Overview
BunkyoWesterns, a team including Ikotas Labs members, placed first at SAS CTF 2026 Finals, held in Bali, Indonesia, on October 20, 2026. The team finished with nearly twice the score of the runner-up and received the $10,000 first-place prize.
More than half of the BunkyoWesterns players competing in the finals are Ikotas Labs members.
About SAS CTF
SAS CTF is an international cybersecurity competition organized by Kaspersky as part of the Security Analyst Summit. The 2026 online qualifier attracted 1,146 teams worldwide. BunkyoWesterns placed third and advanced to the on-site finals in Bali alongside the other qualifying teams.
The qualifier used a Jeopardy format, in which teams solved discrete challenges. The finals instead used an Attack & Defense format, requiring every team to attack and defend continuously.
What Attack & Defense Requires
In a Jeopardy-format CTF, teams analyze independent challenges in areas such as cryptography, Web security, binary exploitation, and forensics, then submit flags for points. This is the format most commonly associated with CTF competitions.
In Attack & Defense, every team operates the same set of vulnerable services. Players must analyze service code, discover vulnerabilities, and exploit rival teams while simultaneously monitoring attacks against their own systems, applying patches, and keeping services available. Because attack flags rotate frequently, a single successful exploit is not enough; offensive and defensive operations must be automated and sustained.
Winning requires more than applying prepared techniques. Teams must quickly discover vulnerabilities in unfamiliar services, turn them into reliable exploits, identify incoming attacks, deploy emergency mitigations and patches, and restore service without delay.
AI-Assisted Defensive Patching Within Seconds
BunkyoWesterns did not focus on offense alone. The team also operated as a blue team to protect its own services. When an attack arrived, the team used AI to analyze the attack and source code immediately, then created and applied a defensive patch within seconds. This allowed the team to strengthen its defenses without taking services offline and prepare for the next attack.
There is little time to inspect every trace and write every fix manually. By combining the speed of AI analysis with human judgment, the team turned incoming attacks into defensive updates almost immediately. It was a practical demonstration of next-generation cyberattack response under live conditions.
First Place by a Wide Margin
BunkyoWesterns worked on vulnerability analysis, exploit development, and defensive patching in parallel from the beginning of the competition. By rapidly automating successful attacks while keeping its own services operational, the team finished first with nearly twice the runner-up’s score.
This image shows the scoreboard at the Round 210 ranking freeze.
The result reflects more than the ability to solve individual challenges. It demonstrates the operational strength to sustain vulnerability discovery, exploitation, defense, and recovery against live systems in real time.
The Team and Ikotas Labs
More than half of the players in the finals are Ikotas Labs members who work on vulnerability research, exploit development, and security assessments. The ability to identify and validate attack paths quickly, along with the ability to respond immediately to compromised systems, directly supports practical penetration testing and incident response work.
Ikotas Labs provides attacker-led vulnerability assessments, penetration testing, red-team exercises, and incident response support. Please contact us to discuss your security needs.