Capture the Flag (CTF).

A cybersecurity competition in which teams solve security challenges to retrieve hidden tokens, used for training, hiring, and community building. It belongs to the Application Security category of cybersecurity.

A cybersecurity competition in which teams solve security challenges to retrieve hidden tokens, used for training, hiring, and community building.

Capture the Flag (CTF) is a cybersecurity competition format where participants find hidden strings — called flags — by solving challenges in categories such as web exploitation, binary exploitation (pwn), reverse engineering, cryptography, forensics, and OSINT. Two main formats dominate: Jeopardy-style, where teams pick standalone tasks worth points, and attack-defense, where each team operates a vulnerable service and attacks others while patching their own. Long-running events like DEF CON CTF set the elite bar; HackTheBox, TryHackMe, picoCTF, and Google CTF democratize learning at all skill levels. CTFs are a staple of security education, recruiting pipelines, and certification training, and have produced many leading exploit developers.

Defences for Capture the Flag (CTF) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CTF competition, Security CTF.