The world's biggest competition for cybersecurity specialists
When
May 21–24, 2025
May 2025
Online and offline
Cyberbattle
for blue teams
Join the hyperrealistic international competition where blue teams of cybersecurity experts (aka defenders) investigate attacks by white hat hackers and gain hands-on experience to securely protect companies in real life
Since 2016
Standoff has been
held internationally
held internationally
300+
top-notch ethical hackers
will put blue teams' readiness
for cyberattacks to the test
will put blue teams' readiness
for cyberattacks to the test
1,500+
replicas of industry-specific
systems and software
systems and software
Gain years' worth of experience in just four days
Get into the thick of battle with 1,000+ cyberattacks and boost your skills so that actual threat actors can never catch you off guard.
Examine strategies used by 200+ attackers to better understand how genuine adversaries could act in the wild.
Fine-tune team collaboration and develop action plans for scenarios your organization might face in real life.
Get familiar with cutting-edge information security tools employed by major companies.
Want to get the most out of the cyberbattle?
Learn how you can get mentor support from a practicing cybersecurity expert
who will accompany your team and help you enhance expertise in the chosen field
Main objectives of blue teams during the battle:
Detecting incidents
01
Investigating
critical events
critical events
Some blue teams can also respond to attacks using up-to-date security tools, which allows them to demonstrate and enhance their expertise.
02
Don’t miss the chance to make a name for yourself at the cyberbattle
Cyberbattle stages for blue teams
Stage 1.
Application submission
Application submission
Fill out the form, on behalf of your team, and we'll contact you within five days to discuss the terms and cost of participation.
Team requirements
⭐️ Team size: up to 15 members
The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members to increase your chances of success.
⭐️ Full engagement in the cyberbattle
Make sure to clear your schedule for the entire duration of the cyberbattle since complete concentration on the competition is key to achieving the best results.
The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members to increase your chances of success.
⭐️ Full engagement in the cyberbattle
Make sure to clear your schedule for the entire duration of the cyberbattle since complete concentration on the competition is key to achieving the best results.
Stage 2.
Communication support and team data provision
Communication support and team data provision
Joining the group chat
Once the terms of participation are agreed upon, we’ll create a Telegram chat for all team members. This chat will be the main communication channel between the team and the organizers.
Filling out the registration form
The team captain or representative needs to fill out a special form to register the team on the Standoff 365 Platform, where cyberbattles take place.
Providing extra information about the team
We’ll ask the team captain or representative to provide more detailed information about the team and its members. This is important because the Standoff Cyberbattle is not just a competition, but a large-scale media event where we introduce teams to the spectators and the community, including through our live streams from the analytics studio and media publications.
In particular, we will ask for the team logo and team members' email addresses, and whether the team wishes to participate under its organization’s name or prefers to remain anonymous.
Once the terms of participation are agreed upon, we’ll create a Telegram chat for all team members. This chat will be the main communication channel between the team and the organizers.
Filling out the registration form
The team captain or representative needs to fill out a special form to register the team on the Standoff 365 Platform, where cyberbattles take place.
Providing extra information about the team
We’ll ask the team captain or representative to provide more detailed information about the team and its members. This is important because the Standoff Cyberbattle is not just a competition, but a large-scale media event where we introduce teams to the spectators and the community, including through our live streams from the analytics studio and media publications.
In particular, we will ask for the team logo and team members' email addresses, and whether the team wishes to participate under its organization’s name or prefers to remain anonymous.
Stage 3.
Access setup and general instructions
Access setup and general instructions
Access to training materials
The team will get access to the knowledge base and tutorials that will help them prepare for the cyberbattle.
Guidelines
We'll provide a step-by-step guide on how to use the Standoff 365 Platform and register the team for the cyberbattle.
VPN setup
To access the cyberbattle infrastructure, each team member needs to set up a VPN connection following the instructions provided in their Standoff 365 account.
Test cyberbattle
The team will receive access to a test cyberbattle to get familiar with the platform's interface and practice before the competition.
The team will get access to the knowledge base and tutorials that will help them prepare for the cyberbattle.
Guidelines
We'll provide a step-by-step guide on how to use the Standoff 365 Platform and register the team for the cyberbattle.
VPN setup
To access the cyberbattle infrastructure, each team member needs to set up a VPN connection following the instructions provided in their Standoff 365 account.
Test cyberbattle
The team will receive access to a test cyberbattle to get familiar with the platform's interface and practice before the competition.
Stage 4.
Onboarding
Onboarding
Knowledge base and resources
Our knowledge base for blue teams provides all the information and materials needed for the cyberbattle.
Mentor support (optional)
Teams aiming to maximize the benefit from their participation in the cyberbattle can discuss the terms of receiving support from a mentor, who is a first-rate expert in a particular field.
To ensure the highest quality preparation for the competition, the mentor will hold meetings with the team, review completed tasks, and provide valuable feedback.
Below is an approximate plan for the meetings.
Introductory meeting with the mentor and organizers
At this meeting, the team will:
Technical preparation
At this meeting, the team will receive:
Report analysis
At this meeting, the mentor will:
Final preparation
This meeting will be held the day before the cyberbattle. The mentor will:
The total number of meetings will be determined based on the team’s level of preparation and specific needs.
Our knowledge base for blue teams provides all the information and materials needed for the cyberbattle.
Mentor support (optional)
Teams aiming to maximize the benefit from their participation in the cyberbattle can discuss the terms of receiving support from a mentor, who is a first-rate expert in a particular field.
To ensure the highest quality preparation for the competition, the mentor will hold meetings with the team, review completed tasks, and provide valuable feedback.
Below is an approximate plan for the meetings.
Introductory meeting with the mentor and organizers
At this meeting, the team will:
- Meet the mentor and the organizers.
- Learn about the interaction formats and the next steps.
- Receive cyberbattle preparation materials.
- Get a test assignment.
Technical preparation
At this meeting, the team will receive:
- Access to the private infrastructure and the Standoff Cyberbones online simulator.
- Quick start guides.
- Tasks for the test cyberbattle, where the team needs to investigate five cases.
- Examples of good and bad reports.
Report analysis
At this meeting, the mentor will:
- Grant the team access to information security tools.
- Provide important cyberrange checklists.
- Analyze key mistakes that the team made when handling tasks.
Final preparation
This meeting will be held the day before the cyberbattle. The mentor will:
- Provide information about the organizational aspects of the cyberbattle: its time frame, location, schedule, and other important details.
- Check whether the team has access to all the necessary resources.
- Give final recommendations to the team.
The total number of meetings will be determined based on the team’s level of preparation and specific needs.
Stage 5.
Cyberbattle
Cyberbattle
Dates:
May 21–24
All cyberbattle participants can look forward to four days of exciting challenges and complex cases that will enrich their professional experience and create memories for years to come.
P.S.
Following the cyberbattle, blue team members will receive personalized certificates as well as team certificates of participation.
For teams with a mentor
Three weeks after the cyberbattle, we will hold a concluding meeting with each team to discuss their results and give professional recommendations and advice.
For teams with a mentor
Three weeks after the cyberbattle, we will hold a concluding meeting with each team to discuss their results and give professional recommendations and advice.
Start preparing for the cyberbattle now to excel at the four-day challenge
Guide
Key information for cyberbattle participants, including performance evaluation principles and restrictions
Read guide
Recommendations for blues teams on how to fill out reports effectively
Read guide
Guide
Online
simulator
simulator
A collection of real Standoff Cyberbattle incidents packaged into interesting cases that infosec specialists can investigate 24/7
LEARN MORE
Online simulator
Standoff Cyberbones
Standoff Cyberbones
How to fill out reports
Standoff Cyberbattle rules
Become part of the groundbreaking Standoff 15 Cyberbattle
FAQ
The cost depends on a number of factors, including the mode in which the team will participate:
- In monitoring mode, blue teams detect incidents and investigate attacks.
- In response mode, teams can additionally prevent and repel attacks to protect their sector.
There are two participation options for blue teams:
- Online format is the default option that allows you to join the cyberbattle from anywhere in the world.
- Offline format implies that team members will be physically present at the event venue in Moscow, Russia.
Teams that want to be invited to participate at the event venue in Moscow, Russia must discuss it with the organizers as the number of spots is limited.
According to the rules, blue teams can have up to 15 members.
The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members. Otherwise, it might be hard for the team to handle tasks. Each team should have members with the following roles:
The Standoff Cyberbattle is a challenging competition, so we recommend assembling a team of at least 6 members. Otherwise, it might be hard for the team to handle tasks. Each team should have members with the following roles:
- Captain (coordinator)
- First- and second-line analyst
- Industrial control systems (ICS) specialist
- Risk manager (for inventory and process management)
- Vulnerability and attack vector analysis specialist
- Technical writer
The team captain can add and remove team members via the Standoff 365 Platform right up until the event starts. However, participants who are added later will have less time for preparation.
Yes, you can change this information after registration, but no later than two weeks before the event starts.
Note. If you make last-minute changes to the team description, the initial description may still appear on the event-related resources and in marketing materials. For this reason, it is best to double-check the description of your team before submitting it.
Note. If you make last-minute changes to the team description, the initial description may still appear on the event-related resources and in marketing materials. For this reason, it is best to double-check the description of your team before submitting it.
Contact our community manager, and we'll prepare the necessary document.
Following the cyberbattle, every team member will receive a digital certificate of participation.
If you have any questions about participation or the battle itself,
please contact us at
blueteam@standoff365.com
please contact us at
blueteam@standoff365.com
Copyright © 2025 Standoff 365. All rights reserved.
EN
Standoff 15 application form for blue teams
Your team can have up to 15 members.
Fill out the form, and we'll contact you within five days to discuss the terms and cost of participation. Once your participation is approved, we’ll send you a link to register on the portal.
Fill out the form, and we'll contact you within five days to discuss the terms and cost of participation. Once your participation is approved, we’ll send you a link to register on the portal.
Critical events are events that inflict and reputational damage on organizations and can temporarily disrupt the operation of an entire business or individual departments, lead to human casualties, or create health threats.
Blue teams can participate in the cyberbattle in one of two modes:
- In monitoring mode, teams detect incidents and investigate attacks.
- In response mode, teams can additionally prevent and repel attacks to protect their sector.