# Dubai’s cyber defence competition should test decisions, not just tools

Dubai has opened a cybersecurity competition that is more interesting than its prize money. The second School of Cyber Defense asks university teams to work through a realistic incident, defend their choices and present them to practitioners. That format can expose something a multiple-choice exam cannot: how a team behaves when the evidence is incomplete and every response has a cost.

The [Dubai Electronic Security Center announcement](https://www.desc.gov.ae/dubai-electronic-security-center-launches-second-edition-of-school-of-cyber-defense-at-gisec-global-2026/) says registration closes on 1 September. Teams can include up to five students; case-study submissions run from 2–7 September; five finalists are due to be named on 10 September; mentoring follows from 11–17 September; and the live final is scheduled for 18 September at GISEC Global. The top three teams share AED 20,000.

Those dates make the competition timely. Its bigger value, though, will depend on what entrants are asked to produce. A polished slide deck is easy to rehearse. A defensible incident record is much harder to fake.

## Treat the case as an incident, not a puzzle

A good exercise should not have one hidden “correct” answer. Real responders receive fragments: an alert with uncertain severity, an account that may be compromised, a service owner worried about downtime and logs that do not tell the whole story. Teams should have to decide what they know, what they only suspect and what they need next.

This is consistent with established exercise practice. The UK National Cyber Security Centre’s free [Exercise in a Box](https://www.ncsc.gov.uk/information/exercise-in-a-box) uses unfolding incidents to test decisions, policies and team relationships. The US Cybersecurity and Infrastructure Security Agency’s [tabletop packages](https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages) similarly provide objectives, scenarios, discussion questions, participant feedback and an after-action report—not merely a technical challenge.

For the Dubai competition, that suggests four outputs.

**First, an evidence map.** Every important statement should be tagged as observed, inferred or unknown. “The account authenticated from a new location” is an observation. “The attacker stole the password” is an inference until the team can rule out session theft, token abuse or another route.

**Second, a decision log.** Record the choice, owner, time, evidence available and expected trade-off. Disabling an account may contain access but interrupt a public service. Isolating a host can preserve one boundary while destroying volatile evidence. The point is not to avoid trade-offs; it is to make them visible.

**Third, a control map.** Teams can use [MITRE ATT&CK](https://attack.mitre.org/) as a shared vocabulary for observed adversary behaviour, not as a bingo card. ATT&CK is built from real-world observations and separates tactics, techniques, data sources and mitigations. A strong submission would map only the behaviours supported by the scenario and state what telemetry would confirm the rest.

**Fourth, an improvement backlog.** The response should end with specific fixes: the missing log source, unclear escalation path, untested recovery step or excessive privilege that made the incident harder. Each item needs an owner and an acceptance test.

![A four-part evidence pack for cyber defence exercises: evidence map, decision log, control map and improvement backlog](https://cdn.hashnode.com/uploads/covers/60ecf4a0fc37a15ec15655e8/45e7e1ae-0254-49b7-ab3d-d28c86ffb678.png align="center")

*A reviewable cyber-exercise evidence pack, based on DESC’s 24 August 2026 competition announcement and guidance from NIST NICE, CISA CTEP, the UK NCSC, MITRE ATT&CK and Saudi NCA CSCC. Original SultanByte infographic.*

## Make the judging useful to employers

Cybersecurity hiring often collapses broad capability into a list of tools. The [NIST NICE Framework](https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center) offers a better bridge. It describes cybersecurity work through a common language of work roles, knowledge and skills, and explicitly supports hands-on learning, competitions, work-based learning and candidate assessment.

Judges could score five observable behaviours instead of rewarding the most dramatic technical story:

1. **Evidence discipline:** Does the team separate facts from assumptions?
2. **Risk reasoning:** Can it explain the operational cost of containment choices?
3. **Role clarity:** Does someone own each action and escalation?
4. **Communication:** Can technical findings become a short decision for a service owner or executive?
5. **Learning quality:** Does the after-action backlog include testable improvements?

That rubric gives students material they can show later without exposing the competition scenario. A redacted evidence map, one decision-log entry, a short executive briefing and an after-action item reveal far more than “participated in a cyber competition” on a CV.

## Do not confuse competition success with production readiness

A competition is a safe and compressed environment. Production response has legal duties, customer impact, evidence-handling rules, tired people and systems that refuse to cooperate. Winners should not be presented as fully formed incident commanders.

There is also a local control context. Saudi Arabia’s National Cybersecurity Authority publishes [regulatory cybersecurity documents](https://nca.gov.sa/en/regulatory-documents/), and its [Critical Systems Cybersecurity Controls](https://cdn.nca.gov.sa/api/files/public/upload/f15af01c-dc59-4281-95e2-03a770655937_Critical-Systems-Cybersecurity-Controls.pdf) require, within their stated scope, measures such as pre-release security source-code review, protection of source-code access and releases, authenticated API security and controlled movement from test to production. Those are useful reminders for any regional exercise designer: the scenario should connect incident response to the software and change processes that created—or could remove—the exposure.

Universities can help by running a second session after the final. Ask teams to revisit their submission with no time pressure, identify where they jumped to a conclusion and rewrite one weak decision. Employers should look at that correction process, not only the leaderboard. The ability to update a view when evidence changes is a core defensive skill.

## The artifact is the real prize

The School of Cyber Defense arrives at a moment when students can generate plausible scripts, reports and diagrams very quickly. That makes process evidence more valuable, not less. Judges should ask why a claim was accepted, what would falsify it, who approved a risky action and how the team would know a fix worked.

If the competition produces those answers, Dubai will have more than five finalist teams and three winners. It will have a repeatable way to turn a simulated incident into credible evidence of judgement—and a much stronger signal for universities and employers trying to recognise people who can defend real systems.