For most internal developer training, pick a jeopardy-style CTF: independent challenges, points per solve, low setup cost. Choose attack-defense only when your team already knows the basics, has a day to spend, and has someone who can run the game infrastructure. Mixed formats suit events with both newcomers and experts.
How the formats work
The CTFtime explainer describes jeopardy as tasks grouped by category such as web, forensics, crypto or binary. Each solved task earns points, usually more for harder ones, and some tasks unlock only after others are solved. The team with the most points when time runs out wins.
In attack-defense, each team gets its own network or host running vulnerable services. Teams usually patch their services and prepare exploits beforehand. Once the game starts they connect to each other's networks and earn defense points for keeping services up and attack points for compromising opponents. Mixed formats combine elements of both, and the exact structure varies by event.
What each one teaches
Jeopardy teaches recognition and exploitation of single bug classes. A web challenge about injection teaches injection. It is easy to tune difficulty, easy to run asynchronously, and forgiving of mistakes.
Attack-defense teaches operations under pressure: patching a live service without breaking it, noticing that you have been attacked, and balancing fixes against uptime. That is closer to real incident work, and it exposes habits that jeopardy hides.
What each one costs
Jeopardy needs a scoreboard, a set of challenges and a flag checker. Many teams can run it from a handful of containers.
Attack-defense needs a network per team, a checker that keeps testing whether services still work, and a way to reset a team whose box has been destroyed. Plan for far more preparation, and for something to go wrong on the day.
A simple decision guide
- First CTF for the team, or mixed experience: jeopardy.
- Fewer than eight people: jeopardy, in pairs.
- Two hours available: jeopardy.
- A full day, experienced engineers, and a spare engineer to run infrastructure: attack-defense is worth considering.
- Want something repeatable every quarter: jeopardy with new challenges added each time.
A hybrid that works
Run a jeopardy morning and a short "patch the service" afternoon. Give each pair one service that carries the same bug they exploited earlier, and ask them to fix it while a simple checker confirms the service still works. You get much of the attack-defense lesson with a fraction of the infrastructure.
For wider context on running these events, see CTF driven security training for engineering teams.
Quick check
Which format is better for beginners?
Jeopardy. Challenges are independent, so one stuck task never blocks the rest of the session.
Can we mix the two formats?
Yes. Mixed events are common, and the structure varies. A jeopardy block followed by a patching exercise is a practical middle path.
Sources
Last reviewed: 19 October 2026.
