Capture-the-Flag (CTF) competitions are widely praised as hands-on, practical cybersecurity training—but do they actually translate into better performance in a real-world SOC?

This round-table brings together SOC professionals to cut through the hype and discuss where CTFs genuinely add value—and where they fall short. We’ll explore how skills learned in offensive, time-boxed challenge environments map (or fail to map) to day-to-day SOC realities like alert triage, incident response, detection engineering, and threat hunting.

Key discussion angles can include:

• Skill transfer: Which CTF skills actually help in a SOC, and which are mostly academic or ego-driven
• Blue vs. red bias: Are most CTFs too attacker-centric for defensive teams?
• Junior vs. senior value: Who benefits most—new analysts, seasoned responders, or specialists?
• Tooling vs. thinking: Do CTFs teach real analytical thinking or just tool-specific tricks?
• Time & ROI: Are CTFs a good use of scarce SOC training time compared to labs, simulations, or live-fire exercises?
• Culture & motivation: Do CTFs improve team engagement, curiosity, and retention—or just reward the loudest hackers?

Todd James
Head of Cyber Defense
Operations at Swisscom AG