(Photo: David Lee)
On any given weekend, U of T students race against the clock to uncover hidden vulnerabilities and “capture the flag” (CTF). But unlike the classic outdoor game, they’re doing it in global cybersecurity competitions.
In just a few years, U of T Capture the Flag (UofTCTF) has grown from a small group of cybersecurity enthusiasts into one of the world’s top student CTF teams. In 2025, it ranked first in Canada and among the Top 25 globally on CTFtime — the premier hub and tracker for cybersecurity competitions — and hosted a competition that drew thousands of participants. Now, the team aims to further its impact.
“I’m really proud of the team,” says Ahtesham Ulhaq, a second-year computer science student and UofTCTF’s vice-president of operations. “It’s incredible how much we’ve grown in a short time. In 2023, we ranked 232nd in the world. Contrast that with 2025, when we were 22nd. The people on this team are really motivated.”
Community and personal impact
UofTCTF, based at the St. George Campus and open to all skill levels, brings together more than 1,400 members from across U of T. It competes in the popular Jeopardy-style format, where players tackle increasingly difficult challenges, from cryptography and web exploitation to reverse engineering and forensics.
“We’re always happy to support people who want to join,” says Ulhaq. “We offer resources on our website and run workshops and training. Many people are interested in playing but may not be at a competitive level yet, so we help them build up to it.”
For Ulhaq, who has been competing in CTF since high school, UofTCTF is both a community and a way to apply classroom learning in real time. One of the benefits for students, he says, is turning theory into practice.
“There are definitely ways students find that CTF connects directly to their coursework,” Ulhaq says. “For example, cryptography draws on math, while reverse engineering relates to operating systems. You’re often applying concepts you won’t formally learn until third or fourth year, which gives you a head start.”
Representing U of T globally
UofTCTF’s approach has delivered standout results. In 2025, the team recorded a dozen first-place finishes and qualified for international finals in New York City, Malta, Romania and Iran.
The momentum has continued into 2026, with UofTCTF not only competing but also hosting its flagship competition. Now in its fourth year, the 2026 edition attracted nearly 4,000 participants from more than 1,500 teams worldwide. It further cemented UofTCTF’s reputation as both a top CTF competitor and organizer.
“It’s incredible representing Canada at the world level and competing against people from other countries,” says Ulhaq. “At the heart, our team is competitive, and we want to keep improving and winning.”
While competition remains central, Ulhaq says the club’s focus is also on broadening access to cybersecurity knowledge, bringing in new members, increasing participation and expanding beyond Jeopardy-style events to attack-and-defence formats.
“Cybersecurity will be more important in the future for everyone,” he says. “We want to expand that knowledge across the computer science student body, while having fun doing it.”