HARDEN.

Use an organizer-provided baseline to harden a realistic enterprise environment, reduce its attack surface, and submit the result for post-challenge measurement.

PRACTICAL SKILLSTEAMWORKAUTHORIZED ENVIRONMENTS

01 / OVERVIEW

LOCK IT DOWN

DEFENSE
YOU CAN
MEASURE.

Before the challenge begins, organizers assess the template environment and establish the scoring baseline. Teams then inherit a functioning copy that also contains security weaknesses. Your job is to understand what is exposed, decide what matters most, and harden the systems without breaking essential services.

After time expires, organizers scan the hardened environments and compare the results with the baseline. The challenge rewards practical risk reduction across Windows, Linux, and identity infrastructure.

02 / WHAT TEAMS WILL DO

FROM BASELINE
TO BETTER.

REVIEW

Study the organizer briefing, then inspect hosts, services, accounts, policies, and exposed ports across the environment.

PRIORITIZE

Separate urgent exposure from lower-impact findings and build a defensive plan under time pressure.

HARDEN

Secure operating systems, identity, services, access controls, and configurations while preserving required functions.

VERIFY

Confirm required services still work and collect evidence that the intended defensive changes were applied.

DOCUMENT

Record important changes and explain the defensive reasoning that guided the team’s decisions.

HAND OFF

Submit the hardened environment and requested evidence for the organizers’ post-challenge scan.

03 / ENVIRONMENT

REAL SYSTEMS.
REAL TRADEOFFS.

Windows and Linux systems
Identity and Active Directory components
Network services and exposed interfaces
User accounts, permissions, and security policies
Services that must remain available

HOW SCORING WORKS

Organizers assess the starting environment and compare it with the hardened result. Practical risk reduction and required service availability matter. Event-specific checks, weights, and rules are defined for each edition.

2026 scoring reference

Reduce validated weaknesses
Keep required services operational
Avoid changes that create new exposure
Submit requested evidence before time expires

04 / PREPARE

ARRIVE
READY.

Review basic Windows and Linux administration, Active Directory security, access control, patching, service configuration, firewalls, and common hardening guidance.

Teams may draw on recognized guidance such as CIS Controls, NIST resources, ISO-aligned practices, or the Essential Eight. The competition will focus on practical outcomes, not memorizing a framework.

Preparation guide

BUILD YOUR SKILLS

READY TO
LOCK IT DOWN?

Prepare for the challenges