Frequently Asked Questions

CyberLuka is a CTF-as-a-Service platform for running Capture The Flag cybersecurity competitions on an interactive world map. Game creators choose countries, assign a challenge to each one, invite teams, and start the game from a browser — the platform provisions all the infrastructure automatically and removes it when the game ends. It is built for cybersecurity trainers, universities, conferences, and corporate team events.

A Capture The Flag competition is a hands-on cybersecurity exercise where participants find hidden strings called flags by exploiting deliberately vulnerable applications. Flags are formatted as CTF{some_text} and each one is worth points; the team with the most points when the timer ends wins. CTFs are widely used for security training because people learn attacks by safely performing them, rather than by reading about them.

CyberLuka is built for cybersecurity trainers, university and vocational lecturers, conference organisers, IT and security managers, and HR or L&D teams planning a security-awareness event. It works equally well for a classroom session, a corporate team-building afternoon, a conference booth activity, or an internal awareness campaign. Participants do not need a security background.

No technical skills are required to create a game on CyberLuka. You choose a name, select countries on a map, pick which challenges to place on them, and click start; the platform provisions every server, database, domain, and certificate behind the scenes. Setup typically takes a few minutes and there is nothing to configure afterwards.

The CyberLuka catalogue covers everyday security awareness (phishing, smishing, QR-code scams, credential stuffing, password reuse, MFA fatigue, fake tech support, tailgating), AI-era threats (prompt injection, improper output handling, data extraction from chatbots), and classic web application security (SQL injection, session hijacking, broken access control, insecure password resets). Challenges are grouped into themes so a game can be pitched at a specific audience, and new ones are added regularly.

Players need only a web browser. There is nothing to install, no VPN to configure, no virtual machine to download, and no account to register — a player opens an invite link, chooses a display name and password, and starts playing. It works on a laptop, a desktop, or a tablet.

Each CyberLuka game is an interactive world map where every selected country holds one cybersecurity challenge. A team conquers a country by solving its challenge and submitting the correct flag, and the country then turns that team's colour on everyone's map in real time. The first team to solve a challenge earns a first-blood bonus, which makes the map a live picture of the competition.

Group size depends on the plan: Free is a single-player trial, Curiosity supports 2 teams of 1 player, Squad supports 10 teams of 2 players (20 players), and Team Event supports 40 teams of 8 players — up to 320 players in one game. For larger audiences, the Custom Event plan removes the team and player limits entirely.

Game length is set by the plan: 30 minutes on Free, 4 hours on Curiosity, 8 hours on Squad, and 12 hours on Team Event, with flexible durations on Custom Event. The game creator decides when to start the countdown, and when it expires flag submissions close and the final leaderboard is locked.

Yes — CyberLuka has a Free plan with 3 introductory challenges and a 30-minute game window, and it does not require a credit card. It runs the same end-to-end flow as the paid plans, so it is the fastest way to see how a game deploys and plays before committing to one.

CyberLuka has five plans: Free (€0), Curiosity (€149), Squad (€499), Team Event (€1,499), and Custom Event (quoted individually). Each is a one-off price for the whole game rather than a subscription or a per-participant fee, and prices are available in EUR, GBP, and USD. The pricing page lists current rates and what each plan includes.

Yes — CyberLuka is designed for cybersecurity courses, workshops, and lab sessions. A lecturer sets the game up before class, shares one invite link per team, and runs the competition live during the session with the projector view on the lecture-hall screen. Because everything runs in a browser, it works in a computer lab, on students' own laptops, or in a fully remote class.

A Capture The Flag competition is one of the most popular team-building activities for IT, development, and security teams, because it is competitive, collaborative, and directly relevant to their work. On CyberLuka, teams race to conquer countries on a shared world map while a live leaderboard updates on the big screen, which turns a security exercise into a spectator event. A half-day Squad game suits most departments.

Yes — CyberLuka was built with conferences in mind. The organiser sets the game up in advance, displays the live world map and leaderboard on a projector or large screen, and lets attendees join throughout the event with an invite link. The Team Event plan runs for up to 12 hours, which covers a full conference day.

Yes — every CyberLuka game includes a dedicated projector view designed for large screens. It shows a dark-themed live leaderboard, a countdown timer, a recent-activity feed, and the conquest map, and it updates automatically without anyone driving it. It is meant for a lecture hall, a conference room, or an office wall during the event.

The game creator sets up the teams and gets one unique invite link per team. A player opens their team's link, enters a display name and a password they choose, and is in the game — no account registration, no email address, and no approval step. Sharing the link is all it takes to onboard a team.

Yes — on paid plans the game creator controls the flag text, the point value, and the first-blood bonus for every challenge. Flags can be written by hand or generated securely by the platform, which is useful when you want challenge-specific answers for a themed event.

When the timer expires, flag submissions close and the final leaderboard is preserved. The creator can review the results — final standings, which team conquered which country, and where the first bloods landed — from their dashboard. The game's infrastructure is then torn down automatically, so nothing is left running or costing money.

Yes — each CyberLuka game runs on its own isolated infrastructure with its own subdomain, challenges, teams, and leaderboard, so any number of them can run in parallel. That makes it practical to give each class, department, or conference track its own separate competition.

No — CyberLuka is fully managed. Server provisioning, databases, networking, domain names, and certificates are all handled by the platform, and everything is removed automatically after the game ends. You never open a cloud console, and there is no leftover infrastructure to pay for or clean up.

CyberLuka runs on European Union cloud infrastructure, and game infrastructure is provisioned in an EU data-centre region. The company is based in the Netherlands, and personal data is processed under the GDPR and the Dutch implementation act. A named sub-processor list is available on request.

Bespoke challenges are available through the Custom Event plan, which also covers custom branding and white-label options. Organisations that want scenarios built around their own tools, brand, or threat model should get in touch through the contact form, and we will scope it with you.

An API for programmatic game creation and integrations with learning management systems such as Moodle and Canvas are on the CyberLuka roadmap and are not available yet. Games are currently created through the web dashboard. If an integration would be decisive for you, get in touch — roadmap priority follows demand.

Support is available by email through the contact form, covering setup questions, technical issues, and advice on structuring an event. For a scheduled event it is worth getting in touch in advance, so the game can be checked before the room fills up.

Create an account with a company or university email address, choose the Free plan, and launch a game — no credit card and no technical setup are required. The Free plan deploys in a couple of minutes and runs the same flow as a paid game, so it doubles as a rehearsal for a real event.

No — CyberLuka is a hosted alternative to self-managed CTF platforms such as CTFd. With a self-hosted platform you install the scoreboard, build and deploy each vulnerable application, manage domains and certificates, and take it all down afterwards; on CyberLuka that whole chain is automated and the challenges are already built. In practice the difference is that a game is ready in minutes, instead of needing days of preparation and someone to operate it on the day.

Yes — CyberLuka's everyday-awareness challenges are designed for people who have never opened a terminal or developer tools. They cover realistic situations such as phishing emails, malicious QR codes, scam phone calls, and reused passwords, and each one comes with step-by-step instructions. Mixed teams work well: non-technical staff take the awareness challenges while engineers take the web and AI ones.

A 50-person event fits the Team Event plan at €1,499, which covers up to 40 teams of 8 players (320 participants), 30 challenges, and a 12-hour window. The smaller Squad plan at €499 tops out at 10 teams of 2 players (20 participants), so it suits a single department rather than a 50-person group. Both are one-off prices for the whole game — not per participant, and not a subscription.

Creating a game on CyberLuka takes a few minutes: name it, pick countries on the map, choose challenges, set the flags and points, and confirm. The platform then deploys it automatically — a Free game is usually ready in a couple of minutes, and larger games take a little longer as more challenges are provisioned in parallel. You can prepare a game days in advance and start the countdown whenever the event begins.

Yes — CyberLuka is entirely browser-based, so players can take part from an office, from home, or from anywhere with an internet connection. Teams share a single invite link regardless of where their members are, and the live map and leaderboard give a distributed group the shared focal point a room would normally provide. For hybrid events, running the projector view on a screen-share alongside a video call works well.

CyberLuka is available in eight European languages: English, Dutch, German, French, Spanish, Italian, Portuguese, and Croatian. Both the platform interface and the challenge content are translated, and each player picks their own language independently — so a multinational team can play the same game, each in their own language, at the same time.

Yes — CyberLuka is a European platform operating under the GDPR, the Dutch implementation act, and the ePrivacy Directive, with EU data residency and a cookie consent flow for EU visitors. Players join with a display name and a password of their own choosing, so running a game does not require participants' email addresses or other personal data. The privacy policy sets out the lawful basis, retention periods, and data subject rights in full.

Three things separate CyberLuka from a traditional CTF platform. First, nothing is self-hosted: the challenges are pre-built and the infrastructure is provisioned and destroyed automatically, so nobody has to operate it. Second, the competition happens on a live world map with territory to conquer and a projector view, which makes it work as a spectator event rather than a scoreboard. Third, the catalogue deliberately includes beginner and awareness-level challenges, so non-technical participants can play alongside engineers instead of being locked out.

CyberLuka challenges cover three areas. Everyday security awareness: phishing, smishing, QR-code scams, credential stuffing, password reuse, MFA fatigue, fake tech support, malicious browser extensions, rogue Wi-Fi, and tailgating. AI-era threats: prompt injection, improper output handling, and data extraction from chatbots and AI assistants. Web application security: SQL injection, session hijacking, broken access control, and insecure password resets.

CyberLuka works from a single player up to a few hundred. A class or department of 10 to 20 is the most common size and fits the Squad plan; a company event, conference, or full lecture cohort of up to 320 fits Team Event; anything larger is handled by Custom Event. Smaller groups work well too — teams of two or three tend to produce the most discussion per challenge.