HKCERT Capture The Flag Challenge 2025 Achieves a Record 40% Surge in Participation

According to the latest "Hong Kong Cybersecurity Outlook 2026" released by the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) under the Hong Kong Productivity Council (HKPC), nearly 30% of the 622 surveyed enterprises still lack dedicated cybersecurity staff. Specifically, only 26% of SMEs have a dedicated cybersecurity role, significantly lower than the 59% of large enterprises, reflecting a gap in resource allocation and technology adoption among SMEs.

To cultivate practical talent for the cybersecurity sector, the sixth "HKCERT Capture The Flag Challenge 2025" (HKCERT CTF Challenge) was successfully organised by the Digital Policy Office (DPO), HKPC, and HKCERT. This year's competition was elevated to the first-ever adoption of an attack–defence mode, closely replicating the network setup of real enterprises. Participants experienced first-hand hacking techniques, system vulnerability analysis, threat intelligence gathering, and coordinated response in a simulated real-world environment. Through completing multiple tasks within a limited time, the competition also allowed them to break through the traditional classroom theoretical framework, gain practical experience and build confidence. The event attracted around 1,940 young contestants, an increase of nearly 40% from last year's 1,385 participants, reaching a record high for the competition. Contestants included teams from Hong Kong, Chinese Mainland, Asia, and Europe, fostering cross-regional exchange and collaboration. In the finals, three local teams and one overseas team were awarded gold prizes in the Secondary School, Tertiary Institution, Open Category, and International Category respectively, while Sing Yin Secondary School received the "Best School Award". The full list of awardees is available on the event website.

Participants Share Practical Experience Integrating AI into Attack and Defence
The competition was well received by contestants for its innovative format and realistic offensive and defensive environment, offering a valuable platform for learning and exchange. The winning team in the International Category, W&M, commented, "Our members are from Shanxi, Guangdong and Beijing. This was our first time competing together in the HKCERT CTF Challenge. The atmosphere and experience of the finals were excellent. The tasks were centred on an attack‑defence simulation, requiring us to find all vulnerabilities while patching our own systems and attacking other teams at the same time. Some vulnerabilities were discovered and exploited by other teams first, which kept the scores very close and made the competition incredibly tense and exciting".

They added, "During the competition, we also applied lots of AI techniques for assistance, such as applying AI to analyse vulnerabilities and refine attack methods. In the future, AI may play a deeper role in areas like vulnerability detection and code analysis, but for now it cannot be fully relied upon—human oversight is still essential".

HKCERT CTF Challenge has now been held for six consecutive years, with its scale expanding annually and participants showing continuous growth. Many secondary school students gain their first hands‑on exposure to cybersecurity through the competition and connect with university mentors, helping them shape their academic and career paths. Several past participants have gone on to compete in local and international events, committing to a future in the cybersecurity field. Beyond attracting overseas talent to exchange ideas in Hong Kong, HKCERT continues to build connections between cybersecurity professionals in Hong Kong and Chinese Mainland. Top‑performing teams can gain direct entry into equivalent finals in Chinese Mainland. For example, participants from the previous HKCERT CTF Challenge 2024 advanced directly to the finals of the "Greater Bay Area Cup Cybersecurity Challenge", where they secured the top four places in the Hong Kong and Macao category. This also provided local contestants with access to world‑class cybersecurity techniques, effectively promoting cross‑regional elite collaboration and talent development.

Finals Format Upgraded: Attack-Defence Mode Mirrors Real Enterprise Operations
The finals were comprehensively upgraded this year. In addition to increase the overall technical difficulty, the competition introduced an attack‑defence format for the first time that closely mirrors real enterprise cybersecurity operations. Teams played dual roles—both attackers and defenders—in an environment created with reference to the real-world systems. The tasks simulated incident response and live attack-defence scenarios commonly encountered in the cybersecurity field. Within a limited timeframe, participants had to do penetration testing, exploit vulnerabilities and attack, while patching their own systems and monitoring threats in real time against attacks from other teams. This parallel attack‑defence setup reflects actual workflow patterns in the industry, effectively training participants' analytical abilities and adaptability under pressure. Through hands‑on practice in a likely enterprise environment, contestants developed multifaceted, industry‑aligned capabilities—laying a solid foundation for their future careers in cybersecurity.

Ms Candy CHAN, Assistant Commissioner (Project Governance and Cybersecurity) of the DPO, highlighted the DPO's commitment to enhancing Hong Kong's cyber resilience, with one of its key initiatives being the nurturing of the next generation of cybersecurity professionals. She emphasised that the DPO has been collaborating closely with academia and industry partners to foster a robust talent pipeline and build a safer digital environment in Hong Kong. She noted that this year marks the sixth edition of the HKCERT CTF Challenge, which has grown into one of Hong Kong's most respected and anticipated cybersecurity competitions over the years. Beyond being a contest of technical prowess, the Challenge serves as a dynamic platform for networking, knowledge exchange and community building among the new generation of cybersecurity experts.

Ir Samson SUEN, General Manager of Digital Trust and Transformation Division of HKPC, stated, "HKCERT CTF Challenge has consistently aimed to build an international platform for technical exchange. Through high-intensity simulated contests, we enhance participants' cyber defence skills and promote cross-regional interaction among emerging cybersecurity talents. This cultivates a new generation of globally competitive professionals in Hong Kong and strengthens the local talent pipeline. This year's finals first introduced a simulation of real-world cybersecurity operations, enabling teams to experience both offensive and defensive roles in a recent cybersecurity team. This hands-on approach is crucial for developing practical skills and incident response capabilities".

Fostering Cybersecurity Awareness Across All Sectors of Society
To further enhance cybersecurity awareness across the community, HKCERT has partnered with the DPO and the Cyber Security and Technology Crime Bureau of The Hong Kong Police Force, to launch the "Building a Secure Cyberspace 2026" campaign to promote cybersecurity awareness. The initiative includes various educational activities, such as an "AI-Generated Four-Panel Comic"contest, which encourages the public to make good use of AI tools while strengthening their understanding of cybersecurity. At the corporate governance level, HKCERT will publish a series of practical guidelines addressing emerging risks —such as AI applications and supply chain security—highlighted in the "Hong Kong Cybersecurity Outlook 2026", to support business in establishing a robust protection framework. In particular for AI governance, the guidelines will offer actionable recommendations covering AI system security assessments, compliance rules for employees using public AI platforms, controls over sensitive data input, and methods for monitoring and defending against AI‑assisted attacks. These resources aim to help enterprises systematically enhance their cyber resilience across governance, technology, and awareness.

As Hong Kong accelerates the development of innovation and technology and advances its digital economy, strengthening cyber defence capabilities has become a key talent need. HKCERT will continue to support businesses and the public through incident response, security guidance, and cybersecurity awareness programmes. The HKCERT CTF Challenge continues to play a vital role in nurturing local talent, fostering cross-regional collaboration, and advancing public education. By enhancing the overall level of protection, the competition contributes to the sustainable development of the digital economy and reinforces Hong Kong's long‑term competitiveness.

The seventh edition of HKCERT CTF Challenge will be held in November 2026, featuring more innovative attack-defence challenges and continuing to set up an international category to provide local contestants with a platform for technical exchange with top teams from Hong Kong, Chinese Mainland, and overseas. Registration opens in September 2026, with finalists competing in the live finals in February 2027.

Hashtag: #HKCERT

The issuer is solely responsible for the content of this announcement.

About Hong Kong Productivity Council

The Hong Kong Productivity Council (HKPC) is a statutory body established in 1967, dedicated to enhancing the productivity and competitiveness of Hong Kong enterprises through world-class applied R&D, innovative technology services, and integrated manufacturing solutions. As a market-oriented, international R&D organisation, HKPC leverages its deep expertise and extensive industry experience in key areas such as AI, advanced manufacturing, life and health technology, green technology and new energy to drive new industrialisation and support the growth of emerging and future industries.

HKPC focuses on addressing businesses challenges and industrial technology needs, promoting the full integration between technological and industrial innovation. Through technology transfer, product innovation, intellectual property protection and commercialisation of R&D outcomes, the Council fosters collaboration with the local business community as well as top global R&D institutions, delivering added value to industries and advancing the development of new productive forces. HKPC's world-class R&D achievements have been widely recognised over the years, winning an array of local and overseas accolades, reinforcing Hong Kong's role as an international innovation and technology centre and a smart city.

To help enterprises capitalise on Hong Kong's strengths in international connectivity to expand into global markets, HKPC offers comprehensive overseas expansion services tailored to critical areas including product development, technology, manufacturing, and management, enabling businesses to successfully go global from Hong Kong.

HKPC is also committed to providing timely and practical support to SMEs and startups with timely and practical , assisting them in accessing Government funding programmes. Through its FutureSkills training initiatives, HKPC helps both industry and academia stay ahead in latest digital and STEM technologies, nurturing a future-ready talent pool for Hong Kong.

For more information, please visit HKPC's website: www.hkpc.org/en.