timed KotH or A/D round in the final hours for the top teams.
For a full overview of every format, including Raw Ops bug hunting and SOC drills, read CTF formats explained. If you're new to CTFs, start with what is a CTF.
Running either format on CTF7
CTF7 supports both formats from one registration flow and one organizer dashboard.
- Jeopardy CTF: static or dynamic scoring and a real-time scoreboard. Free covers static flags, attachments and external links; Standard adds hints that can cost points, dynamic flags unique per team, anti-cheat monitoring and bring-your-own Docker challenge images.
- Attack-defense simulations: replicated live networks where teams attack and defend at the same time, exercising offense alongside incident response and threat hunting.
Every plan is hosted on CTF7. The Free plan covers a jeopardy event for up to 50 participants. Standard (₹9,999 per event) adds dynamic flags, anti-cheat and bring-your-own Docker images for up to 500 participants. Large or multi-day events can run on Premium, which adds managed container deployment and end-to-end setup. Attack-defense is run as a managed event that we scope with you, so tell us about your event and we'll help you pick the right format. Compare the self-serve tiers on the pricing page.
Where to go next
- Learn the A/D vocabulary. The glossary explains the vulnbox every team defends and the checker and SLA logic that drives scoring.
- Get the scoring math right. How CTF scoring works covers dynamic decay, tick-based scoring and tie-breaks.
- Train both sides. Red team vs blue team exercises shows how A/D, king of the hill and SOC drills fit into a training plan.
- Pick your lane. Attack-defense CTF and king of the hill describe the formats we run.
