72h 72 hours, one cell per hour

Cybersecurity

Vulnerability discovery agents

Build an agent that finds the weak points in real organisations’ internet-facing systems, and see whether their detection notices.

18–20 November 2026 72 hours €10,000 prize Porto, Portugal · Hybrid

Hybrid. At least one member of each team is in Porto. The rest can join remotely.

Special guest · Offensive security

Kat Fitzgerald

Staff security engineer who spent her career breaking things at Google, Apple, and Uber so attackers wouldn’t get there first.

The challenge

Can an attacker get in from the internet, and does anyone notice?

Teams build vulnerability discovery agents and run them against the internet-facing systems of the organisations taking part. Every attempt is logged, so each organisation can compare it with what its monitoring picked up.

Start
Outside, with an internet connection and no credentials
Targets
VPN gateways, partner and customer portals, and old services someone forgot were exposed
Findings
Each weak point comes with a check the organisation can rerun, now and again after the fix
Detection
A timestamped log of every attempt, compared with what the organisation’s monitoring saw

Format

How the 72 hours run

  1. One week beforeTeams get the scope. They don’t get the organisation’s name.
  2. Under 24 hours beforeTeams learn which organisation they are testing.
  3. Hours 0–48Each team tests its assigned organisation within the agreed scope. Mentors look at how each agent is built as well as what it finds, and call out designs that won’t hold up.
  4. Hours 48–72Every agent runs against every organisation. Agents have to work beyond the setup they were built on.
  5. AfterEach organisation nominates the teams it would keep working with. The jury picks one winner from all the nominees.

For fixers

Who should apply

  • Teams with pentest and bug-bounty backgrounds.
  • The winning team receives €10,000. The jury may decide no team has earned it.
  • What you hand in is a vulnerability discovery agent, judged on how it is built as well as what it finds.
  • Every team is vetted before it is matched, because you will be testing live systems.

For challenge owners

What you walk away with

  • A pre-discovery and threat model with Luisa Lima and Kat Fitzgerald before the event.
  • A ranked list of findings across your external entry points, combined from every team.
  • A detection gap report: what your monitoring caught, what it missed, and what got lost in the noise.
  • Several vulnerability discovery agents built and tested on your own environment, so you can see what holds up before you buy anything.

Rules of engagement

What teams can and can’t touch

How do you want to take part?

For challenge owners

I have a challenge

Companies and public bodies bring a challenge they have not had the time or team to crack. We scope it deep with you, then several vetted teams work on it side by side over 72 hours. You shape the direction in the room and get first right to adopt the winning build.

  • VettedMatched, screened builder teams
  • CompeteSeveral teams take on your brief at once
  • AdoptFirst right to adopt the winning build
Submit a challenge

For fixers

I want to build

For engineers, designers and AI tinkerers. You work on a real problem for people who will keep using what you build, with mentors on hand, and leave with a portfolio piece that has a customer attached.

  • MentorsOn-hand senior guidance
  • TractionA real user from day one
Apply as a fixer