How far down the Rabbit Hole can you go?

In cybersecurity, the gap between theoretical knowledge and real-world capability remains one of the industry’s most persistent challenges. Organisations invest heavily in tools, frameworks, and training and yet when incidents occur, success ultimately depends on the ability to think, adapt, and act under pressure. 

This is the context behind The Rabbit Hole, DNV Cyber’s Capture-the-Flag (CTF) challenge. It is a hands-on, technology-driven experience designed to test how security professionals solve problems when the path forward is no longer obvious. 

From theory to practice 

Capture-the-flag challenges have long been a staple of the cybersecurity community. At their core, they are structured problem-solving environments where participants must identify vulnerabilities, analyse systems, and extract specific pieces of information – the “flags.” 

But The Rabbit Hole goes further than isolated technical puzzles. It is designed to reflect how real attackers operate across multiple domains, requiring participants to combine different disciplines, such as: 

• Application security and web exploitation 
• Cryptography and data analysis 
• Open-source intelligence (OSINT) 
• Digital forensics and structured investigation 

This reflects the reality of modern cyber threats, where attacks rarely stay within a single discipline. Instead, they evolve across layers of technology, requiring defenders to connect insights, adapt their approach, and maintain a structured line of reasoning. 

Thinking like an attacker to defend effectively 

At DNV Cyber, the challenge is built on a clear principle: strong defence starts with understanding how attackers think. The Rabbit Hole is not about memorising techniques or following predefined scripts. It is about developing a mindset based on curiosity, persistence and logic.  

Each challenge is designed to guide participants through signals in the environment. Instead of relying on guesswork, they must analyse patterns, break complex problems into smaller steps and validate assumptions before moving forward. 

This approach reflects how real-world security teams operate. When investigating an incident, there is rarely a clear starting point or a predefined path to resolution. Instead, progress comes from iterative analysis and informed decision-making.

A realistic and immersive environment 

One of the defining characteristics of the Rabbit Hole challenge is its narrative-driven design. Participants are placed into an evolving scenario where they must navigate an unfolding situation, uncover hidden elements, and ultimately reach a defined objective. 

For example, earlier iterations introduced a storyline requiring participants to infiltrate an adversary’s system, identify weaknesses, and retrieve sensitive information. Behind this narrative sits a carefully constructed technical environment that incorporates realistic vulnerabilities and defensive mechanisms. 

This combination of storytelling and technical depth gives context to the problem-solving process. It brings the experience closer to how cyber incidents are encountered in practice, rather than as isolated tasks.  

Learning under pressure 

Cybersecurity skills are not only about knowledge – they are about execution under uncertainty. The Rabbit Hole is designed to simulate this environment by requiring participants to make decisions without complete information. Challenges increase in complexity, forcing individuals to continuously reassess their approach and refine their thinking. 

This “learning by doing” model is widely recognised as one of the most effective ways to develop technical capability. Rather than absorbing information passively, participants actively engage with problems, test hypotheses, and experience the consequences of their decisions. 

Because the environment is safe and controlled, participants can experiment with techniques and learn from the consequences of their decisions without creating real-world risk. 

Building capability across experience levels 

The Rabbit Hole includes different levels of difficulty, aligned with the points awarded for solving each challenge. This makes the experience relevant for participants with different levels of cybersecurity experience, ensuring that both early-career professionals and experienced practitioners can engage meaningfully with the challenge. 

This highlights a wider industry need for broad, practical understanding. As cyber threats become more complex, organisations increasingly rely on teams that can collaborate across disciplines rather than operate in narrow silos. 

By encouraging participants to develop cross-domain awareness, the Rabbit Hole supports this shift towards more integrated, resilient security capabilities.

More than a challenge 

Ultimately, The Rabbit Hole is not only about competition or scoring points. It is a platform for building capability, identifying gaps in technical understanding and strengthening the analytical mindset needed in modern cybersecurity. 

In doing so, it aligns with DNV Cyber’s broader mission: helping organisations safeguard critical systems by combining technical expertise with practical, real-world insight. 

As cyber threats continue to evolve, so must the way organisations build and assess capability. Structured training and theoretical frameworks remain essential, but they are not enough on their own. Practical, scenario-based experiences like the Rabbit Hole play a critical role in bridging the gap between knowledge and execution. 

For those ready to test their approach, challenge their assumptions, and refine their thinking, the question remains: 

How far down the rabbit hole can you go?