WICC 2026: Recapture the Flag

With one hour remaining on day two of WICC 2026, the public scoreboard stopped updating.

The competition did not.

The livestream had already ended, so there was no broadcast to catch it either. For the last hour of the inaugural Women’s International Cybersecurity Challenge, the score existed only inside the platform. And that hour turned out to hold the best racing of the whole event: the lead changed hands twice in the final four minutes, seventy-one seconds apart.

Nobody saw it happen.

The Recapture on day two. Photography in the From-the-room panel is by Mark Leahy.

The Recapture puts that finish back on screen. It replays both days of WICC second by second, with the scoreboard, the network telemetry, the livestream and the photography all running on the same clock. Drag the timeline and the whole competition rewinds; stop anywhere and the URL remembers the exact second, so any moment can be sent to someone else.

Two sets of numbers matter here. The raw platform totals at the end of play had the US Cyber Team in front; the official result, after the organisers’ adjustments, placed Team Europe first, the US Cyber Team second and Oceania third. The replay shows both.

One rule shaped all of it: no guessing. Where there’s no footage, the video stops. Where the traffic couldn’t be attributed, the map says so. And where the original system got something wrong on the day, the replay keeps the mistake.

Why I built it

A few months before WICC, in March, I played ZeroDays’ own CTF. It was my first CTF in about a decade, and our team came second in the open event and tenth overall. I came away with two impressions. I’d forgotten how much fun these events are, and I’d forgotten how invisible they are to everyone outside the team rooms. Spectators get a scoreboard, some commentary, and maybe a camera pointed at people typing. The actual contest stays hidden.

CTFRadar was my attempt at fixing a little of that. When ZeroDays staged WICC in July, it sat on the range watching sampled, team-level network traffic, and Luke Guinan gave me a few minutes on the day-one stream to explain what it was doing.

Talking about CTFRadar with Luke Guinan during the day-one broadcast. Frame from the ZeroDays CTF stream.

The players

WICC ran over two days in July at St Laurence’s Church on TU Dublin’s Grangegorman campus, organised by ZeroDays on a platform built by the Overseers. Nine teams entered and eight competed: Team Europe, the US Cyber Team, the UK Cyber Team, Ukraine G1rlUn1ty, Team Canada, the LAC Women’s Cyber Team, Team Asia and Oceania. Regional squads of women from around the world, playing a serious two-day competition in a converted church, with a crowd and a broadcast.

And they put on a show. Fifty-six head-to-head duels across the weekend. Jeopardy challenges hard enough that only seven fell in two days. Sixteen hours of attack and defence that ended with first and second separated, on raw scores, by less than a single duel’s worth of points.

That level of play from all-women teams is still a rare sight in this industry, and it shouldn’t be. It’s hard to aim for something you’ve never seen, and events like WICC make the path visible in a way no careers talk ever will: here are the teams, here is the play, here is what being good at this looks like.

I’ll admit a personal stake in supporting this event with ctfradar.live. I have two daughters of my own, and I encourage both of them to get into tech and more specifically security. Hopefully one day they’ll reach Team Europe levels of performance, and if they do, I’ll be there cheering them on!

The official result, as the replay presents it. Team Europe first, the US Cyber Team second, Oceania third.

The finish nobody saw

The freeze hid the best of it. Team Europe went ahead with about three minutes left; the US Cyber Team took it back seventy-one seconds later. Both moves were 1v1 duel wins, worth a hundred points each, and on the raw platform totals the US finished 99 points in front. A two-day international, decided by less than one duel. It deserved an audience.

The day-two rank trace. The dotted line marks the point at which the public scoreboard froze.

Putting it back together

After the event, SuperFashi from the Overseers gave me the complete scoreboard state: a full snapshot of every team’s standing, once a second, for each eight-hour day. About 13GB of data in total.

The dump had no timestamps, so the real work was alignment: lining the scoreboard up with the telemetry, the livestream and the photographs until everything ran on one clock.

What the map shows

The range view is built from cloud flow logs: sampled, minute by minute, no payloads. It shows the shape of the play, the bursts, the sweeps and the quiet spells, and it deliberately claims nothing more. It won’t tell you who exploited what, and it isn’t a scoreboard.

Traffic moving across the range during a busy period on day two, replayed at 60×.

The replay applies the same straight dealing to CTFRadar’s own history. On day one, the mapping between traffic and competition objectives didn’t come up until 13:04 Dublin.

The live board also spent most of day one in stealth, after a team objected that it gave away too much about rivals’ activity. It kept watching; the room just couldn’t see it. As complaints go, that one was nearly a compliment.

The board became part of the show

CTFRadar started WICC as a telemetry experiment and ended it as part of the entertainment. Over the two days the live board picked up a jumbotron, crowd reactions and a viewer counter, and at the closing ceremony it ran the meme awards: certificates computed from the traffic, each with a QR code so the room could scan a trophy straight off the venue screen. Team Europe collected six of them, which earned them one extra point in the official adjustments.

The orbital view. Continents represent team home regions, not packet locations.

Finding your way around

The complete replay state lives in the URL: day, timestamp, view, span and trace. Move the timeline and the address bar follows, so any moment can be copied, bookmarked or sent to someone else.

Useful places to begin:

• the final eleven minutes, played at 2×
• the moment the public scoreboard froze
• day one before the mapping fix
• the orbital view

Credits

The photography is by Mark Leahy, aligned to the competition clock using each image’s capture time. WICC was organised by ZeroDays and ran on the Overseers’ platform. Luke Guinan produced the broadcast for the ZeroDays CTF channel. SuperFashi provided the per-second dump the replay is built from.

And the sponsors who made the event possible:

• Diamond: State Street, Aer Lingus, TU Dublin - School of Informatics and Cybersecurity, SkillBit (formerly MetaCTF), ZeroDays CTF
• Platinum: National Cyber Security Centre, Ireland (NCSC-IE), Cisco, Munster Technological University
• Gold: Edgescan, TryHackMe
• Silver: OtterSec, Security Risk Advisors, Salesforce
• Community partners: Atlantic Exploit Labs, Tog Hackerspace
• Partners: Cyber Ireland, European Union Agency for Cybersecurity (ENISA), UCD Centre for Cyber Resilience Education - Cyberwise, Women in CyberSecurity (WiCyS), Women4Cyber Ireland, KATZCY, PlayCyber, European Cybersecurity Competence Centre (ECCC)

This is an independent reconstruction rather than an official record, and the published scoreboard is the authority on the result.