Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.
As artificial intelligence squeezes early-career learning opportunities, capture-the-flag contests could be one way to help pick up the slack.
October 29, 2026
Artificial intelligence (AI) may be gobbling up entry-level jobs and learning opportunities for security practitioners, but it can't erase the value of hands-on experience with enterprise systems and security tools.
No matter how much agentic action cybersecurity teams embed into their security operations center (SOC) and the rest of their programs, smart people have to backstop that work. And the only way these "humans-in-the-loop" can do that capably is if they build up the kind of judgment that's best learned from the school of hard knocks.
The problem? With SOC tier 1 analysts becoming an endangered species and bug bounty programs on the ropes from a glut of AI submissions, the chances are dwindling for security newbies to rack up real-world experience.
There's no great fix to this career pipeline problem just yet, but some of the answers might be found in one of the industry's age-old mechanisms for both camaraderie and skill-building: the trusty capture-the-flag (CTF) competition.
Related: AI Takes Root in Hospital Corridors, Raises Security Stakes
"CTFs give passionate talent the opportunity to grow and learn in ways that they might not have at their day jobs," says Jason Walker, a security engineer by day at software-as-a-service firm Five9. An avid CTF competitor, he won the Sentinels League competition sponsored and run by SentinelOne, beating two other finalists from a field of thousands of competitors worldwide. Besides street cred, Walker picked up a $5,000 prize for his efforts and a $10,000 donation in his name to his charity of choice, Trans Lifeline.
The livestreamed event offered up the spectacle and fun of an e-sports competition, but it may hold deeper clues as to how the industry can keep refreshing its talent pool in the coming years. As Walker puts it, CTFs are the ultimate way to expose both new and experienced cyber professionals to a wider range of problems and technologies.
"CTFs have helped me be a lot more versatile," he says. "If your company is running well and your program is mature, you aren't going to necessarily be firefighting new things every week. You're not going to be exposed to every new technique and threat. Doing CTF events and other hands-on training is a really important way to make sure you can stay up to date."
CTF competitions come in many shapes and sizes, but they fundamentally challenge players to find hidden pieces of data called "flags" buried inside intentionally vulnerable systems. Most fall into one of two formats: Jeopardy-style events, the kind Sentinels League runs, hand out standalone puzzles across categories such as Web exploitation, forensics, and cryptography, with points awarded per solve. Attack-defense events ask each team to defend its own vulnerable network while trying to break into everyone else's.
Related: Vulnerability Management Isn't About the Score — It's About How It Applies to You
The attack-defense format took shape at DEF CON's CTF, which started in 1996 and is still the event most associated with it. It has sprung forth a wellspring of CTF formats that range from grassroots industry events to big vendor-sponsored competitions like Sentinels League.
Sentinels League grew out of ThreatOps, a set of internal games SentinelOne's solutions engineers have run since 2020 to teach customers how to hunt through telemetry for hidden flags. This year's championship built on that with four games — Endpoint, Cloud, SIEM, and AI — spread across 12 weeks of qualifiers between June and October
The opening player pool of 2,236 entrants came from more than 100 countries, competing for a total prize pool of $100,000. Smaller prizes were dispensed across the qualifier and regional events, with the bigger prizes kept on reserve for the final, which was held in conjunction with SentinelOne's annual OneCon event.
Ryan O'Grady, director of SE operations at SentinelOne, says the firm invests the money in the prizes and the considerable logistics of running such a big event as a way to give back to the community, to build up expertise and exposure to its platform, and as a recruiting tool.
Related: Is Your Organization Ready for 2027's AI Accountability Era?
Whether motivated for the prizes or the training, the appetite for the event keeps growing. This year's drew enough interest that the company had to get a bigger ballroom to accommodate spectators.
Sentinels League is just one example of what a CTF looks like amid a much broader spectrum of competitions available. On CTFtime, the volunteer-run archive that tracks the hobbyist side of the scene, last year's calendar alone listed more than 200 individually organized events, with active teams from countries spanning every populated continent.
DEF CON CTF, often called the World Series of hacking, pulled 673 teams through its 2026 qualifiers before finals in Las Vegas this August. The National Cyber League, a nonprofit circuit O'Grady competes in, drew more than 7,500 students from 670 schools and universities this past spring. Kaspersky continues to run its own wildly popular SAS CTF out of Bali.
Other more academic events, such as New York University's CSAW and Carnegie Mellon's picoCTF, run versions aimed at students. Larger consulting firms, such as KPMG, use the format to scout corporate recruits.
In spite of the obvious demand for CTFs evident in the number of events held worldwide and the thousands of participants willing to sink their personal time into these pursuits, many security pundits worry about what AI is going to do to the purpose and purity of these competitions.
CTF organizers are thinking deeply about what this means for their rule books and how they enforce them. RITSEC's 2026 rules ban using AI to autonomously solve challenges outright, calling it against the spirit of the competition. Meantime, CSAW leaned into AI, this year creating an entire track built around using large language models (LLMs) to solve past CTF problems.
DEF CON CTF's 2026 qualifier split the difference. It barred fully autonomous AI teams but let human competitors use AI tools as long as a person stayed meaningfully in charge, requiring every team to label itself No AI, Low AI, or Human-Led AI on the public scoreboard.
A recent study of hundreds of Hack The Box machines released between 2017 and 2025 found solve times dropped roughly 16% a year, with the steepest declines after 2022. The hardest tier of challenges went from a 15-hour median solve down to about five, according to penetration tester Jacob Krell of Suzu Labs, who did the analysis .
He's not the only one worried. An academic study earlier this year from IBM Research and the College of William & Mary pitted 41 participants in a live, on-site CTF against four autonomous AI agents. It found that those agents placed second overall, ahead of most of the human teams competing.
Findings like these are enough to get firms like OtterSec, a blockchain security firm, to make noise about how to "save" CTFs. This summer the firm launched a $100,000 "Save CTFs Fund" to bankroll new formats that stay meaningful as AI keeps improving.
SentinelOne's O'Grady doesn't buy the death-of-CTFs talk. In his view, AI just forces organizers to redesign CTFs so they still force a human to think laterally, AI assistance or not.
AI may not be killing creative CTFs anytime soon, but it is definitely making cybersecurity's career ladder wobble. In the process it may actually be making CTFs even more crucial.
SANS Institute polled nearly 1,000 security leaders and found unclear career progression to be one of the top hiring challenges, cited by 32%, more than triple the rate last year. Only one-quarter of organizations say they have a clearly defined career path, and entry-level jobs that used to train the next generation of defenders are diminishing. SOC and security analyst roles lead the AI-driven cuts, down 32%. Threat intelligence analysts are next, at 26%, with incident responders close behind, at 22%.
Bug bounty programs are buckling under AI's pressure. At the start of the year, maintainers of the open source project Curl shut down their program after a massive influx of junk AI submissions. HackerOne paused its Internet Bug Bounty program in April after a wave of low-quality, AI-assisted reports flooded in. And this month Google Bug Hunters also paused its open source bounty program due to similar problems.
These are all blows for cyber career progression, as bug bounty problems were another great place for security professionals to flex their skills publicly and for newcomers to gain a foothold into the industry.
As long as CTF organizers can keep their competitions relevant, these events will remain a valuable puzzle piece in the skills training picture for the industry, alongside other important hands-on challenges like cyber ranges.
"With LLMs basically sweeping the table on bug bounties, it's become even harder than it already was for people to get out there, show off their skills, and get their name out there," O'Grady says. "AI has only increased the importance of CTF events like this."
Ericka Chickowski
Contributing Writer, Dark Reading
An award-winning freelance reporter with nearly two decades of experience covering B2B cybersecurity, Ericka Chickowski has tackled every angle of security and risk for Dark Reading since 2009. Her coverage has spanned the full range of cyber topics important to every kind of cybersecurity stakeholder, including cybersecurity practitioners, CISOs, security-minded business managers, and security-aware board directors. She specializes in going deep on topics, breaking down how the technology trends affect real people, and how risk impacts the bottom line.
Some special areas of focus include: adversarial AI; AI risk and resilience; AI and agentic governance; application security (AppSec); governance, risk, and compliance (GRC); cloud security; network security; software supply chain risk; cyberinsurance; DevSecOps; enterprise risk management; and CISO career development.
In addition to Dark Reading, Ericka has written for many different IT and business publications over the years. Her byline has appeared in dozens of trade and consumer magazines, including Baseline, Consumer Digest, Channel Insider, CIO Insight, CSOOnline.com , DevOps.com, eWeek, Entrepreneur, Forbes, InformationWeek, SC Magazine, and SecurityBoulevard . She regularly contributes independent stories about AppSec and supply chain risk to the ReversingLabs Blog. She was one of the founding contributing editors for DevOps.com and has deep expertise in digital transformation and development best practices. This helps inform her stories on software risks and business resilience.
Ericka is also a prolific executive ghost writer, with experience helping cybersecurity and IT leaders bring their ideas to life. She's helped them craft important position pieces for respected publications like the Financial Times and The Wall Street Journal .
Prior to beginning her freelance career, Ericka served in a number of editorial staff roles, including West Coast Bureau Chief for SC Magazine . Before that position, she was editor-in-chief for a cluster of regional technology and lifestyle magazines in the Seattle area, as well as a beat reporter for a regional business newspaper. She holds a bachelor's degree in English from the University of Washington. Her work is well-regarded and has won multiple awards from the Society of Professional Journalists.