How to Run a Hardware CTF for a Company Event or School
How to run a hardware CTF for a company event or school: format, teams, logistics, safety, challenge design, budget structure and a full organiser's checklist.
Running a hardware CTF for a company event or school means setting security challenges that people solve with an object in their hands: a radio beacon to decode, NFC tags to read, a memory chip to dump. Done well, it is a team-building and training format that works for very different profiles, from developers to managers. This guide is the operational playbook: format, logistics, safety, challenge design, budget structure and a checklist.
Why a hardware CTF rather than an online one
An online CTF (Capture The Flag, where you hunt for "flags" hidden in deliberately vulnerable systems) is easy to organise: a platform, some challenges, laptops. For an in-person event it has one weakness, though: everyone stays behind their screen, and they could just as well be playing from home.
A hardware CTF changes the dynamics of the room.
- It creates interaction. A team huddled around a circuit board talks, passes tools around, shows what it found.
- It is visible. Onlookers can follow what is going on, which matters for an internal event or a trade show stand.
- It levels the field. A senior web developer has no decisive edge over a network engineer when facing a radio signal. Non-technical people can contribute to the observation and logic challenges.
- It teaches something concrete. Seeing that a badge can be read at a distance, or that a memory chip holds secrets in clear text, changes how people look at the company's connected devices.
It has constraints too: hardware to build, ship and test, and a headcount limited by the number of kits. For a very large audience or several sites, a hybrid physical and online format is often a better fit.
Format: length, teams, mixed skill levels
Length
| Format | Length | Good for |
|---|---|---|
| Taster workshop | 1.5 to 2 hours | A conference break, a university evening, a trade show stand |
| Half day | 3 to 4 hours | Team building, onboarding day |
| Full day | 6 to 7 hours with a break | Internal security event, inter-university competition |
Under an hour and a half, teams don't get past the first challenges. Beyond a day, you need overnight logistics, which only makes sense for audiences who are already enthusiasts.
Teams
Teams of 3 to 5 people work well: enough to split the work, few enough that everyone gets their hands on the hardware. For a company event, build the teams yourself and mix departments; that is the point of team building. For a school, let students choose, but require a mix of year groups if skill levels vary a lot.
Mixed skill levels
This is what makes or breaks the event. Every challenge family needs:
- an entry point a beginner can solve in 10 to 15 minutes with a phone or a supplied tool;
- an intermediate challenge that requires understanding what you are doing;
- a hard challenge to keep technical players busy until the end.
Plan a hint system too, free or paid for in points. A team stuck for 30 minutes switches off, and a team that switches off drags the others down.
Logistics: room, hardware, scoring, safety
Room
- Pods, one table per team, with room for the hardware and a laptop.
- Power at every pod: plenty of extension leads, cables taped down.
- Good lighting: reading silkscreen labels on a board under mood lighting is painful.
- A big screen for the scoreboard, which keeps the competitive spirit going.
Hardware
- One kit per team, plus at least one spare for every few teams. Kit gets dropped, unplugged and worn out.
- Laptops: either ask participants to bring their own, with a list of software to install beforehand, or provide prepared machines. Locked-down corporate laptops often can't install USB drivers, so check before the day.
- Consumables: USB cables, batteries, test leads.
Scoring
A scoreboard platform lists the challenges, validates flags and keeps the ranking. CTFd is the usual choice: it is open source and self-hosts on a small server with Docker, or you can pay for the hosted version. For a short workshop, a shared spreadsheet run by a facilitator can be enough.
Safety
- Electrical. Low-voltage hardware only, powered over USB or by battery. No soldering irons on open tables: pick challenges that need no soldering.
- IT. The scoreboard and challenges run on a network isolated from corporate IT. No challenge targets real infrastructure, employees' badges or building systems.
- Radio. Any transmitters used in challenges must be compliant, low-power devices on permitted bands, such as Bluetooth Low Energy. No jamming, nothing outside the regulations.
- Ethics. Open the event with three minutes on the rules: you attack what was built for it, and only during the event. Pointing out that unauthorised access is a criminal offence, under the UK's Computer Misuse Act 1990 or article 323-1 of the French Penal Code for instance, is part of the awareness value.
Designing the challenges (or bringing in a provider)
Challenge families that work at events
| Family | Example challenge | Participants' tool |
|---|---|---|
| Radio / BLE | A beacon broadcasts an encoded message to capture and decode | Phone with a BLE scanner app, then a laptop |
| NFC / RFID | Tags hidden around the room, each giving the clue to the next | NFC phone, a dedicated reader for protected tags |
| Memory / firmware | A flash chip holds a flag inside a data structure | Supplied USB programmer and clip |
| Serial bus | A board sends data over a UART port | USB-UART adapter, logic analyser |
| Observation and logic | Physical clues, schematics, riddles | None |
These are exactly the families we use for our consumer puzzles, such as the BLE Beacon Decode Challenge planned for summer 2027 and the NFC Escape Tag planned for Christmas 2027: three levels per challenge, nothing to solder.
Doing it in-house
It is feasible if your team includes people comfortable with both electronics and security. Plan for:
- a sheet per challenge: learning goal, flag, full solution, graded hints, estimated solve time;
- at least one dry run with people who didn't design the challenges. That is where you find out the "easy" one takes an hour;
- reliable batch production: what works on one prototype doesn't always work on twenty units;
- a fallback for every challenge that depends on fragile hardware.
Bringing in a provider
It is the safest option for a first edition or a large audience. We design and run hardware CTFs for company events and schools: challenges tuned to your audience, hardware, scoreboard and facilitation. Details and quote requests are on our teams page.
To extend the event, an online component lets participants keep practising afterwards. CyberCTF, our sister platform, offers free, open-source, realistic pentest labs, a good next step for technical profiles who want to go further.
Budget structure for 20, 50 and 100 participants
Costs depend too much on the venue, the number of challenges and the level of customisation to give honest figures without knowing your project. The structure of the budget is always the same, though, and each line scales differently.
| Line | 20 people (≈ 5 teams) | 50 people (≈ 12 teams) | 100 people (≈ 25 teams) |
|---|---|---|---|
| Challenge design | Fixed cost, whatever the size | Same | Same, unless you add challenges to spread teams out |
| Challenge hardware | One kit per team + spares | Proportional to team count | Proportional; batch production becomes an issue |
| Facilitation | 1 or 2 facilitators | Several, one per area | A facilitation team plus a dedicated technical lead |
| Scoreboard | A shared spreadsheet can do | CTFd recommended | CTFd essential, on a dedicated network |
| Room and equipment | A meeting room | A large room, plenty of power | An event space, power and networking to plan |
| Prizes and catering | Your call | Your call | Your call |
Three points to frame your budget:
- Design is a fixed cost. The more participants, the better it pays off. For 20 people, adapting existing challenges is often more sensible than building everything from scratch.
- Hardware can be reused. If the event will recur, investing in sturdy kits pays off over several editions.
- Participants' time is the biggest cost. Half a day for 100 people is worth far more than the event budget itself, which is one more reason to get the difficulty curve right.
Common pitfalls and the checklist
The most common mistakes are predictable: challenges too hard for most players, laptops that can't install a driver, a kit failing with no spare, a scoreboard that depends on the hotel Wi-Fi. The checklist below covers them.
Six to eight weeks before
- Audience, headcount, length and goals agreed
- Provider chosen or design team assembled
- Challenge list signed off, with three levels per family
- Room booked, pods and power planned
Two to four weeks before
- Full dry run with people outside the design team
- Hardware built or ordered, spares included
- Scoreboard installed on an isolated network
- Software list sent to participants, laptop compatibility checked
- Teams drawn up
On the day
- Every pod set up and tested an hour before
- Opening talk on the legal and ethical rules
- Hints ready, facilitators briefed on solutions
- Scoreboard on the big screen
- Final debrief: solutions walked through in 15 minutes, which is where most of the learning happens
Afterwards
- Short feedback survey
- Solutions and resources sent to participants
- Hardware inventoried for next time
For your next event
A successful hardware CTF comes down to three things: well-tuned difficulty, hardware logistics planned early, and a debrief that turns the game into learning. If you would rather hand over design and facilitation, see our offer for companies and schools, and have a look at our physical CTF puzzles to get a feel for the kind of challenges involved. For the basics of the format, our guide what is a CTF is also a handy primer to share with participants.
Frequently asked questions
Do participants need to be experts for a hardware CTF?
No. A good event hardware CTF has beginner challenges that can be solved with a phone or a supplied tool, then harder ones for technical profiles. Mixed teams let everyone contribute.
How long does it take to prepare a hardware CTF?
Allow several weeks for an event using existing challenges, and several months if every challenge is custom-built, including dry runs and hardware production. The more participants, the earlier the hardware logistics need to start.
Is a hardware CTF a risk to the company network?
It shouldn't be. Challenges run on dedicated hardware and, if a scoreboard is needed, on a network isolated from corporate IT. No challenge should target the company's real infrastructure or employees' badges.
Can you combine a hardware CTF with an online CTF?
Yes, and it is often a good idea. The hardware challenges bring the room to life on the day, and an online component lets people keep practising afterwards or include remote teams.