This year, 1,926 players on 1,269 teams took on 57 challenges built around Operational Technology (OT) and Industrial Control Systems (ICS), the most challenges we have put in a single event. The field included plenty of familiar names, among them Gr1dGuardi4ns and hxteam, last year’s top two finishers, along with many other teams who have made the Dragos CTF part of their yearly routine. By the time the clock ran out, 312 teams had solved every challenge.
A CTF is a hands-on cybersecurity competition. Players work through a series of challenges, each built around a realistic scenario, and submit a “flag” as proof they solved it. Challenges range in difficulty and include tasks such as analyzing network traffic captures, working through industrial protocols and tracing an adversary’s path across a network.
Many challenges build on one another, so solving one unlocks the next and players follow a single attack from initial access into the ICS environment. When players get stuck, some challenges offer hints they can buy for a small point cost. Challenges cover both sides of an attack: the techniques an adversary uses against an OT environment, and the skills defenders need to detect and respond to them.
Since 2022, the Dragos CTF has grown from 597 players on 385 teams to nearly 2,000 players on more than 1,200 teams, with players joining from 90 countries by 2025. The challenges grew harder as the field grew larger. In 2022, nine teams solved every challenge and ukatemi finished in under nine hours. Over the next three years, only two or three teams finished each year, and the winners needed most of the event to get there: 31 hours and 39 minutes for ukatemi in 2023, and 33 hours and 3 minutes for Localhorst in 2024.
The margins at the top narrowed too. In 2024, both teams that finished scored a perfect 20,000 points without a hint, so finish time alone decided first place. In 2025, the top three were separated only by hints, with first and second one point apart (hints were a one-point penalty in 2025).
Some names keep coming back: ukatemi won in 2022 and 2023 and placed third in 2024, and OTóż to finished on the podium in 2022 and 2025 and cleared every challenge in 2023.
Incorrect submissions have fallen every year since we started tracking them. In 2024, 80% of all flags submitted were wrong: 33,252 incorrect against 8,178 correct, roughly four misses for every hit. That rate fell to 65% in 2025, and in 2026 it dropped below 45%, with 24,589 incorrect submissions against 31,770 correct. For the first time, players submitted more right answers than wrong ones. The shift is still large enough to explain, so below we’ll look at one of the main reasons behind the drop.
From 2022 to 2025, an average of four teams solved every challenge each year, and winning teams needed more than 24 hours on average to get there.
- 2022: ukatemi won in 8h55m
- 2023: ukatemi won in 31h39m
- 2024: Localhorst won in 33h3m
- 2025: Gr1dGuardi4ns won in 34h25m
In 2026, 312 teams solved all 57 challenges, and 20 of them did it in under two hours. The most likely explanation is AI. We can’t measure it directly, but the data points one way, so let’s dive into the data…
We can’t measure it directly. We didn’t ask players which tools they used, and the scoreboard doesn’t record it. What we can measure is how people played, and the data points one way. Challenges in the Dragos CTF unlock in sequence, so we can see how long each team spent on a challenge after it opened. In past years, harder challenges took longer. This year they didn’t. Our 1,000-point challenges, built around packet captures, ICS protocols and process logic, took a median of about four minutes from unlock to solve, faster than our 400-point challenges, and 43% were solved within three minutes of opening. Historically, the 1,000-point challenges took hours, if not days to complete. They became the differentiator between teams that completed all the challenges and those who gave it their all, but ultimately fell short.
Players also leaned on us less. 197 of the 312 teams that solved everything never used a hint, and 169 of those full clears came from a single player. In 2022, one solo player clearing the board was a highlight of the event. It’s not the norm, it shouldn’t be expected, but we’re dealing with a CTF game-changer now.
AI is now part of how people learn and practice OT security, and used well, it’s a powerful study partner. But a flag is only proof of a solution, not proof of understanding. A model can pull a flag out of a packet capture without the player ever learning what a Modbus write does to a pump, why a setpoint change on a PLC matters, or how a safety system is supposed to respond when something goes wrong. Those are the skills that count on a real plant network, where there is no flag to confirm the answer, the process keeps running while you investigate, and a wrong call can affect safety and operations.
This year’s wrong answers showed the gap: AI confidently suggested real-world CVEs for a scenario where none of them applied, and only a player who understood the environment could tell they were wrong. Teams that worked through the challenges themselves, using AI to check their thinking rather than replace it, left with knowledge they can take back to their own facilities. That is the point of the Dragos CTF, and it is what we will keep building toward.
First, the Dragos CTF team wants to thank every player who made time in a busy week to take part. We spend months building realistic OT challenges and seeing nearly 2,000 players show up reminds us why the work is worth it. As we mentioned above, a record 312 teams solved every challenge this year, with one team leading the way from start to finish.
Congratulations to Knightsec, who solved all 57 challenges in 48 minutes and 21 seconds to win the 2026 Dragos CTF.
The leaderboard was stacked, lots of intense competition at the top. Big kudos to our top five teams!
Learn from real engagements. Every Dragos CTF challenge is built by the Dragos Services team, the same OT experts who work in industrial environments every day. Many scenarios are based on what the team sees in the field, especially during Network Penetration Testing and Incident Response engagements, with all customer details removed. The attack paths, misconfigurations and investigation steps players work through mirror what we find in real OT environments. Those engagements help organizations find both technical and non-technical gaps, from exposed remote access and weak network segmentation to unclear response roles and missing procedures. Playing the CTF gives you hands-on practice with the same problems our team helps customers solve.
For OT asset owners and operators, stronger security starts with an honest look at where your organization is today. The SANS ICS 5 Critical Controls help teams focus limited time and budget on the controls that matter most in an industrial environment, rather than applying IT practices that don’t fit OT.
