Use a lunch-and-learn to raise awareness, a workshop to build a specific skill, a CTF to build energy and practice under light pressure, and a code review session to change what happens in your own repositories. Choose by the outcome you want, then by the time you have.
The four formats
Lunch-and-learn (30 to 45 minutes). One speaker, one topic, mostly listening. Cheap to run and good for introducing a new risk or policy. Weak at changing behavior, since nobody practices anything.
Workshop (90 minutes to half a day). Short framing, then labs. This is where skills form. Cost is preparation: a lab per bug class and a facilitator who has done it before.
CTF (two hours to a day). Competitive, social, and good for finding who is curious. Teaches recognition and exploitation. Needs a scoreboard and challenges, and some people dislike competition, so offer pairs or team play.
Code review session (45 to 60 minutes). The group reviews real or lightly edited code from your own services. It has the best transfer to daily work, because the patterns are yours.
Decision table in words
- Goal is awareness of a new topic: lunch-and-learn.
- Goal is that people can fix a specific bug class: workshop.
- Goal is team energy, hiring interest or discovering enthusiasts: CTF.
- Goal is fewer findings in our code: code review session, then a workshop on the recurring pattern.
- Audience is mixed, including non-developers: lunch-and-learn.
- Audience is experienced engineers: CTF or review session.
Sequencing for a quarter
A pattern that works: a lunch-and-learn in month one to frame the theme, a workshop in month two with labs, and a review session or small CTF in month three to apply it. Each step builds on the last, and each has a different cost.
What to measure
Awareness events: attendance and questions. Workshops: lab completion and a short quiz after a week. CTFs: participation and the number of people who volunteer for the next one. Review sessions: actions opened and closed in the repositories. See how to measure whether training worked.
Mistakes to avoid
Running only lunch-and-learns and expecting code to change. Running a CTF with no follow-up, so the energy fades. Choosing a format because it was fun last year, not because it fits this year's problem.
Budget thinking
A talk costs one speaker's hour plus prep. A workshop costs several days of preparation the first time and little afterwards, since labs are reusable. A CTF costs challenge writing up front. Reuse is what makes the second and third sessions cheap, so store your labs.
Quick check
Which format changes developer behavior most?
Hands-on formats tied to your own code, such as workshops and code review sessions, usually transfer best because people practice the exact patterns they use.
Can one event combine formats?
Yes. A short talk, a lab block and a mini CTF in one afternoon is a common and workable mix.
Last reviewed: 19 October 2026.
