CTFs that fight back: Building adaptive and procedural hacking environments for offensive security education

Current CTF challenges and training environments are typically static in design. Much like a solved Sudoku or crossword puzzle, once completed, the challenge does not change. Repetition therefore reinforces memory of the solution rather than the underlying problem-solving process. This creates a barrier to continued skill development, requiring learners to constantly seek out new challenges to maintain progression.

Dynamic laboratory generation addresses this limitation by enabling the rapid creation of diverse and reusable training scenarios. Educational institutions and industry can deploy on-demand environments that adapt to desired skill areas, allowing learners to encounter a broader range of systems, vulnerabilities, and attack paths. This not only improves accessibility to high-quality practice environments but also supports continuous skill development without reliance on static content.

In addition to training benefits, dynamically generated CTF challenges enable new forms of game design and participant engagement. As a case study, this talk presents a narrative-driven, time-based, cooperative CTF built using this approach. Key features include:

• Narrative-driven: "It was a military-grade super-AI designed to protect - but it has gone rogue. Now self-aware, it’s breaking free from its digital prison. Will the hackers pull the plug on the AI before it escapes its cage forever? Or will the world be rebooted under the cold grip of its new overlord?"
• Cooperative: Players collaborate as one collective resistance against the CTF that fights back.
• Time-based: Players race against the clock. Every flag captured awards points and bonus time.
• Ephemeral challenges: Some tasks are time-limited; if not solved within the allocated window, they are permanently replaced with new ones.
• Adaptive difficulty: Challenge complexity dynamically adjusts based on player performance, preventing premature completion while supporting struggling participants through catch-up mechanics.
• Procedural variety: Each playthrough presents a unique combination of systems and vulnerabilities, encouraging genuine problem-solving over memorisation.
• Open source: The underlying platform and gameplay functions are open source, allowing the community to expand and grow its functions, features, and pool of modules.

This work demonstrates how procedural generation and modular design can redefine cybersecurity training and CTF experiences, shifting from static exercises to adaptive, scalable, and continuously evolving learning environments.