Capture-the-Flag (CTF) is a cybersecurity exercise in which participants solve technical challenges to uncover hidden “flags,” usually short secret strings that prove the task was completed. CTFs are designed to test offensive skills such as web exploitation, reverse engineering, cryptography, binary analysis, and privilege escalation.
CTFs matter because they train the same reasoning attackers use in real intrusions: finding weak inputs, chaining vulnerabilities, and extracting proof from a target. Security teams also use CTF-style tasks for hiring, training, and red-team practice. In real environments, the CTF mindset can be useful for defenders when evaluating attack paths, but it can also become risky if a test setup is not isolated. If internet access or production systems are reachable, a “sandbox” can turn into a live incident instead of a safe exercise.