🥈 2nd Place, Thailand Cyber Top Talent 2026, Open Division 🇹🇭
2nd Place — Thailand Cyber Top Talent 2026, Open Division
🥈 2nd Place, Thailand Cyber Top Talent 2026, Open Division 🇹🇭
September 14, 2026
🥈 2nd Place — Thailand Cyber Top Talent 2026, Open Division 🇹🇭
Team VantagePoint, representing Vantage Point Security Thailand, finished 2nd in the Open Division of Thailand Cyber Top Talent 2026 (TCTT2026).
The competition began with the online qualifier on 15 August. Our objective was pragmatic: finish in the Top 10 and earn a place in the onsite Final.
Across 24 challenges spanning Web, Mobile, Forensics, Network, Cryptography and OSINT, we solved 22 and qualified in 6th place.
For the Final on 5 September, the objective changed: compete for the top.
29 challenges. 29 solves.#
The Final comprised 29 challenges across Web, Mobile, Forensics, Network and Miscellaneous — and we solved every one.
Our strength was versatility. We don’t operate with rigid specialisations where one person handles Web and another Mobile. Everyone works across disciplines, sharing findings, switching problems and helping unblock one another.
We also approached First Bloods much more strategically. Each was worth an additional 50 points, so challenges without an existing First Blood became high-value targets.
That strategy mattered.
We ultimately finished just 100 points behind first place — two additional First Bloods would have drawn us level; three would have put us ahead.
Close enough to hurt. 😂
Perhaps slightly overprepared#
Two of us arrived so early that we were the first competitors at the venue.
Most teams brought laptops.
We brought desktop PCs, full-size cases and large monitors. 😂
Overkill? Possibly.
But our philosophy was straightforward: eliminate avoidable disadvantages. We wanted familiar machines, properly configured tooling and an environment where we could concentrate entirely on the challenges.
The challenges that stood out#
Dark Willow was a deceptively deep web challenge. What initially appeared straightforward exposed multiple vulnerabilities and plausible attack paths. The difficulty wasn’t finding vulnerabilities — it was distinguishing meaningful exploitation paths from convincing dead ends.
PackRat was particularly memorable.
It went considerably beyond conventional APK reversing: Android reverse engineering, mutual TLS certificate extraction, reconstruction of a custom ECDH/AES-GCM protocol, browser activation, hardware attestation, signature validation and decryption of a dynamically downloaded DEX.
Each stage depended on the last. A minor error in the cryptography, authentication or attestation chain stopped everything downstream.
It was an excellent demonstration of why breadth across security disciplines matters.
AI as part of the workflow#
We also treated AI as an engineering tool rather than a chatbot.
One teammate built a custom CTF-focused AI skill for the competition, providing the model with competition context, CTF methodology and structured workflows rather than repeatedly starting from a blank prompt.
We used it to accelerate source-code analysis, reverse engineering, protocol analysis, scripting, debugging and identification of potential attack paths.
It was useful — but certainly not autonomous.
We still had to validate its reasoning, test hypotheses, debug generated code, recognise false paths and decide where our time was best spent. Challenges involving misleading evidence, stateful authentication, browser verification, short-lived flows and prompt injection were particularly effective at exposing the limits of automation.
The advantage wasn’t simply “using AI”.
It was knowing how to integrate AI into an existing technical workflow without outsourcing judgement to it.
What mattered most#
The biggest lesson wasn’t a particular exploit or tool.
It was time allocation and teamwork.
In a competitive CTF, technical ability is only part of the equation. You need to know when to continue digging, when to abandon a path, when to bring in another teammate and which problem offers the greatest strategic value.
Good tooling compounds that advantage.
Whether it’s a custom script, reverse-engineering framework, automation workflow or AI skill, the objective is the same: remove mechanical work and preserve human attention for the problems that require actual reasoning.
Finally, thank you#
Most importantly, thank you to my teammates. Second place was the result of three people continuing to share information, challenge assumptions and help one another despite running on very little sleep. And a significant thank you to Vantage Point Security Thailand for backing us providing the time to compete, covering competition-related costs, and supporting the AI subscriptions and tooling we used both in preparation and during the event.
That investment in experimentation, learning and technical development matters. We went from 6th in the Qualifier to 2nd in the Final, finishing only 100 points from the top.
I’m proud of that result, but it also makes next year’s objective rather obvious.
🥈 2026: 2nd. 🏆 2027: we come back for 1st.
#ThailandCyberTopTalent2026 #TCTT2026 #CyberSecurity #CTF #VantagePointSecurity #CybersecurityThailand #WebSecurity #MobileSecurity #DigitalForensics