By recognizing how their mistakes are easily exploited, builders can incorporate security controls at each development phase. For example, knowing an attacker can execute code via a login screen reinforces that mitigations like AntiXSS library or proper input sanitization must be implemented. Mindsets will shift from “Why would anyone do that?” to “Oh, that’s a big problem!”

Once software applications are deployed, IT operations maintain the availability of key services:  configure servers, protect APIs, manage access, apply patches, and minimize information disclosure.  There are many challenges that reinforce these key security principles that provide defense in depth.

With ranges that progress in difficulty level, CMD+CTRL is the best way to groom Defenders: pen testers, red teamers, and vulnerability assessors. Easier ranges spot potential talent by gauging their understanding of the OWASP Top Ten. Advanced ranges feature complex environments that force experienced staff to make interlinking decisions.