Compete

How the competition works

CPTC simulates a real penetration testing engagement. Teams scope, test, and report on a themed environment, and are judged on technical depth, professionalism, and communication.

Download the rulebook (PDF) Knowledge base

The season at a glance

The rhythm of a CPTC season.

A season runs from spring planning through Finals in January.

Spring

Planning & build

CPTC volunteers start planning the year and begin building the competition environment while institutions start planning their teams before their summer breaks.

Summer – Early Fall

Team selection

Institutions and cyber clubs build their rosters, selecting teams of six (plus two alternates), and work with their coaches to practice and plan for the season.

October / November

Regionals

Regionals occur at various Universities and Institutions around the world, with teams and volunteers coming together to compete in that season's themed environment.

January

Finals

The winner of each regional, plus the highest-scoring remaining teams, compete in the Global Finals to crown a champion.

Rules and how it works

The engagement model

Each team plays the role of a security consulting firm hired by a fictional client that changes each season based on the year's theme. Much like a real assessment, Teams are given scope and rules of engagement, then work to identify, exploit, and document vulnerabilities, exactly as they would for a real customer.

What sets CPTC apart is the emphasis on the deliverable and interactions. Discovering a vulnerability is only half the job. Teams must clearly communicate business risk, technical detail, and remediation guidance in a professional report and debrief. They must also interact with the client in a professional manner, exactly as they will after graduation.

Teams

Teams represent a single college or university.
Up to six competitors plus alternates, supported by a faculty or staff coach.
Many schools hold internal tryouts to select their roster.

How teams are scored

Scoring rewards the full professional skill set, not just exploitation:

Technical findings including the depth, accuracy, and impact of discovered vulnerabilities.
Reporting including clarity, risk framing, and quality of the written deliverable.
Communication with the client including debrief and interactions (both written and verbal) during the event.
Professionalism in the way they interact with the client, including staying in scope and conducting the engagement ethically.

Regionals and finals

Teams first compete at regional events held across CPTC's global partner institutions. Top-performing teams from each region advance to the finals, where they take on an evolved version of the same environment, present to the "client board" (a panel of industry volunteers).

Scope and conduct

All activity is confined to the provided competition environment and the published rules of engagement. Acting outside scope, or unprofessionally, results in penalties. CPTC is, first and foremost, training for professional practice.

Dig deeper