Overview
In August 2026, multiple members of our company attended DEF CON 34 in Las Vegas, U.S. At DEF CON CTF Finals, which invites only top teams that clear qualifiers held around the world, we took the world title (championship) as part of the international coalition team Blue Water. On top of that, across Village CTFs and other on-site contests, competing as NECotas (a joint team of our company and NEC Corporation) and as individual members, we finished among the top in the world across a broad range of areas including IoT, red team, blue team, and cloud. The full set of results is as follows.
- DEF CON CTF Finals (main contest): 1st place
- IoT Village CTF: 1st place
- $unL1ght Sh4d0w5: 1st place
- Red Team Village CTF: 3rd place
- Blue Team Village CTF: 3rd place
- Cloud Village CTF: 3rd place
About DEF CON CTF and the Villages
DEF CON is one of the world's largest hacking conferences, first held in 1993. Now in its 34th edition, DEF CON 34 ran from August 6 to August 9, 2026, at the West Hall of the Las Vegas Convention Center. This year's theme was "Agency," referring to self-determination and autonomy.
At the venue, alongside the on-site finals of DEF CON's official CTF, DEF CON CTF, community-run Villages covering specific domains such as IoT, red team, blue team, cloud, automotive, and hardware hosted talks, workshops, and contests.
DEF CON CTF is one of the most historic and prestigious CTFs in the world, first held in 1996. The 2026 edition was organized by Benevolent Bureau of Birds, with a 48-hour online qualifier held from May 22 to May 24. Only top teams that cleared qualifiers held around the world advanced to the on-site Finals in Las Vegas, where they competed for three days in formats including Attack & Defense (A&D) and King of the Hill (KotH).
In the A&D format, each team runs the same set of services while exploiting vulnerabilities in other teams' services and patching and defending their own. In the KotH format, teams contend for a shared target, with points awarded at regular intervals so that a team that keeps meeting the winning condition gains an advantage. Either way, beyond vulnerability discovery and exploit development, the format tests operational stability and the ability to automate both offense and defense.
Each Village operates independently of DEF CON CTF, with its own contest format and target domain. Village CTFs are separate contests from DEF CON CTF Finals, but they test techniques specialized to their respective domains, such as IoT, red team, blue team, and cloud.
World Title at DEF CON CTF Finals
Blue Water cleared the May online qualifier in 9th place and advanced to DEF CON 34 CTF Finals. In the Finals, the team beat the world's top teams to finish 1st out of all competitors and claim the top spot in the world's premier CTF.
Our CEO took part in Blue Water as one of its key members. Multiple Japanese members from several companies joined Blue Water, and many of them were recruited by our CEO. Japanese members active on BunkyoWesterns and undef1ned joined top overseas players and formed the international coalition team for the Finals.
In the Finals, teams have to analyze newly released services, discover vulnerabilities, develop exploits, and monitor and patch attacks against their own services in parallel under tight time constraints. Blue Water combined role allocation among members, prioritization decisions, and automation of both offense and defense, and finished the event in 1st place.
The winning team of DEF CON CTF is awarded the DEF CON Black Badge every year. The Black Badge is the highest honor at DEF CON, granting its holder lifetime admission to DEF CON with the badge alone. Blue Water received eight Black Badges for this year's win.
Placements at Village CTFs and Other Contests
Alongside DEF CON CTF Finals, our members participated in several contests including Village CTFs. For the team-based contests, we competed as NECotas.
- IoT Village CTF (1st place): The CTF run at IoT Village, operated by the security firm Independent Security Evaluators (ISE). The competition focuses on the security of IoT devices and the systems around them.
- $unL1ght Sh4d0w5 (1st place): An individual contest in which entrants extend an exploit chain against a Linux-based cyber-physical system to achieve remote code execution and payload deployment. Our member took 1st place and received a prize.
- Red Team Village CTF (3rd place): An offensive-focused CTF run by Red Team Village, covering intrusion into target networks, exploitation, and evasion of detection.
- Blue Team Village CTF (3rd place): A CTF on defensive investigation and response, with challenges including malware analysis inside containers, reconstruction of cloud attacks, and incident investigation spanning from cloud to OT environments.
- Cloud Village CTF (3rd place): A CTF run by Cloud Village, covering the security of multiple cloud environments including AWS, Google Cloud, and Microsoft Azure.
Our Involvement
Our members took part in DEF CON CTF Finals as part of Blue Water, contributing under BunkyoWesterns and undef1ned. For Village CTFs and other team-based contests, we competed as NECotas, a joint team of our company and NEC Corporation. We supported the members' on-site activity by covering part of their travel costs.
At DEF CON CTF Finals, the Japanese-side members brought tactics, offensive and defensive automation tooling, and knowledge from past challenge trends into the team's overall operation. In the other contests, members with expertise in each domain contributed their respective knowledge and experience.
This year's results reflect our members' world-class technical capability across a broad range of areas including IoT, red team, blue team, and cloud. Winning the world's premier DEF CON CTF Finals while also placing at the top in multiple Village CTFs demonstrates well-rounded strength that is not confined to any single domain, and the expertise built up in day-to-day vulnerability research and security work translated directly into results on the CTF stage.
Security Assessment and Penetration Testing
Building on the insights gained from CTFs and security research, we provide IoT device assessment, vulnerability assessment for web applications and APIs, penetration testing, red team engagements, incident response and defense-strengthening support, and cloud assessment. These are practical assessments and exercises that verify, from an attacker's perspective, vulnerabilities and attack paths that could realistically be exploited. If you are interested, please feel free to contact us.