We interviewed Michał Błaszczak, lead of PrimeRanks, the team that won the Global Cyber Skills Benchmark CTF 2026—the world’s biggest CTF for business teams—to hear about their preparation, teamwork, use of AI, and experience competing in Project Nightfall.
I didn't arrive at Project Nightfall as a weekend CTF player.
The story goes back to around 2009. That is when I started reading my first books and browsing cybersecurity forums, and when I learned my first programming language, C++. In the second half of 2012, I installed BackTrack 5 R3 on a laptop, my first "hacker" operating system and the predecessor of today's Kali Linux. I still use Kali for offensive work, alongside Whonix, Debian, and Ubuntu. By around 2021, I had experience across many areas, including programming, reverse engineering, cryptography, web applications, and forensics. What I did not have was CTF experience.
That changed in 2021, when I joined a CTF team. That is when I started playing. A little over a year later, I moved to Hack The Box.
Live events were never really my format. Friends were doing CTFs and talking about how good they were. I wanted the same pressure without it being the whole experience, and I wanted something with a higher floor. Back then, Hack The Box had a reputation; even the easy machines assumed you already knew something, and you had to hack an invite just to register. You could say HTB chose me. It still took three attempts before I actually stayed.
Once I did, the platform became two years of my life. I played with other people along the way, rather than treating it as a solo grind. I have to be honest about how I finished the platform. I wouldn't have done it at that pace without people willing to sit and explain things, and without teamwork on the harder content. I do not consider myself an expert in every domain. Nobody is. The trick was always having a roster that covered the gaps.
The goal was not to "finish the entire platform" on day one. I started HTB to try CTFs. The first real target, as it is for most players, was Omniscient, and I completed the active content. After that, I needed a new stimulus. Completing everything was huge, especially because nobody had done it before. I still cannot fully explain why I went through with it. Maybe I wanted to prove something to myself. Maybe it was just an addiction to gaining experience, the same way games work. The end was irritating. You would have one task left, and then Hack The Box would publish new content. At one point, it felt Sisyphean. What I actually took from it was not another list of techniques. It was learning how to look for a solution, learning humility, and learning to approach unusual problems from a wider angle.
After two years, I had completed everything the platform offered at the time. Since then, I have gone through the entire HTB Academy and every machine that followed.
Every box on HTB became its own small CTF. That is where a team learns who can help with what. Working through known material at your own pace teaches you a lot. It doesn't tell you which instincts will hold up when the challenge is new and the points are moving.
I also run the Official HTB Meetup in Warsaw together with Not The Hidden Skillz, where we offer free hands-on CS sessions. Participants collaborate on real HTB content rather than listening to lectures. I have hosted four events this year, attracting 100 people in each one, covering offensive security, DFIR, mini ProLabs, and interactive discussions. The initiative aims to give the community an open space to learn, practice, and solve complex problems together.
Project Nightfall sat firmly at the demanding end of the CTFs I've played, and finishing first with my team is something I'll be proud of for a long time.
The challenges held up their end. The quality was consistently high, and the difficulty curve was honest. Nothing felt like a guessing game, and every solve came from actually understanding the system in front of us. Several tasks sat closer to real research than typical CTF puzzles, and a few of them introduced me to techniques I've already used outside the competition.
My role on PrimeRanks was not confined to a specialist lane. I handled organization and communication, keeping things moving and making sure people knew what was open and what had been marked. Preparation was not a week of slides before 15 May. It was years of Hack The Box, hundreds of machines and challenges, sleepless nights, and the habit of playing to win. We came in with a setup that was already ours. We established a large lead from the start and finished with a result that still feels like it belongs to the people I get to work with, not to a single weekend.
The people. Many of them work in cybersecurity every day and are deep in their own domains. Everyone has limitations. That's exactly why we built the roster the way we did: to avoid weak spots.
You don't assemble this at kickoff. It comes from people who already know each other and know who can help with what. Every machine and every challenge on Hack The Box is a mini-CTF for us, and that is where we gel. Nightfall was the exam, not the first rehearsal.
During the event, everyone took what fit. If someone stalled, they marked the task, and whoever was free picked it up. Time mattered, so we also tried to start where a first blood was still available. Communication sat with me as leader, but the rule belonged to the team; it was not a speech. The tooling and setup were ready because we had already been playing together. We did not invent a method for GCSB. We showed up with one.
The pressure was at the start, not the finish. We built a large lead early, and many players could stay focused on work that suited them. We did not have to abandon a challenge, pull people across lanes, or trade first bloods to survive the clock.
When someone got stuck, we did not hold a crisis huddle. We used a standing team rule we already trust from other CTFs: mark it, and let whoever is free take it. I was there to keep that visible. I was not there to override it.
One FullPwn challenge needed more time. It did not feel like a different sport. It felt like a Hack The Box season box. You have to sit with it and connect dots that are not obvious. Sometimes something just takes more time. That is not failure. That is the work.
The Hybrid Mode rules felt right. AI as a co-pilot for analysis, with the reasoning still on me. That reflects how I actually work, and it's a good direction for a benchmark intended to measure people rather than tooling.
In practice, we used it to analyze code, modify exploits, run tests, and research faster. It handled the boring and mechanical parts of the work. It did not get the last word. If we could not stand behind a path ourselves, we did not take it. The decision stayed human.
I do not have a dramatic story about a model that confidently sent us into a wall. We did not need one. AI is a friend if you already know how to work, and it is a liability if you let it replace the part where you understand the system in front of you.
It confirmed something I already believed: a high-performing team is not a method you can install. You cannot decide, in the week of the event, that you will "have" one. It is made up of people who know each other, know who to call, and have already been through enough shared problems that the handoff is boring.
That lesson is not unique to CTFs. It is the same muscle used in a pentest, an IR engagement, a red-team operation, threat analysis, or research. You cover gaps on purpose. You do not pretend one person is strong everywhere.
What has changed in real-world security work is AI. In pentests, IR, red teaming, threat analysis, and research, working with it is now part of everyday life. We not only use AI directly; many of the solutions we rely on are built on it. Nightfall did not introduce that. It reflected it. The lesson is not simply to "learn to prompt during a CTF." It is to keep the human call and build a team that is already a team before the incident, or the first challenge, starts.
What I got out of it personally, beyond the result, was a clear read on where I actually stand. Competing against a global field on content nobody has seen before is a very different signal from working through known material at your own pace. You quickly find out which instincts hold up under time pressure and which ones you've been leaning on without ever testing. I came away with a short, specific list of things to work on, which is more than most competitions give you.
What surprised me was the week's shape. GCSB is a five-day event. For us, most of the board was gone on day one, and we finished everything very quickly. That is not a story about the challenges being easy. It is a story about showing up ready to play. The content was demanding. We were ready.
My advice for next year is not to build the team right before the CTF. Play together first. Learn how each other works and understand each other's range. Prepare the setup. And treat AI as a friend. Learn how to use it as a co-pilot, not as something you switch on at random and hope will win.
If you had to describe what made your team successful in one sentence, what would it be?
We didn't assemble for Nightfall. We showed up as a team that had already been playing to win.