Everything a real event needs. Already built.
Plan, generate, check, deploy
The four stages of an event, in one place. You set the plan — categories, difficulty spread, dates. CTFFactory writes the challenges, checks them, then brings the infrastructure online on its own: compute, private network, containers, routing, TLS. Two to five minutes, and your players have somewhere to log in.
Pick the ground. Set the difficulty. Never get the same challenge twice.
Web, forensics, cloud, crypto, OSINT, pwn, reverse, infra, offsec — browse the catalogue by category and family, pick a specification, and generate it in one click. Every specification takes a difficulty from easy to insane. And two generations of the same specification rarely produce the same challenge: different company, different names, different data, different flag.
An LLM can't solve what it never receives
A downloadable forensic artifact is a solved challenge. Drop the capture into a chat window and the answer comes back in seconds — the exercise measured the model, not the player. So CTFFactory doesn't hand the file over. It opens in a workbench running on our infrastructure, with tshark, tcpdump, scapy and a full shell; nothing downloads, and the container has no outbound network. The player keeps every tool a real analyst uses. What they lose is the shortcut.
The AI designs the event, not just the challenges
Pick one anchor challenge. The AI invents the world around it, then draws a graph: which challenges exist, which services and artifacts they share, and in what order they unlock. You review that graph before a single challenge is generated — and change it if you disagree. What comes out is a chain: what a player finds in one challenge is what opens the next.
That structure is the part a challenge library can never give you. Its tasks were written by different people, for different events, and have nothing to do with each other.
Every event gets a world written for it
A company with a name and a history. Employees with roles, and one of them who opened the wrong file. Locations, organisations, a dated backstory — and a network whose hosts carry that same story. CTFFactory writes the whole bible before it writes a single challenge, which is why the challenges hold together instead of sitting side by side.
- Personas — named staff, each with a role in the incident
- Places & orgs — where things happened and who was involved
- Backstory timeline — a dated chain the players reconstruct
- Central object — the one thing every thread leads back to
Built for the AI era
MCP & API
Connect CTFFactory to Claude, your own agent, or your CI. Create an event, generate a challenge, publish it — by command, not by clicking.
For the person who has to answer for the training
Assign it, then see whether it happened
Most platforms show a learner their own progress and nobody else's — which leaves the person paying for the training with no way to know it is working. The Manager module is that view: who was assigned what, how far each person got, what has slipped past its due date, and which credentials your people now hold. Assign a path to someone with a deadline, export the lot as CSV when someone asks for evidence.
Completions leave the platform too. They are reported to your own Learning Record Store as xAPI statements, so the training your team does here lands in the same system as everything else they do — and Open Badges v3 credentials stay with the person who earned them, verifiable after they have left.
- A bounded role. A manager follows and assigns training — no billing, no SSO settings, no member management. It reads; it does not reach into anyone's account.
- Your identity provider decides who is in. With enterprise SSO enabled, the member list is your IdP's, not ours.
Built for every organizer
Why not just reuse a challenge library? Because its answers are already online. CTFFactory generates content that never existed before — a different company, different names, different network, different flags for every event. There is nothing to look up.
Trust & compliance
The questions procurement asks before anyone gets to play.
Pricing
Plans designed for individual builders, academic programs, training providers, and enterprise cyber teams.
Pricing in CAD ·
Academic discount available on all paid plans ·
Annual billing saves up to 20%.
Free
For solo exploration
- Single-person workspace
- Unlimited participants
- No active managed CTF
- 2 hours
- Limited challenge type (Web & Forensics)
- Custom domain
- 15 AI credits / mo
- Scheduled deployments
- No support included
Student
For schools & students — 80% edu discount eligible
- Single-person workspace
- 1 event collaborator
- Unlimited participants
- 1 active CTF event
- 24 hours
- All challenges type
- Custom domain
- 40 AI credits / mo
- Managed CTF hosting
- Scheduled deployments
- Community support
Starter
For small organizations
- Single-person workspace
- 2 event collaborators
- Unlimited participants
- 2 active CTF events
- 48 hours
- All challenges type
- Custom domain
- 80 AI credits / mo
- Managed CTF hosting
- Scheduled deployments
- Priority support
Team
For growing teams
- Single-person workspace
- 5 event collaborators
- Unlimited participants
- 3 active CTF events
- 7 days
- All challenges type
- Custom domain
- 200 AI credits / mo
- Managed CTF hosting
- Scheduled deployments
- Attack-Defense arenas
- Priority support
Business
Enterprise-grade · Private Cloud Canada
- 25 staff seats
- 25 event collaborators
- Custom participants
- Custom active CTF events
- 14 days
- All challenges type
- Custom domain
- Unlimited AI credits
- Dedicated infrastructure
- Scheduled deployments
- Advanced SSO & RBAC
- Attack-Defense arenas
- Priority support
FAQ
How long until my first event is live?
An afternoon for a full event. A single challenge takes minutes.
Do I need to know CTFd?
No. CTFFactory deploys and configures it for you. If you already run CTFd, export the bundle instead.
Where is my data hosted?
In Canada — PIPEDA and Quebec Law 25 ready, isolated per tenant.
Can I reuse an event?
Yes. Every event is a reusable pack you can redeploy, or regenerate with a new story.
Does it work in French?
Fully — the interface and the generated challenges, stories and artifacts.
Ready to run your next CTF?
Generate, deploy, and run a production-ready CTF event or training session — in French, in English, hosted in Canada, live in under a week.