When
May 26–29, 2026
Format
Offline and online
For blue teams
The world's biggest competition
for cybersecurity specialists
The world's biggest competition
for cybersecurity specialists
When
May 26–29, 2026
Format
Offline and online
For blue teams
The world's biggest competition
for cybersecurity specialists
The world's biggest competition
for cybersecurity specialists
Join a hyperrealistic international competition where blue teams of cybersecurity experts (aka defenders) investigate and respond to attacks by white hat hackers, gaining hands-on experience to effectively protect companies in real life
Since 2016
Standoff has been held internationally
200+
top-notch ethical hackers will put blue teams' readiness for cyberattacks to the test
1,500+
replicas of industry-specific systems and software
Gain years' worth of experience in just four days
Get into the thick of battle with 1,000+ cyberattacks
and boost your skills so real threat actors never catch you off guard.
Examine strategies used by 200+ attackers
to better understand how genuine adversaries could act in the wild.
Fine-tune team collaboration
and develop action plans for scenarios your organization might face in real life.
Try out cutting-edge information security tools
employed by major companies.
Main objectives of blue teams during the battle
Detecting incidents
Investigating critical events
Critical events are events that inflict financial and reputational damage on organizations and can temporarily disrupt the operation of an entire business or individual departments, lead to human casualties, pose health threats, or cause environmental damage.
Some blue teams can also respond to attacks using up-to-date security tools, which allows them to demonstrate and enhance their expertise.
Blue teams can participate in the cyberbattle in one of two modes:
- In monitoring mode, teams detect incidents and investigate attacks.
- In response mode, teams can additionally prevent and repel attacks to protect their sector. This mode is recommended for teams with prior Standoff experience.
Cyberbattle stages for blue teams
Stage 1. Application submission
Fill out the form on behalf of your team, and we'll contact you within five days to discuss the terms and cost of your participation.
Team requirements
🔵 Team size: up to 15 members
The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members to increase your chances of success.
🔵 Full engagement in the cyberbattle
Make sure to clear your schedule for the entire duration of the cyberbattle since complete concentration on the competition is key to achieving the best results.
Team requirements
🔵 Team size: up to 15 members
The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members to increase your chances of success.
🔵 Full engagement in the cyberbattle
Make sure to clear your schedule for the entire duration of the cyberbattle since complete concentration on the competition is key to achieving the best results.
Stage 2. Communication support and team data provision
🔵 Joining the group chat
Once the terms of participation are agreed upon, we'll create a Telegram chat for all team members. This chat will be the main communication channel between the team and the organizers.
🔵 Filling out the registration form
The team captain or representative needs to fill out the form to register the team on the Standoff 365 Platform, where cyberbattles take place.
🔵 Providing extra information about the team
We'll ask the team captain or representative to provide more detailed information about the team and its members. This is important because the Standoff Cyberbattle is not just a competition, but a large-scale media event where we present teams to spectators and the community, including through media publications.
In particular, we'll ask for the team logo and team members' email addresses, and we'll also inquire whether the team would like to participate under its organization's name or remain anonymous.
Once the terms of participation are agreed upon, we'll create a Telegram chat for all team members. This chat will be the main communication channel between the team and the organizers.
🔵 Filling out the registration form
The team captain or representative needs to fill out the form to register the team on the Standoff 365 Platform, where cyberbattles take place.
🔵 Providing extra information about the team
We'll ask the team captain or representative to provide more detailed information about the team and its members. This is important because the Standoff Cyberbattle is not just a competition, but a large-scale media event where we present teams to spectators and the community, including through media publications.
In particular, we'll ask for the team logo and team members' email addresses, and we'll also inquire whether the team would like to participate under its organization's name or remain anonymous.
Stage 3. Access setup and general instructions
🔵 Access to training materials
The team will get access to the knowledge base and tutorials that will help them prepare for the cyberbattle.
🔵 Guidelines
We'll provide a step-by-step guide on how to use the Standoff 365 Platform and register the team for the cyberbattle.
🔵 VPN setup
To access the cyberbattle infrastructure, each team member needs to set up a VPN connection following the instructions provided in their Standoff 365 account.
🔵 Test cyberbattle
The team will receive access to a test cyberbattle to get familiar with the platform's interface and practice before the competition.
The team will get access to the knowledge base and tutorials that will help them prepare for the cyberbattle.
🔵 Guidelines
We'll provide a step-by-step guide on how to use the Standoff 365 Platform and register the team for the cyberbattle.
🔵 VPN setup
To access the cyberbattle infrastructure, each team member needs to set up a VPN connection following the instructions provided in their Standoff 365 account.
🔵 Test cyberbattle
The team will receive access to a test cyberbattle to get familiar with the platform's interface and practice before the competition.
Stage 4. Onboarding
🔵 Knowledge base and resources
Our knowledge base for blue teams provides all the information and materials needed for the cyberbattle.
🔵 Mentor support (optional)
Teams aiming to maximize the benefit from their participation in the cyberbattle can discuss the terms of receiving support from a mentor, who is a first-rate expert in a particular field.
To get the team competition-ready, the mentor will meet with the team, review completed tasks, and provide actionable feedback to level up your skills.
Below is an approximate plan for the meetings.
🔵 Introductory meeting with the mentor and organizers
At this meeting, the team will:
🔵 Technical preparation
At this meeting, the team will receive:
🔵 Feedback session
At this meeting, the mentor will:
🔵 Final preparation
This session is held on the day before the cyberbattle. The mentor will:
The total number of meetings will be determined based on the team's level of preparation and specific needs.
Our knowledge base for blue teams provides all the information and materials needed for the cyberbattle.
🔵 Mentor support (optional)
Teams aiming to maximize the benefit from their participation in the cyberbattle can discuss the terms of receiving support from a mentor, who is a first-rate expert in a particular field.
To get the team competition-ready, the mentor will meet with the team, review completed tasks, and provide actionable feedback to level up your skills.
Below is an approximate plan for the meetings.
🔵 Introductory meeting with the mentor and organizers
At this meeting, the team will:
- Meet the mentor and the organizers.
- Learn about the interaction formats and the next steps.
- Receive cyberbattle preparation materials.
- Get access to the test environment..
🔵 Technical preparation
At this meeting, the team will receive:
- Access to the Standoff Cyberbones online simulator.
- Quick start guides.
- A breakdown of team roles and responsibilities.
- Examples of good and bad reports.
🔵 Feedback session
At this meeting, the mentor will:
- Walk through a sample investigation.
- Provide important cyberrange checklists.
- Analyze key mistakes that the team made when handling tasks.
🔵 Final preparation
This session is held on the day before the cyberbattle. The mentor will:
- Discuss organizational aspects of the cyberbattle.
- Check the team's readiness.
- Give final tips and recommendations.
The total number of meetings will be determined based on the team's level of preparation and specific needs.
Stage 5. Cyberbattle
All cyberbattle participants can look forward to four days of exciting challenges and complex cases that will enrich their professional experience and create memories for years to come.
P.S.
🔵 After the cyberbattle, blue team members will receive the following:
Please note that we prepare gifts and merch in advance, with up to 15 packages allocated per team.
🔵 For teams with a mentor
Three weeks after the cyberbattle, we will hold a concluding meeting with each team to discuss their results and give professional recommendations and advice.
- Personalized certificates as well as team certificates of participation
- Memorable gifts and merchandise
Please note that we prepare gifts and merch in advance, with up to 15 packages allocated per team.
🔵 For teams with a mentor
Three weeks after the cyberbattle, we will hold a concluding meeting with each team to discuss their results and give professional recommendations and advice.
Start preparing for the cyberbattle now
to excel at the four-day challenge
to excel at the four-day challenge
FAQ
How much does it cost for a blue team to participate in the cyberbattle?
The cost depends on several factors, including the team's chosen participation mode:
🔵 In monitoring mode, blue teams detect incidents and investigate attacks.
🔵 In response mode, teams can additionally prevent and repel attacks to protect their sector.
🔵 In monitoring mode, blue teams detect incidents and investigate attacks.
🔵 In response mode, teams can additionally prevent and repel attacks to protect their sector.
What participation formats are available?
There are two participation options for blue teams:
🔵 The online format is the default option that allows you to join the cyberbattle from anywhere in the world.
🔵 The offline format means that team members will be physically present at the event venue in Moscow, Russia.
The participation format is discussed individually with each team.
🔵 The online format is the default option that allows you to join the cyberbattle from anywhere in the world.
🔵 The offline format means that team members will be physically present at the event venue in Moscow, Russia.
The participation format is discussed individually with each team.
How many members can a team have?
According to the rules, blue teams can have up to 15 members.
🔵 The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members. Otherwise, handling all assigned tasks may be difficult. Each team should have members with the following roles:
🔵 The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members. Otherwise, handling all assigned tasks may be difficult. Each team should have members with the following roles:
- Captain (coordinator)
- First- and second-line analyst
- Industrial control systems (ICS) specialist
- Risk manager (for inventory and process management)
- Vulnerability and attack vector analysis specialist
- Technical writer
Can team members be changed after registration?
The team captain can add and remove team members via the Standoff 365 Platform right up until the event starts. However, participants who are added later will have less time for preparation.
Can the team name and description be changed after registration?
Yes, you can change this information after registration, but no later than two weeks before the event starts.
Note.
If you make last-minute changes to the team description, the initial description may still appear on the event-related resources and in marketing materials. For this reason, it is best to double-check your team's description and logo before submitting them.
Note.
If you make last-minute changes to the team description, the initial description may still appear on the event-related resources and in marketing materials. For this reason, it is best to double-check your team's description and logo before submitting them.
Can I get an official document confirming my participation in the cyberbattle for my employer or educational institution?
Contact our community manager, and we'll prepare the necessary document.
Will participants receive certificates?
Following the cyberbattle, every team member will receive a certificate of participation.
Will participants receive merch?
Each team can get up to 15 packs of merch. You can pick up your merch at the Positive Technologies office in Moscow, Russia, or we can arrange delivery to a single address for your entire team.
If you have any questions about participation or the battle itself, please contact us at
blueteam@standoff365.com
blueteam@standoff365.com
Standoff 17 application form for blue teams
Your team can have up to 15 members.
Fill out the form, and we’ll contact you within five days to discuss the terms and cost of your participation. Once your participation is approved, we’ll send you a link to register on the portal.
Fill out the form, and we’ll contact you within five days to discuss the terms and cost of your participation. Once your participation is approved, we’ll send you a link to register on the portal.