Services
Security Training & CTFs for Teams
Practical, hands-on sessions that help developers and technical teams recognise, exploit in a safe lab, and fix the security flaws that matter in their work.
Training built on practice
Security awareness slides rarely change how software is written. Practical training does: when developers see a vulnerability exploited in a lab, then fix it themselves, the lesson sticks. Our sessions draw on the same practical approach we use in our community CTFs and in testing work.
Training is a complement to our testing and review services. It works especially well after an assessment, using the classes of issue that were found — without exposing your actual findings — to help the team avoid them in future.
What sessions can cover
Content is shaped around learning objectives agreed with you in advance. Sessions can draw on topics such as:
Web and API vulnerabilities
How common flaws such as injection, broken access control, and SSRF work, how they are found, and how to prevent them.
Secure development practices
Input validation, output encoding, authorization patterns, secret handling, and dependency hygiene in everyday code.
Defensive security concepts
How attacks are detected and investigated, and what developers can do to make applications easier to defend.
Authorised CTF exercises
Capture-the-flag challenges run in purpose-built, isolated lab environments — never against real systems.
Not every area applies to every engagement. The areas tested are listed in the scope we agree with you before work starts.
Format and delivery
Before any session we agree the audience, their experience level, the learning objectives, and the format. Format, duration, and delivery method — for example, live remote sessions — are agreed per engagement.
All hands-on exercises use safe, isolated environments built for training. Participants never test systems they are not authorised to test, and acceptable-use rules are explained at the start of every session.
What's included
Depending on the agreed format, an engagement can include:
- A session plan aligned to the agreed learning objectives.
- Facilitated workshop or lab sessions with practical exercises.
- Access to the lab or CTF environment for the duration of the session.
- Reference material participants can return to afterwards.
To plan a session
- The size and experience level of the group, and the technologies they work with.
- What you want participants to be able to do afterwards.
- Preferred format, dates, and time zones.
Please don't send credentials, keys, or vulnerability details through the website form. We agree a secure channel once an engagement is confirmed.
Engagement process
From first conversation to verified fixes
A simple, predictable process. Actual timing and deliverables depend on the scope we agree.
Swipe to see all 6 steps
FAQ
Training & CTFs: common questions
Can't find your answer? Ask us directly, or browse every question in the full FAQ.
No. The Academy and community CTFs are our public learning resources. Team training is a separate engagement, planned around your organisation's objectives and audience.
Sessions can be shaped around the technologies and vulnerability classes relevant to your applications. We don't use your real systems or confidential findings as live training targets.
Planning security training for your team?
Tell us about your application, API, or software security requirements. We can discuss the appropriate scope and next steps.
What happens next
- 01We review your enquiry and reply by email
- 02An initial discussion about your application and goals
- 03A written scope — nothing is tested until it's agreed