CyberStakes

CyberStakes
Name	CyberStakes
Status	Active
Genre	Esports, Cybersecurity Competition
Venue	Variable
Organizer	Independent consortium
First	2012
Frequency	Annual

CyberStakes CyberStakes is an annual international competitive series focusing on offensive and defensive digital operations that brings together participants from academic, industry, and government sectors. The event features capture-the-flag style challenges, red-team/blue-team exercises, and live incident-response scenarios drawing competitors from across North America, Europe, Asia, and Oceania. CyberStakes emphasizes real-world simulation, operational tradecraft, and collaborative problem solving among teams representing universities, corporations, and research labs.

Overview

CyberStakes assembles teams comprising students and professionals affiliated with institutions such as Massachusetts Institute of Technology, Stanford University, University of Cambridge, ETH Zurich, Tsinghua University, National University of Singapore, University of Oxford, University of Toronto, Imperial College London, California Institute of Technology, Harvard University, Princeton University, University of California, Berkeley, Carnegie Mellon University, Georgia Institute of Technology, University of Michigan, Peking University, University of Tokyo, Seoul National University, University of Melbourne, University of Sydney, École Polytechnique Fédérale de Lausanne, Technical University of Munich, KTH Royal Institute of Technology, Delft University of Technology, University of Illinois Urbana–Champaign, University of Washington, Columbia University, Cornell University, University of Pennsylvania, Johns Hopkins University, University of California, Los Angeles, Yale University, University of Edinburgh, University of British Columbia, McGill University, University of Hong Kong, National Cheng Kung University, Kyoto University, Osaka University, Hong Kong University of Science and Technology, Indian Institute of Technology Bombay, Indian Institute of Science, Aalto University, Chalmers University of Technology, Universidad Nacional Autónoma de México, Universidade de São Paulo, University of Cape Town, Tel Aviv University, Ben-Gurion University of the Negev, Technion – Israel Institute of Technology, Hong Kong Polytechnic University, Nanyang Technological University and industry partners including Google, Microsoft, Amazon, Cisco Systems, IBM, Intel Corporation, Facebook, Twitter, Oracle Corporation, SAP SE, VMware, CrowdStrike, Palo Alto Networks, FireEye, Kaspersky Lab, Symantec Corporation, McAfee, Check Point Software Technologies, Juniper Networks, Hewlett Packard Enterprise, Red Hat, GitHub, Atlassian, Uber Technologies, Airbnb, Goldman Sachs, JP Morgan Chase, Bank of America.

History

CyberStakes was founded in 2012 by a coalition of academics, practitioners, and non-profit groups inspired by earlier exercises like the DEF CON CTF, European Cyber Security Challenge, CTFtime, SANS Institute competitions, and capture-the-flag events hosted at Black Hat USA and RSA Conference. Early editions drew on methodologies from DARPA programs and incident-response frameworks developed by CERT Coordination Center and US-CERT. Over time CyberStakes expanded its scope to include partnerships with NATO Cooperative Cyber Defence Centre of Excellence, United Nations Office on Drugs and Crime, Interpol, Europol, European Union Agency for Cybersecurity, National Institute of Standards and Technology, Cybersecurity and Infrastructure Security Agency, UK National Cyber Security Centre, Australian Signals Directorate, Canadian Centre for Cyber Security, Japan Computer Emergency Response Team Coordination Center, and regional laboratories such as MITRE. High-profile keynote speakers have included delegations from DARPA, executives from Microsoft, senior researchers from Google Project Zero, and academics from Stanford University and University of Oxford.

Format and Rules

Competitions are typically divided into jeopardy-style challenges, attack-defense matches, and red-team/blue-team scenarios modeled on standards from NIST Special Publication 800-series and tactical guidance from ISO/IEC 27001. Teams register under institutional or corporate affiliations like MIT, Stanford, Google, Amazon, IBM, Carnegie Mellon University, University of Cambridge, Oxford University Press (as sponsor), Cisco Systems, CrowdStrike, and banking partners such as Goldman Sachs and JPMorgan Chase for finance-themed challenges. Rules prohibit social engineering against non-consenting third parties and follow disclosure practices informed by Responsible Disclosure norms promoted by groups like Open Web Application Security Project and Internet Society. Scoring integrates automated flag submission, manual adjudication, and forensic review using toolsets developed by contributors from SANS Institute, CERT, MITRE ATT&CK, and academic labs at Georgia Tech and Imperial College London.

Notable Competitions and Results

Notable editions include a 2016 cloud-security series where teams from Amazon Web Services, Google Cloud Platform, Microsoft Azure research groups competed in container escape and orchestration challenges; a 2018 industrial-control simulation featuring teams from Siemens, ABB, and Schneider Electric; a 2020 pandemic-themed incident-response exercise coordinated with World Health Organization protocols; and a 2022 supply-chain challenge involving participants from SolarWinds incident responders, FireEye, CrowdStrike, and academic teams from Harvard University and Carnegie Mellon University. Winning teams have come from Carnegie Mellon University, University of Cambridge, MIT, ETH Zurich, Google Project Zero alumni squads, and private security firms such as Mandiant and CrowdStrike. Media coverage has appeared in outlets like Wired, The New York Times, The Guardian, The Washington Post, The Wall Street Journal, Bloomberg, Reuters, BBC News, The Verge, and TechCrunch.

Technology and Tools

Participants commonly use open-source and commercial tools including Metasploit Framework, Wireshark, Burp Suite, Nmap, OpenSSL, Docker, Kubernetes, GDB, IDA Pro, Radare2, Ghidra, Kali Linux, Remnux, ELK Stack, Splunk, Zeek (software), Suricata, Snort, Hashcat, John the Ripper, Aircrack-ng, OpenVAS, Nessus, OWASP ZAP, Terraform, Ansible, Puppet (software), SaltStack, Git, GitLab, Jenkins, CircleCI, Travis CI, Prometheus (software), Grafana, Ansible Tower, Cobalt Strike, and bespoke frameworks developed at MITRE, SRI International, Fraunhofer Society, IARPA, Lawrence Livermore National Laboratory, Sandia National Laboratories, Los Alamos National Laboratory.

Impact and Controversies

CyberStakes has influenced hiring pipelines at firms like Google, Microsoft, Amazon, Facebook, Palantir Technologies, CrowdStrike, Mandiant, Deloitte, PwC, Accenture, and Booz Allen Hamilton, and informed curriculum updates at MIT, Stanford, Carnegie Mellon, ETH Zurich, Imperial College London, and University of Cambridge. Controversies include disputes over dual-use tool disclosure debated by participants with ties to DARPA, IARPA, and corporate security teams from Cisco Systems and Juniper Networks, questions about sponsorship influence from tech giants such as Google and Microsoft, and legal challenges concerning cross-border data handling involving regulators like European Commission and agencies such as CISA and NCSC. Ethical debates have mirrored discussions in venues like DEF CON, Black Hat USA, RSA Conference, Chaos Communication Congress, and policy fora convened by OECD and United Nations bodies.

Category:Esports competitions