ECSC2026Competitors aged 14–25 qualify through competitions in their home countries. They represent their country in two Capture the Flag (CTF) formats: Jeopardy and Attack-Defense.
Teams solve challenges to find secrets (flags) and submit them for points. Challenges cover web security, cryptography, reverse engineering, software and hardware vulnerabilities, and other categories. Challenge scores decrease as more teams solve them, so challenges solved by fewer teams are worth more points.
Teams earn points by keeping their services running and capturing flags from other teams’ services. They also patch vulnerabilities to prevent opponents from capturing their flags.
Find the competition rules in the handbook.
ECSC 2026 is organised by NFITS Events gGmbH together with Nachwuchsförderung IT-Sicherheit e.V. (NFITS).
The organising team works entirely on a voluntary basis.
The winning teams and host locations from previous editions of ECSC.
Hosted in Warsaw, Poland
2025
Winner: Germany
Hosted in Turin, ItalyWinner: Germany
Hosted in Hamar, Norway
Winner: Denmark
Hosted in Vienna, AustriaWinner: Germany
Hosted in Prague, Czechia
Winner: Romania
Hosted in Bucharest, RomaniaWinner: Germany
Hosted in London, United Kingdom
Winner: Spain
Hosted in Málaga, SpainWinner: Spain
Hosted in Düsseldorf, Germany
Winner: Austria
Hosted in Luzern, SwitzerlandWinner: Austria
Hosted in Fürstenfeld, Austria