Attack-defense competitions, run for you by our team
Every team gets the same vulnerable services, defends its own, attacks everyone else's and keeps its checkers green for every tick. Attack-defense is a managed event on CTF7, not a self-serve option and not part of the Free or Standard plans: we scope it with you on a call, send a quote, and our team builds and runs the game infrastructure on the day.
Illustrative scoreboard from a managed A/D event (sample data)
What is an attack-defense CTF?
An attack-defense CTF (also written A/D or "attack defence") is a live Capture The Flag format where every team runs an identical machine, the vulnbox, hosting several deliberately vulnerable services. The game server plants fresh flags in each service every round, or tick. Teams score by capturing flags from rivals, lose points when their own flags are stolen, and earn SLA points only while a checker confirms their services stay up and working.
Offense and defense happen at once, which is why A/D is often called a red vs blue CTF. It rewards teamwork, patching discipline and monitoring as much as offensive skill. Compare every format in our CTF formats guide.
At a glance
- Teams: usually 8 to 40, with 3 to 8 players each
- Duration: 6 to 10 hours on site, up to 48 hours online
- Services: 3 to 6 per vulnbox
- Skill: intermediate to expert; ideal as a final after a jeopardy qualifier
- How you get one: a managed event, scoped and quoted per event
How an A/D game runs, tick by tick
From the first VPN connection to the last tick.
A/D vs jeopardy, explainedEvery team receives an identical vulnbox
Each team gets its own machine running the same services, such as a notes web app, a file vault and a custom network protocol, each with intentional weaknesses. Teams get root on their own box only.
Teams join a shared game network over VPN
Players connect through a per-team VPN profile into a shared game network where every vulnbox sits at a predictable address, so teams know where to attack and where to defend.
A short setup window, then the network opens
Teams get 30 to 60 minutes to explore their services, take backups and patch before the firewall between teams drops.
The game runs in ticks, and flags rotate every tick
A tick is typically 60 to 180 seconds. Each tick, the game server plants a new flag in every service on every vulnbox. Flags expire after a few ticks, so captures must be submitted quickly.
Checkers verify every service, every tick
Automated checkers act like real users: they store the new flag, read back older ones and exercise normal features. A passing service is UP and earns SLA points; a broken, slow or flagless one does not.
Attack and defend until the final tick
Teams find weaknesses, patch their own copy and submit flags captured from rivals. The live scoreboard combines attack, defense and SLA points until the final tick.
Attack-defense scoring: attack, defense and SLA
Each tick, teams earn or lose points in three buckets per service:
- Attack: points for every valid, unexpired flag captured from another team's service.
- Defense: points lost for every one of your own flags that another team submits.
- SLA: points for each tick the checker rates your service UP.
In its simplest additive form:
score = Σ ticks Σ services (attack + defense + SLA)Some competitions instead weight attack and defense by the share of ticks a service was up. Either way, taking a service offline to "defend" it costs more than it saves. We agree the model, tick length and flag lifetime with you and publish them in the rules.
Each tick the checker rates every service UP, MUMBLE, CORRUPT or DOWN, and only UP earns SLA points. See checkers and SLA for the full status list and the math, and what a vulnbox is for the box teams defend.
Worked example: team BlueJays keeps "vault" UP for a tick (+10 SLA), captures flags from 6 rivals (+6 × 5 attack) and loses 2 of its own (−2 × 5 defense). Net for that service and tick: +30.
How strong A/D teams split the work
Nobody can attack, patch and watch traffic at once. Winning teams assign roles before the network opens.
Service owners
Each player owns one or two services completely: understand the code, find the weaknesses, ship a patch that keeps the checker happy.
Offense and automation
Turns findings into reliable flag collection across rivals each tick, within the submission rate limits.
Monitoring and traffic analysis
Watches incoming traffic and logs to spot how rivals score against you, and briefs service owners.
Infrastructure keeper
Owns backups, deploys and rollbacks on the vulnbox, so a bad patch never costs more than one tick of SLA.
Captain
Tracks the scoreboard and checker status, decides where effort goes and keeps communication calm. Student teams can add a mentor with limited permissions.
Why a scoreboard alone can't run attack-defense
A jeopardy scoreboard only has to check a submitted string. An attack-defense game needs a tick engine that plants flags, a checker that exercises every service on every team, a VPN, one vulnbox per team and a scoreboard that updates every round.
Jeopardy scoreboards don't run A/D natively (see our open-source CTF platform comparison, facts checked October 2026). Dedicated open-source game servers do, but someone still has to operate them.
If you plan to build it yourself, read our explainers on the vulnbox and on checkers and SLA first. They are the two pieces that take the most engineering time.
Build it yourself or have us run it
Open-source game servers handle ticks, flags and scoring, but you still build and operate the vulnboxes, checkers, VPN and hosting. When you book a managed A/D event, that operating work moves to our team. You either write the services yourself or have our authors build them.
If you self-build an A/D game, budget time for:
- A vulnbox image per team, rebuilt identically and frozen before game day
- One checker per service that stores flags, reads them back and tests normal features
- A per-team VPN into an isolated game network
- A playtest in which every service is exploited and patched without breaking its checker
- Live monitoring and someone on call for every hour of the game
- A scoreboard and submission endpoint that keep up with every tick
What our team operates on your A/D day
You decide the format, the teams and the services. Our team stands up the game infrastructure for your event, watches it for every hour of play and takes it down afterwards.
Illustrative view of the game-server console our staff watch during a managed event (sample data). Organizers see the scoreboard, not this console.
Game server & tick engine
Schedules ticks, plants flags, enforces flag lifetime and computes scores.
Service checkers
Scripted health checks per service, run against every team each tick.
Flag store & submission
Issues unique flags per team, service and tick, and validates submissions with rate limits.
VPN & vulnboxes
Per-team VPN profiles and identical vulnboxes, scoped with you for each event.
Live scoreboard
Per-service status and points for every team, ready for a venue projector.
Registration & teams
Team sign-up runs on the regular CTF7 event page.
Event-day staff
Our engineers watch game-network health and submissions, and handle rule violations with you.
Custom services
Our authors build and test A/D services and checkers. Challenge development
A red vs blue CTF day for your security team
A/D is the closest a CTF gets to a real incident: a service is under attack, the business needs it running, and you have minutes to decide.
For internal teams we run a compact, one-day version. Mix developers, SOC analysts and pentesters in each team so every role learns how the others think. Services can mirror your stack, such as an internal API or login portal, built by our challenge development team without touching production code.
The day ends with a purple-team debrief on what each team found, patched and saw in the logs. That is where the training value lands. The red vs blue section of our formats guide covers the exercise design in depth, and CTF7 for enterprises covers private, branded events. Weighing a one-day A/D event against a standing training environment? Our guide to what a cyber range is compares the two.
| Time | Corporate A/D day |
|---|---|
| 09:30 | Briefing, rules and VPN check for every team |
| 10:00 | Setup window: explore services, take backups, first patches |
| 10:45 | Network opens; ticks begin (120 seconds each) |
| 14:00 | New service released to reshuffle the board |
| 16:30 | Final tick; scores final |
| 16:45 | Purple-team debrief and awards |
How to prepare for an attack-defense CTF
A/D punishes chaos more than lack of skill. Habits of calm teams:
- Back up first. Copy every service and its data before the network opens so any change can be rolled back.
- Patch with discipline. Fix the root cause, keep legitimate features working and test before deploying. A patch that breaks the checker is worse than none.
- Monitor from minute one. Log incoming traffic; how rivals score against you tells you what to fix next.
- Automate what repeats. Build reliable team tooling for per-tick work in practice, not on game day.
- Talk constantly. One channel, one owner per service, one captain.
- Know the rules. Attacking the game infrastructure, flooding other teams or sharing flags between teams gets you disqualified.
From scoping call to final tick
Lead times below are for a first event with new services. A rerun with existing services is shorter.
| When | Milestone |
|---|---|
| T − 10 weeks | Scoping call: team count, duration, on-site or online, number of services, who writes them |
| T − 9 weeks | Written quote: service development (if ours), game infrastructure, event-day staff |
| T − 8 weeks | Registration opens on CTF7; optional jeopardy qualifier scheduled |
| T − 6 weeks | Services and checkers in development, by your team or ours |
| T − 3 weeks | Internal playtest: every service exploited and patched, checkers tuned |
| T − 1 week | VPN profiles issued; teams run a connectivity test |
| T − 1 day | Full dress rehearsal with test teams; vulnbox images frozen |
| Game day | Setup window, network opens, live monitoring, final tick |
| T + 1 week | Results, certificates, service source and writeups published |
Planning a first event? Our CTF hosting playbook covers budgets, rules and staffing.
Attack-defense vs jeopardy CTF
Many organizers run both: a jeopardy CTF as an open qualifier, then an attack-defense final for the top teams. For shared-target play, see King of the Hill.
| Aspect | Attack-defense | Jeopardy |
|---|---|---|
| What players do | Defend own services and attack rivals at the same time | Solve independent challenges from a board |
| Interaction between teams | Direct, over a shared game network | None; teams only share the scoreboard |
| Scoring | Attack + defense + SLA, every tick | Static or dynamic points per solve |
| Typical scale | 8 to 40 teams | Dozens to thousands of players |
| Skills trained | Patching, monitoring, incident response, teamwork | Breadth across web, crypto, pwn, forensics and more |
| Beginner friendly | Best after some CTF experience | Yes |
| Getting started on CTF7 | Managed: a scoping call, a quote, and our team runs it | Self-serve in the organizer dashboard; see pricing |
Who runs attack-defense CTFs
Our team also scopes and runs the other managed formats: King of the Hill and SOC simulation. Self-serve events start from the format overview.
Scope an attack-defense event
Tell us the team count, the date and the skill level. We reply with the services, the tick length and a quote, and nothing is built until you approve the scope.
