HITCON Cyber Range 2026

About Cyber Range

HITCON Cyber Range is one of Taiwan's most challenging hands-on blue-team security exercises. It simulates a company under cyberattack: each team plays the incident response team, finds the attacker's footprints in large volumes of threat alerts and system logs, and responds to the attack.

The competition tests not only each team's technical skill and teamwork; more importantly, it builds hands-on experience and defensive technique, so that teams become familiar with the processes and techniques of investigating security incidents. Taking part strengthens the practical ability to resolve security threats and develops the defensive security talent that companies and government agencies need most.

• SOC
• Monitoring
• IR
• Hardening

Key dates

All times are UTC+8

Format and rules

Format

HITCON Cyber Range 2026 is a single-session global online competition that simulates realistic security attack-and-defense scenarios and tests every aspect of a team's hands-on incident response ability.

Focus: hands-on security incidents, end to end

The competition tests a team's overall hands-on security ability under the pressure of a simulated corporate environment. Tasks include:

• Incident investigation and threat identification: Analyze the various kinds of digital evidence provided by the organizers (such as network traffic, server logs and endpoint activity records) to uncover attacker traces, determine which attacks are real, and identify the key Indicators of Compromise (IOC).
• In-depth attack chain investigation: Trace the full attack chain to establish the attacker's entry point, lateral movement path and ultimate objective.
• Hands-on response: Plan and carry out response measures, such as isolating compromised hosts, removing malware, patching system vulnerabilities and hardening security settings.

Recommended skills

• Familiarity with reading logs from common operating systems (Windows / Linux) and network devices (Firewall / Proxy).
• Ability to read and understand SQL queries and PowerShell scripts.
• Familiarity with SIEM event investigation (e.g., anomalous logins, suspicious files dropped on hosts, signs of lateral movement).
• Knowledge of common attacker techniques and the ability to analyze them with the MITRE ATT&CK® framework (e.g., identifying tactics such as Initial Access, Persistence and Lateral Movement).

Recommended team makeup

The challenges are varied, so we suggest team members bring the following complementary backgrounds and hands-on skills:

• IT operations and system administration (servers, networks, AD/DC management)
• Application security and management
• Security expertise (SOC monitoring and analysis, incident response (IR), digital forensics)

How it works

Format

Global online competition (each team connects to the competition environment over the internet from its own location).

Time

Fri, Oct 2, 2026 10:00 – 17:00 (UTC+8, 7 hours in total).

Accounts

Each team receives 4 login accounts so that its members can compete online at the same time.

Environment

We recommend the latest version of Chrome or Edge for the best experience.

Award ceremony

Held separately on Sun, Nov 8, 2026, followed by a networking reception.

Rankings and awards

Teams are ranked by challenge points and completion time. The Non-Cybersecurity Track and the Cybersecurity Vendor Track are ranked separately. Details of the competition process, environment, scoring criteria and other notes will be sent separately to approved teams before the competition.

Registration

1. Eligibility

This year's competition has two tracks, the Non-Cybersecurity Track and the Cybersecurity Vendor Track. Teams must meet the following requirements:

Team composition

• Each team may have at most 4 players.
• Each team must designate 1 member as its contact person and main point of contact.

Team requirements

• All members must belong to the same company or organization.
• Teams formed across companies or organizations are strictly prohibited.
• Teams cannot be registered under an individual's name.

Track eligibility for companies and organizations

• Non-Cybersecurity Track: the registering company or organization must not be a vendor whose main core business is providing cybersecurity consulting, cybersecurity products, managed security services or related professional cybersecurity services to others (that is, not a security vendor, MSSP or consulting firm). This track aims to strengthen the defense and response capabilities of non-security industries themselves.
• Cybersecurity Vendor Track: vendors whose core business is providing cybersecurity consulting, cybersecurity products, managed security services or related professional cybersecurity services may register for this track.

Team limit

• A single company or organization (determined by its tax ID number or specific legal entity) may register only 1 representative team. If several teams in the same company wish to compete, please coordinate internally in advance and nominate a single representative team.
• This year, registrations are reviewed first come, first served: the system reviews eligibility in the order in which registrations are completed. If a company has more than one registration, the organizers will take the team that was first to complete the registration process as its official representative and will not mediate further.

Team name rules

• Team names may only contain text that displays correctly in UTF-8; Chinese, English, numbers and common symbols/emoji are all allowed.
• Team names are limited to 10–13 characters; anything longer will be automatically truncated or hidden on the scoreboard.
• To keep the scoreboard displaying correctly, team names that disrupt the layout are prohibited, including but not limited to:
  • Excessive stacked characters or special combining characters (e.g., stacked Zhuyin symbols, combined variant characters)
  • Character sequences that break the layout, cause erratic line breaks or overflow the column width
  • Characters that cannot be rendered properly and appear as garbled text or boxes
• If a team name is found not to meet the rules above, the organizers will ask the team contact to change it by a set deadline; if it is not changed in time, the organizers may change it to a default format (such as company name plus a number) without further notice.

2. Selection

To ensure competition quality and stable operation of the systems, places in each track are offered according to registrations and eligibility review; once the places are filled, the organizers may close registration early.

• Cybersecurity Vendor Track: up to 10 teams are expected to be selected.
• Non-Cybersecurity Track: up to 50 teams are expected to be selected.

3. Registration timeline (all times UTC+8)

• Registration opens: Mon, May 4, 2026
• Registration closes: Fri, Sep 18, 2026 23:59 (earlier if places fill up)
• Eligibility results: registrations are reviewed first come, first served, and notifications are sent in batches. First batch: reviewed and notified by the end of July; final batch: expected to be emailed to team contacts by Wed, Sep 23, 2026.

4. How to register

Registration platform

All registration is online. During the registration period, please complete the registration process on the KKTIX registration system.

Review and notification

• The organizers review registrations against the eligibility requirements above, in batches and on a first-come, first-served basis.
• Review results (whether or not a team is approved), as well as later pre-competition notices and instructions, will be emailed to each team's contact.

Awards

1. Participation recognition

Every team that meets the eligibility requirements and takes part in the entire competition will receive one electronic HITCON Cyber Range certificate of participation bearing its company name.

2. Ranking awards

3. Exclusive benefits for winning teams

• Exclusive souvenir: a HITCON Cyber Range souvenir that represents the honor and the journey.
• Certificates: individual and company award certificates.
• Networking dinner seats: 4 seats per team at the post-competition networking dinner, to meet security experts and peers.
• Team performance report: a detailed analysis of the team's performance after the competition, to help the team review and grow.
• Publicity: with the winning company's consent, the list of winners will be published in press releases and on official social media.

4. Award ceremony

The award ceremony is expected to take place on Sun, Nov 8, 2026, to celebrate and honor the winning teams, followed by a networking reception.

Venue

New Taipei City Esports Base

Address

3F., No. 87, Sec. 1, Chongxin Rd., Sanchong Dist., New Taipei City

Discovery Day and award ceremony details →

Organizing bodies

Advisor

Administration for Digital Industries, moda

Organizers

Association of Hackers in Taiwan, HIT · Industrial Technology Research Institute, ITRI

Co-Organizers

TRAPA Security

Prohibited conduct

To keep the competition fair and impartial, teams and their members must follow the rules below; anyone who breaks them may be disqualified from the competition or from awards immediately:

• No conduct that undermines the fairness of the competition: including but not limited to teams exchanging, leaking, buying or spreading answers (flags), hints or solution methods in any form.
• No attacks or interference: any form of cyberattack, malicious scanning, denial of service or unauthorized access attempt against the competition platform, related infrastructure, staff or other teams is strictly prohibited.
• One person, one team: each participant may register for and represent only one team.

The organizers reserve the right to make final modifications and changes to the event, to interpret it and to cancel it, as well as final authority to judge and deal with violations.

Participants must also follow the HITCON Community Code of Conduct, which applies to all online and in-person events organized by the Association of Hackers in Taiwan.