CTF formats explained: jeopardy, attack-defense and every other type

The main CTF formats are jeopardy (a board of independent challenges scored by flags), attack-defense (teams defend their own vulnerable services while attacking everyone else's), King of the Hill (capture and hold a shared machine), boot2root (one machine, a user flag and a root flag), quiz (timed theory questions), blue-team forensics CTFs and mixed events that combine them. Two related formats run on the same platforms but are not CTFs, because they score reports instead of flags: Raw Ops (VAPT-style bug hunting scored with CVSS 4.0) and SOC simulation (an analyst shift scored on investigation accuracy).

If you already know your situation, this table is the short version. The rest of the guide explains each row.

Why CTF formats matter

"Capture the Flag" names a family of competitions, not one ruleset. One CTF asks players to decode a cipher at their own pace; another asks a team of five to patch a live service while rivals exploit it. The format decides which skills get rewarded, how many people can play, how much infrastructure you need and whether anyone would enjoy watching it on a projector. If you are new to the idea, start with what a CTF is, then come back here. If you already know you are organizing one, keep our guide on how to host a CTF open in another tab.

For each format below you'll find the same five things: how it works, how it is scored, typical team size, infrastructure complexity and who it's best for. To see how each one runs on CTF7, browse our CTF solutions by format. CTFs are one branch of a wider family that also includes cyber defense exercises, leagues and hackathons; the section on other cybersecurity competitions covers the rest.

This guide is in three groups. First, the CTF formats proper: every one of them is scored on flags, or on short answers that act as flags. Second, two job-simulation formats that run on a CTF platform and scoreboard but have no flags at all, Raw Ops and SOC simulation. Third, hackathons, a related competition that shares the audience but not the rules. Keeping the groups apart matters when you write rules and set expectations: a player who signs up for a "CTF" and receives a scope document and a report template deserves to know that in advance.

Formats scored on flags

Everything in this group fits the strict definition of a CTF. There is something hidden or protected, a flag, and points come from capturing it, holding it or answering the question it stands for.

Jeopardy CTF: the board of challenges

Jeopardy is the format most people picture when they hear "CTF". Named after the TV quiz show, it presents a board of challenges grouped by category (web, cryptography, binary exploitation, reverse engineering, forensics, OSINT, misc) with a point value on each tile. See our guide to CTF categories for what each one tests.

How it works

Every challenge is independent. A player opens one, downloads a file or connects to a hosted instance, finds the hidden flag (for example CTF7{This_is_an_example_flag}) and submits it. Teams choose their own path and split categories between specialists. Online jeopardy events usually run 24 to 48 hours; on-site events at colleges and conferences run 6 to 12 hours.

Scoring

Points are either static (a fixed value per challenge) or dynamic (values fall as more teams solve, so the crowd sets difficulty). Common extras across the scene are bonus points for the first solver on some events, hints that cost points and time-based tie-breakers, where the team that reached a score first ranks higher. Our guide to how CTF scoring works walks through decay curves and tie-breaks with worked numbers. Organizers running bigger events add dynamic flags, a unique flag per team, so copied flags stand out. We explain how that works in dynamic flags and anti-cheat, and the flag format entry covers how to write flags players can't mistype.

Team size, infrastructure and best fit

• Team size: solo up to about 5 players is typical. Some open international CTFs allow unlimited team size.
• Infrastructure: low to medium. Many challenges are just file downloads. Web and pwn challenges need hosted services, ideally one isolated container per team.
• Best for: beginners, college fests, qualifiers, large open events and any first-time organizer.

CTF7's Free plan covers one jeopardy CTF a year with static flags and attachments for up to 50 participants. The Standard plan (₹9,999 per event, up to 500 participants) adds dynamic flags, anti-cheat, hints and bring-your-own Docker challenge images. Premium adds managed container deployment. See jeopardy CTF hosting and pricing.

Attack-defense CTF: patch yours, exploit theirs

Attack-defense (A/D) is one of the oldest styles of hacking competition and the closest to live operations. Conference finals and university competitions have used it to put teams on the same network at the same time, each defending its own services while attacking everyone else's.

How it works

Every team gets an identical machine, often called the vulnbox, running the same set of deliberately vulnerable services. All vulnboxes sit on a shared private network, usually reached over a VPN. Teams have two jobs at once:

• Defense: find the bugs in their own services and patch them without breaking normal functionality.
• Offense: use the same bugs against every other team's vulnbox to retrieve flags that the gameserver has planted there.

The game runs in ticks, scoring rounds that are usually one to a few minutes long. Each tick, the gameserver plants fresh flags in every service and a checker uses each service the way a normal user would, to confirm it still works. Flags stay valid for only a few ticks, so good teams automate their attacks and keep them running for the whole event.

Scoring

Exact formulas vary by event, but most combine three components per service:

score per service = attack points  (flags stolen from other teams)
                  + defense points (your flags that nobody stole)
                  × SLA            (share of ticks your service passed the checker)

# example over 100 ticks:
#   service passed the checker in 92 ticks  → SLA = 0.92
#   a team that "patches" by switching the service off → SLA ≈ 0,
#   which wipes out most of its points for that service

The SLA factor is what makes A/D hard. You can't simply turn off a vulnerable service. You must fix it while keeping it fully usable. The checker and SLA glossary entry explains how checkers decide whether a service is "up". For a deeper look at the two most common formats side by side, read attack-defense vs jeopardy CTF.

Team size, infrastructure and best fit

• Team size: 3 to 8 players is common. Teams need people on offense, defense, monitoring and automation at the same time.
• Infrastructure: very high. You need one vulnbox per team, an isolated network and VPN, a gameserver, reliable checkers for every service and a flag submission system. A broken checker unfairly costs every team SLA points.
• Duration: typically 6 to 10 hours on-site, sometimes 24 to 48 hours for online finals.
• Best for: experienced teams, finals of multi-stage events, red-vs-blue training and advanced university clubs.

Because the infrastructure is the hard part, most organizers either use an existing open-source gameserver and staff it heavily, or hand it to a managed provider. On CTF7, attack-defense is a managed event: our team scopes it with you on a call and runs the game infrastructure. See managed attack-defense CTF.

King of the Hill CTF: capture it, then hold it

King of the Hill (KotH) keeps the fight for control from attack-defense but is simpler to run and much easier to watch.

How it works

Instead of every team getting its own vulnbox, there are one or a few shared target machines (the "hills"). Every team attacks the same box. The first team to compromise it writes its team name into a designated ownership file, often called the king file, and becomes king. The king then defends: closing the holes it used and watching for intruders. If a rival takes over and rewrites the king file, the crown changes hands.

Scoring

A scoring bot polls each hill at a fixed interval, for example every 30 or 60 seconds, reads the king file and checks that the machine's core services still respond. The current owner earns points for every interval it holds the hill:

points = intervals held × points per interval

# example: 60 s polling, 10 pts per interval, 3 hills
#   held hill-1 for 14 min  → 14 × 10 = 140 pts
#   held hill-2 for 41 min  → 41 × 10 = 410 pts
#   total                   → 550 pts (services must stay up to count)

KotH rules always include anti-griefing terms, because a king could "win" by wrecking the box. Typical rules forbid shutting the machine down, deleting or breaking the scored services, tampering with the scoring bot and denial-of-service attacks. Organizers reset a hill to a clean state if it breaks. Our CTF rules template includes infrastructure-abuse clauses you can adapt.

King of the Hill vs attack-defense

The two are often confused. The core difference is who owns what. In A/D every team has its own copy of the services and its score depends on protecting that copy. In KotH there is one shared target and teams take turns owning it. That makes KotH cheaper to host (a few hills instead of one vulnbox per team) and far more fun on a projector, because one "hill-2 captured" announcement tells the whole story.

Team size, infrastructure and best fit

• Team size: solo to about 5 players.
• Infrastructure: medium to high. A handful of hills, an ownership-polling scorer, fast reset and snapshot tooling, and network isolation from everything else.
• Best for: conference and fest crowds, live side events, intermediate players and red-vs-blue practice where teams need to both break in and harden.

On CTF7, King of the Hill is run as a managed event by our team, on request; the King of the Hill page describes how hills, polling and resets work there.

Quiz CTF: timed theory questions

A quiz is the simplest competitive format: a timed set of multiple-choice or short-answer questions about security concepts, scored automatically. A 2022 academic review of five open-source CTF platforms listed it alongside attack-defense, jeopardy, King of the Hill and mixed as one of five competition formats, mainly for reinforcing theory.

How it works

Players answer questions such as "which port does SSH use by default?", "what is the difference between hashing and encryption?" or "what does the S in HTTPS add?". Some quizzes add short practical prompts: decode this base64 string, read this log line, name the protocol in this packet summary. On a jeopardy scoreboard, a quiz round is often built as a set of short-answer challenges where the correct answer is the flag. Rounds are short, usually 15 to 60 minutes.

Scoring

Each correct answer earns fixed points. Organizers commonly add a time limit per question or per round, limited attempts or negative marking to discourage guessing, and a time-based tie-break:

points = correct answers × points per question − wrong-answer penalty

# example: 20 questions, 10 pts each, −2 per wrong answer
#   16 correct, 3 wrong, 1 skipped → 160 − 6 = 154 pts
#   tie on 154 → the player who submitted first ranks higher

Team size, infrastructure and best fit

• Team size: usually solo, sometimes pairs.
• Infrastructure: very low. No hosted services, no containers, no network isolation.
• Best for: orientation sessions, school and first-year audiences, warm-up rounds before a jeopardy event and quick theory checks at the end of a lab module.

The limitation is the same one that makes quizzes easy to run: they test recall, not hands-on skill. A candidate can memorize that SQL injection exists without being able to find one. For hiring, treat a quiz as a short filter at most and use a hands-on round to decide; we compare the two approaches in MCQ vs live labs for cybersecurity hiring. Schools can pair a quiz with the first club night in our guide for high school students.

Boot2root: from foothold to root

Boot2root (B2R) challenges are single vulnerable machines that players compromise from the outside in.

How it works: the player gets a network address for a machine and nothing else. They enumerate its services, gain an initial foothold as a low-privilege user and then escalate privileges to full administrator (root on Linux, SYSTEM on Windows). Scoring: two flags per machine is the norm, a user flag for the foothold and a root flag for full compromise, with the root flag worth more.

• Team size: usually solo, sometimes pairs.
• Infrastructure: medium. Each player or team needs its own isolated instance, or players will trip over each other's changes. Resets must be fast.
• Best for: aspiring penetration testers, practice between events and a "machines" category inside a larger jeopardy event.

Many always-on wargames and practice platforms are built around boot2root-style machines; see where to practice as a beginner to find a starting point at your level.

Blue-team and forensics (DFIR) CTFs: the flag is an answer

Blue-team CTFs flip the usual direction. Instead of breaking in, players work out what an attacker already did. They get disk images, memory captures, packet captures or exported logs and answer structured questions such as "which account was used for initial access?" or "at what time did data leave the network?" Each correct answer is the flag, which keeps the event a true CTF and lets it run on an ordinary jeopardy scoreboard, often as the forensics category inside a larger board. See our guide to forensics CTFs for the typical artifacts and tools.

Scoring: points per correct answer, usually with limited attempts to discourage guessing and a time-based tie-break. Team size: solo to about 4. Infrastructure: low, since the evidence is file-based and nothing needs to be hosted or kept alive.

Best for: forensics students, SOC analysts practicing between shifts and organizers who want a blue-team track without a live environment. When the exercise grows into a live alert queue with an incident report at the end, it stops being a CTF and becomes the SOC simulation described below.

Hardware, ICS and other niche formats

A small but passionate corner of the scene runs CTFs on physical things. Hardware CTFs use circuit boards, badges or embedded devices: players read firmware, probe debug interfaces or analyze radio signals. ICS/OT CTFs recreate industrial control systems with PLCs, protocols like Modbus and simulated plant processes. Conference villages dedicated to hardware, ICS and car hacking often run these.

• Team size: solo to small teams, often limited by how many devices exist.
• Infrastructure: specialized. Real hardware, lab benches and on-site staff. Hard to run online.
• Best for: embedded, IoT and industrial security specialists, and conference villages.

Beyond flags: job-simulation formats that aren't CTFs

These two formats are often listed with CTF formats, including on this site's solutions pages, because organizers pick between them for the same events and because they run on the same platform, scoreboard and clock. They are not CTFs. Nothing is hidden and nothing is captured. Each one simulates a real security job, a penetration test or an analyst shift, and scores the work product that job produces: a vulnerability report or an incident report. That is why they are the formats to reach for when the goal is hiring or training for a specific role, and why they are a poor fit for a fest crowd that came to hunt flags.

Raw Ops: report-based bug hunting scored with CVSS 4.0

Raw Ops is CTF7's "anti-CTF": a time-boxed competition with no flags at all. It simulates a vulnerability assessment and penetration test (VAPT) or a bug bounty program, so it rewards the work those jobs require. Nothing is hidden for players to capture; the target is realistic and the deliverable is a report, which is what makes it a job simulation rather than a CTF.

How it works

Participants receive a realistic target (a web application, an API or a small network) with a written scope and rules of engagement, and investigate it the way a professional would. When they find a weakness, they submit a vulnerability report with a description, reproduction steps, evidence, impact and a suggested fix. Chaining several weaknesses into a higher-impact result is encouraged.

Scoring

Every report goes through triage by the organizer's reviewers: valid, invalid, duplicate, needs more info or rejected. Valid reports are scored with CVSS 4.0, the Common Vulnerability Scoring System maintained by FIRST, and the score drives the points. A worked example with a chain bonus:

valid finding    : CVSS 4.0 base score 8.6 (High)
base points      : 8.6 × 100 = 860
chain multiplier : ×1.2 (two weaknesses combined, per event rules)
final            : 1,032 pts

Multipliers and chain rules are set by the organizer and published with the rules. One well-documented critical chain can beat a dozen low-severity findings, so report quality matters: see our vulnerability report template.

Team size, infrastructure and best fit

• Team size: usually solo or small teams of 2 to 3, so individual contribution stays visible.
• Infrastructure: medium to high. The target must feel realistic, stay isolated and survive many testers at once, and you need reviewers to triage reports during the event.
• Best for: pentest and bug bounty training, hiring for offensive-security and AppSec roles, and advanced students who have outgrown flag hunting.

Read what Raw Ops bug hunting is or see the Raw Ops format page for triage workflow and rules.

SOC simulation: an analyst shift, scored on accuracy

A SOC simulation is the blue-team counterpart to Raw Ops. It rewards noticing, investigating and explaining what happened, rather than breaking in, and the deliverable is an investigation and an incident report, not a flag. Its flag-scored relative is the forensics or DFIR CTF in the first group.

How it works

Participants work like analysts on a shift. They triage an alert queue, dig through logs, network data and endpoint telemetry from a simulated incident, reconstruct the attacker's timeline and write an incident report. The scenario is a believable attack story told through the data, so the exercise tests judgment under a queue, not just tool knowledge.

Scoring

Scoring rewards accuracy first, then speed. Common models: points per correct investigation finding, penalties or limited attempts for wrong calls to discourage guessing, a time component similar to mean time to respond, and a rubric-scored incident report for the final stage. The report usually carries the most weight, which is the clearest sign that this is not a CTF.

Team size, infrastructure and best fit

• Team size: solo to about 4, matching a small SOC shift.
• Infrastructure: medium to high. A live SOC simulation needs realistic log datasets, a search interface and a believable attack story behind the alerts.
• Best for: SOC analyst training, enterprise security teams and anyone moving toward incident response.

On CTF7, a SOC simulation is a managed event that our team builds and runs on request. For how red and blue exercises fit together, see red team vs blue team exercises. Longer, scenario-driven blue-team exercises often run on a cyber range rather than a CTF scoreboard.

Training formats: red team vs blue team exercises

Several formats above are scored competitions, but the ones an organization runs to build readiness are exercises. The red team plays the attacker and tries to reach defined objectives the way a real adversary would. The blue team defends: the SOC, incident responders and detection engineers monitoring, triaging, containing and writing it up. A neutral white cell writes the scenario, enforces the rules of engagement, injects events, scores and leads the debrief. Purple teaming is a way of working, not a third team: red runs a technique, blue checks whether it alerted, they tune the detection and move on. Every exercise needs a white cell, even a small one.

A red team engagement is not a penetration test. A pentest aims for breadth, reporting as many in-scope vulnerabilities as possible with the defenders aware; red teaming aims for depth, proving an objective is reachable and finding out whether anyone notices. Raw Ops sits closer to the pentest side. Choose by goal, not by how impressive the environment looks:

Adversary emulation is the most precise of these: red walks a real threat group's documented behavior technique by technique in MITRE ATT&CK's language, and blue records which ones it detected. Because the plan repeats, it is the best way to close real detection gaps in an environment you already run.

Score both sides, and publish the model in advance. Red earns points for objectives reached, escalation and time to objective. Blue earns points for detections (with a bonus for speed), for containing a host or account before the objective lands, and for the incident report. Include a report-quality component for both sides: communicating findings is half the job. Competitive formats build the model in already, as the attack, defense and SLA points under attack-defense scoring show. In an internal exercise, do not make it red-wins or blue-wins. A red team that "wins" every time without producing fixes has wasted the exercise.

Three metrics carry the value. Mean time to detect is the average gap between a red-team action and blue's first detection of it. Mean time to respond is detection to containment, so write down which you mean. Detection coverage is techniques detected divided by techniques executed, mappable to ATT&CK. Worked example: red executes 20 techniques, blue detects 14, so coverage is 70%; those detections total 266 minutes, so MTTD is 19 minutes. Containment came 41 minutes after the first detection. Rerun the same plan next quarter and compare: that trend line is what leadership wants, and it is the argument for funding the next exercise.

Write the rules of engagement before you build anything. Anything touching real systems needs written authorization from whoever owns them. Cover what is in and explicitly out of scope, prohibited techniques such as denial of service or data destruction, the time window, data handling (no real customer data leaves the environment; use planted "crown jewels" as objectives), stop conditions, how an analyst checks with the trusted agent whether an alert is exercise or real, and what evidence each team logs. Match the format to the participants: students and new analysts get more from a structured attack-defense round than from an unscripted live-fire event.

Cyber ranges: the environment behind the exercise

A cyber range is a controlled, isolated environment that replicates real networks, systems, users and traffic, so people can attack, defend and respond without any risk to production. The name comes from a firing range: live ammunition, but on systems that exist only for the exercise. A range is an environment, not a format. Labs, competitions and full-team exercises can all run on one; what changes is the goal, the duration and the scoring. Almost every range is built from the same layers:

Orchestration ties the layers together: building the environment, resetting it between groups and rerunning the same scenario next month. That repeatability is what turns a one-off exercise into a training program.

"CTF vs cyber range" is a false choice. It is a fair description of a jeopardy board, where each challenge is a self-contained puzzle and the skills are individual. It does not describe the whole family. An attack-defense event gives every team the same vulnerable machine on a shared network with an automated checker scoring availability, which makes it a competitive range exercise with a scoreboard. A SOC simulation is a blue-team range exercise run with CTF mechanics. The useful question is not which one you have but what this format measures and whether that is what you need: individual skill points to labs and jeopardy, team behavior under pressure points to attack-defense, SOC simulation or a live-fire exercise, and most good programs run all three in sequence.

Ranges are grouped by purpose. Training ranges favor guidance, hints and resets over raw realism, so a student can work a phishing email, a packet capture and a small intrusion across one week. Assessment ranges exist to measure, which means identical conditions for every candidate, no leaked answers, detailed logs and a defensible rubric. Exercise ranges are for team rehearsal, from a single-day SOC drill to a multi-day live-fire event. Separately from purpose they differ in delivery: on-premises hardware is fully controlled and expensive, cloud-hosted networks scale and reset easily, hybrid adds real devices for specialized sectors. Simulation models systems in software and is cheap; emulation runs real operating systems.

Universities and SOC teams follow the same pattern, and neither usually needs to own hardware. Move from labs, to an internal jeopardy round to check progress, to focused incident response labs, to a capstone SOC simulation or attack-defense round in teams, then a debrief. A SOC uses the same hour to onboard an analyst safely, to find where a phishing or ransomware playbook breaks down, and to compare mean time to detect across quarters. Scoring is what separates a range exercise from an expensive demo: if nobody records when each step was detected, what was contained and how good the report was, you ran a tour. For schools and clubs, a scored, time-boxed event is the practical way in, which is what Raw Ops on CTF7 delivers, with attack-defense and SOC simulation available as managed events our team runs on request.

Mixed and hybrid events

Many serious competitions combine formats across stages or tracks, and the combinations often cross the groups above, pairing a flag-scored round with a report-scored one. The most common patterns:

• Jeopardy qualifier, attack-defense final. An online jeopardy round filters hundreds of teams down to the top 10 to 20, who then meet for an A/D final. Many competitions follow this model because A/D does not scale to hundreds of teams.
• Jeopardy with a live side event. A conference runs a jeopardy board all day and a KotH round on the main stage for an hour, with its own mini-leaderboard.
• Jeopardy plus report round. A hiring program uses a short jeopardy screen, then invites shortlisted candidates to a report-based round that shows how they write up findings.
• Quiz warm-up, jeopardy main event. A college fest opens with a 20-minute quiz so newcomers learn the vocabulary, then moves everyone onto the jeopardy board.

Hybrids multiply the operational work, so publish exactly how stages and scores combine before registration opens.

Related but not a CTF: hackathons

A hackathon isn't a CTF either, but the two often share an audience and a platform. Where a CTF asks players to break something, a hackathon asks teams to build something: a security tool, a detection rule set, a secure app or a prototype for a problem statement.

Scoring is done by judges against a published rubric (for example innovation, technical depth, completeness and presentation), often over multiple rounds with mentors supporting teams. Teams are typically 2 to 5. Infrastructure is low: registration, team formation, submissions and judging tools matter more than servers. Hackathons suit developer-heavy audiences and college fests, and pair well with a parallel CTF. See hackathons on CTF7.

Other cybersecurity competitions

CTFs are one branch of a wider family. Any event with a defined scope you are allowed to touch, a clock and a published scoring rule counts as a cybersecurity competition. The easiest way to sort them is by what the contest asks you to do: break things, keep things running, do both at once or build something. The formats above already cover breaking in, attack-and-defend games and hackathons. The three below score uptime, response or triaged findings, and the table after them adds security hackathons, which score a judged build. None of the four has flags.

Cyber defense competitions

Here the red team is the organizer, not the other players. The best-known example is the US Collegiate Cyber Defense Competition (CCDC): each student team inherits the network of a fictional small business and has to keep its services running while a volunteer red team attacks throughout the event. Organizers also assign business tasks such as adding user accounts, writing a policy memo or producing an incident report. Points come from service uptime, completed tasks and incident handling, minus damage from the red team. Our red team vs blue team section covers how to plan and score this kind of exercise.

Cyber range exercises

When a cyber range hosts a scored contest it becomes an exercise: blue teams defend, a red team attacks, and a white cell runs the scenario and judges the response. The largest public example is Locked Shields, the live-fire exercise the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn has run every year since 2010, where national blue teams defend simulated networks against a common red team. Scoring follows detection, containment, coordination and the final report. See cyber ranges above for how ranges differ from labs and CTFs, and SOC simulation for a lighter version.

Bug hunting contests

Bug bounty programs are open-ended: organizations pay for valid, unique vulnerabilities in real products, with no guarantee there is anything to find. Contest formats borrow that model and add a clock and a scoreboard. Points come from findings that survive triage, rated by severity. Raw Ops, described above, is CTF7's version and scores findings with CVSS 4.0. CTF vs bug bounty compares the two paths.

What each type scores

Typical values. Individual events vary, so always check the rules of the one you are entering.

All formats compared side by side

Every format on the dimensions organizers ask about most, grouped the same way as this guide. Ratings are relative to each other, not absolute.

How to choose the right CTF format

Start with the outcome you want, then check it against your audience's skill, headcount and the infrastructure you can support.

Goal: teaching beginners

Pick jeopardy. Beginners need an early win or they leave. Jeopardy lets you add easy warm-ups in every category, paid hints and self-paced play. For a very new audience, a short quiz before the board opens gives everyone the vocabulary they'll need. Avoid attack-defense for newcomers: they get exploited from the first tick and rarely recover. For semester-long learning, pair events with practice operations such as War Zone and our CTF for beginners roadmap.

Goal: engaging a conference crowd

Run a jeopardy board plus a King of the Hill round. Jeopardy keeps drop-in attendees busy all day. A KotH round on the main screen gives the event a moment, since "hill captured" updates are easy to follow even for people who have never played. Put the live scoreboard on a projector. See CTF7 for security conferences.

Goal: hiring security talent

Use a short jeopardy screen, then a Raw Ops round. Map jeopardy challenges to the role and keep it to a few hours so working candidates can take part. Raw Ops then shows what a flag can't: how a candidate scopes a target, rates severity and writes a report your team would use. Use dynamic flags and anti-cheat monitoring throughout. More in hiring CTFs and hiring security talent with CTFs.

Goal: training a SOC or blue team

Run a SOC simulation. Offense-heavy formats don't train triage, log analysis or incident write-ups; a SOC simulation scored on accuracy and response time does. If you need something lighter that still fits on a jeopardy scoreboard, run a forensics (DFIR) CTF track instead. If you want offense and defense in one exercise, follow it with an attack-defense or KotH day where the defenders harden and monitor.

Goal: challenging advanced teams

Choose attack-defense, or a hybrid with an A/D final. A/D rewards speed, automation and coordination as well as skill. Plan infrastructure early: one vulnbox per team, checkers tested against patched services, and a full dry run. If you want something advanced but lighter to operate, Raw Ops against a complex target is a strong alternative.

Five questions to settle before you decide

1. Who is playing? First-timers, a mix or experienced teams?
2. How many? Jeopardy scales to thousands; A/D suits tens of teams, not hundreds.
3. How long? A 3-hour hiring round, a 12-hour fest or a 48-hour weekend?
4. Where? On-site allows LAN and hardware; online needs hosted, isolated infrastructure.
5. What budget and staff? Estimate costs with the CTF cost calculator. A/D, KotH and Raw Ops need staff on duty.