Include Security reports that at BSidesSF 2026, 16 teams solved every challenge and top teams automated much of the process with agent pipelines. The useful caveat is that CTFs reward bounded goals, instant flag checks, and low consequence experimentation, while real assessments still need scope control, context, and finding verification.