How CTFs Made Me a Better Engineer (And a Roadmap to Your First One)

It is 3 a.m. I have seventeen browser tabs open, three of which are Stack Overflow threads from 2014 where the accepted answer is “nevermind, fixed it” with zero explanation. My coffee has gone cold twice. I am genuinely convinced the challenge author knows where I live and built this puzzle out of personal spite.

And then I see it. The flag was sitting in an HTTP response header I had scrolled past roughly forty times. This video summarizes the whole CTF experience https://www.youtube.com/watch?v=nCMGIR8V-NE.

That, in one paragraph, is a Capture the Flag competition. And it is the single best thing I ever did for my engineering career.

So what actually is a CTF

A CTF is a hacking competition. Someone builds a deliberately broken thing, hides a secret string inside it called a flag, and you have to break in and find it. The flag usually looks like flag{you_clever_menace}. You submit it, you score points, your serotonin spikes, and you immediately go look for the next one like a raccoon who just found out trash exists.

Challenges come in flavours. Web exploitation, reverse engineering, cryptography, forensics, binary exploitation, and the increasingly chaotic category of “AI stuff we did not have a name for last year.” You can play alone or on a team, for two hours or a brutal forty-eight.

It sounds like a game. It is a game. That is exactly why it works.

The part nobody tells you: CTFs build resilience, not knowledge

Here is the secret. The technical trivia you pick up from CTFs is nice, but it is not the point. Payloads change. Tools get deprecated. The thing CTFs actually install in your brain is stubbornness with a method.

When you have spent twelve hours bypassing a login form on a deliberately vulnerable box, something rewires. You stop believing things are secure just because they look secure. You develop a twitch.

Fast forward to a real engagement. You are reviewing a perfectly normal-looking application and you notice a parameter doing something slightly weird with a quote character. A junior engineer scrolls past it. You do not, because your nervous system has felt this exact discomfort before, at 3 a.m., over a flag. You poke it. It is a SQL injection. It has been there for two years.

That instinct is not talent. It is reps. CTFs are the gym, and the muscle you are training is the refusal to accept “it’s probably fine.” Real security work is ninety percent “it’s probably fine” turning out to be the most expensive sentence in the company.

CTFs are where the future shows up first

Want to know what attackers will be doing in two years? Look at what CTF authors are building this year.

The CTF scene was writing prompt injection challenges while most companies were still arguing about whether they needed a chatbot. Now we have entire categories dedicated to jailbreaking language models, exploiting AI agents, poisoning retrieval pipelines, and convincing an over-eager LLM to hand over a system prompt it was very much told to protect.

This is the underrated magic of CTFs. They are a low-stakes sandbox for high-stakes futures. You get to fail at attacking an AI agent in a competition, for fun, with no incident report, no angry Slack channel, and no lawyer. Then a year later when your company ships an AI feature, you are the person in the room who already knows the failure modes, because you spent a Saturday breaking a toy version of it.

“But can I use AI to solve them?” Yes. Welcome to the discourse.

Every CTF community on Earth is currently having the same argument, and it goes like this. One side says using AI to solve challenges is cheating. The other side says Google was also cheating in 2008 and we all turned out fine.

My honest take: AI is a tool, the same way a debugger is a tool. The skill was never memorising payloads. The skill is knowing what to ask, recognising when the model is confidently, beautifully wrong, and understanding the answer well enough to fix it when it inevitably hallucinates a function that does not exist.

In security especially, AI is a fantastic intern and a terrible oracle. It will hand you a working exploit and an exploit that sets your terminal on fire with equal confidence. Learning to tell those apart is the engineering skill. So use the AI. Then make sure you could have done it without the AI. That gap is where you actually grow.

And if you want the spicy version: go do a challenge where the AI is the target. Nothing teaches you the limits of these systems faster than spending an evening convincing one to betray its own instructions.

A roadmap to your first CTF

You do not need a degree, a fancy setup, or permission. You need a browser and a free evening. Here is the path I wish someone had handed me.

1. Pick a beginner platform and ignore the rest. Start with picoCTF, OverTheWire’s Bandit, or TryHackMe. They are built for people who have never done this. Do not start with the scary 48-hour competition where the team names are in Cyrillic and everyone has a custom toolchain. You will get there.

2. Pick one category. Just one. Trying to learn web, crypto, reversing, and forensics simultaneously is how you learn nothing and feel bad. Most people start with web exploitation because it maps cleanly to things you have seen. Go deep on one lane before you change lanes.

3. Get comfortable being stuck. Being stuck is not a bug, it is the entire product. The discomfort you feel staring at a challenge for two hours is the exact discomfort that, years later, makes you a person who finds the bug everyone else missed. Sit in it.

4. Read the writeup, even when you win. After a challenge ends, people publish writeups explaining how they solved it. Read them religiously. You will discover there were five smarter ways to do the thing you brute-forced. Solving it is not the goal. Understanding it is.

5. Find your people. Join a team or a Discord. CTFs are a team sport and also, conveniently, one of the least gatekept corners of security once you are past the front door. You will learn more from one good teammate than from twenty tutorials.

6. Keep a playbook. Start a notes file. THIS IS VERY IMPORTANT! Every trick you learn, every payload that worked, every “oh THAT’S what that does” moment goes in it. In a year that file becomes the single most valuable document you own. I have mine on Notion(yes it has color-coded databases and seventeen emoji and I stand by every single one).

The actual conclusion

People ask how to break into security and expect me to list certifications. Certifications are fine. But the thing that made me an engineer was not a certificate. It was a thousand small refusals to give up on a problem that a normal, well-adjusted person would have walked away from hours ago.

CTFs taught me that. They taught me that “secure” is a hypothesis, not a fact, and that the most dangerous phrase in this field is “no one would ever do that.” Someone always does that. Usually at 3 a.m. Usually me, in a competition, for a string of text that does not even pay rent.

I am writing this as a Women4Cyber 2026 ambassador, which is the polite institutional way of saying it is now officially my job to drag more women in the cybersecurity world. And I will admit there is a specific quiet joy in being the girl on the scoreboard, the one whose team name nobody expected to see in the top ten, watching a few assumptions recalculate in real time.

3 a.m., day two.

Now go go find your first flag!!! https://tryhackme.com/