Game Mechanics
How do I register for the contest?
Registration typically opens on the Monday before DEF CON. Once registration opens, use the ‘register’ menu item to access the registration form. Once you complete the registration form, you will recieve an automated reply confirming your registration. Design artifacts will be sent out Friday around 10AM PDT.
What is the submission deadline?
Results/findings must be submitted by Saturday at 6PM PDT to be considered as part of the contest. Late submissions may be considered at the discretion of the judges.
How do I submit results?
The submission details will be emailed to registered participants and posted on our website.
How do I format my findings?
We request that all submissions be in the JSON format exported from the Threat Runway! This allows us to partially automate the submission intake process, maximizing the number of submissions we’re able to handle.
If you create any supporting files in order to produce your list of findings, we encourage you to submit those as well. Any such supporting files may be considered in the judging at the discretion of the judges.
You are welcome to submit non-JSON formatted results, but they might not be judged. We only commit to judging results in the defined format. If we are able, we may judge other submissions in other formats. This will depend greatly on the number of submissions received and number of threats within those submissions requiring review.
Is there a JSON schema?
Yes, click here to expand the JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://threatmodel.us/schemas/threat-model-submission.schema.json",
"title": "DCNTTM Threat Modeling Contest Submission",
"description": "Validates a threat-model-*.json file exported by or hand-edited for the DCNTTM submission form (index.html). Field names reflect the current app build: findings use threatSummary/threatScenario/impactedComponents (older exports used title/description/affectedComponents and will NOT validate against this schema).",
"type": "object",
"additionalProperties": false,
"required": ["metadata", "contestant", "customFields", "findings", "reportFindings"],
"properties": {
"metadata": {
"type": "object",
"additionalProperties": false,
"required": ["version", "createdAt", "lastModifiedAt", "exportedAt"],
"properties": {
"version": { "type": "string" },
"createdAt": { "$ref": "#/$defs/isoDateTime" },
"lastModifiedAt": { "$ref": "#/$defs/isoDateTime" },
"exportedAt": {
"anyOf": [
{ "type": "null" },
{ "$ref": "#/$defs/isoDateTime" }
]
}
}
},
"contestant": {
"type": "object",
"additionalProperties": false,
"required": ["handleName"],
"properties": {
"handleName": { "type": "string" },
"email": { "type": "string" }
}
},
"customFields": {
"type": "array",
"items": { "$ref": "#/$defs/customFieldDefinition" }
},
"findings": {
"type": "array",
"items": { "$ref": "#/$defs/finding" }
},
"reportFindings": {
"type": "array",
"maxItems": 25,
"items": { "$ref": "#/$defs/finding" }
}
},
"$defs": {
"isoDateTime": {
"type": "string",
"description": "UTC timestamp exactly as produced by JavaScript's Date.prototype.toISOString(), e.g. 2026-08-06T19:45:03.000Z.",
"pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"
},
"customFieldDefinition": {
"type": "object",
"additionalProperties": false,
"required": ["id", "name", "description", "dataType", "inputType", "values"],
"properties": {
"id": { "type": "integer" },
"name": { "type": "string", "minLength": 1 },
"description": { "type": "string" },
"dataType": {
"type": "string",
"enum": ["text", "number", "select", "multiselect", "checkbox"]
},
"inputType": { "type": "string" },
"values": {
"type": "array",
"items": { "type": "string" },
"description": "Only meaningful for dataType select/multiselect; otherwise should be an empty array."
}
},
"allOf": [
{
"if": { "properties": { "dataType": { "const": "text" } } },
"then": { "properties": { "inputType": { "enum": ["text-field", "textarea"] } } }
},
{
"if": { "properties": { "dataType": { "const": "number" } } },
"then": { "properties": { "inputType": { "enum": ["text-field"] } } }
},
{
"if": { "properties": { "dataType": { "const": "select" } } },
"then": {
"properties": {
"inputType": { "enum": ["dropdown", "radio"] },
"values": { "type": "array", "minItems": 1 }
}
}
},
{
"if": { "properties": { "dataType": { "const": "multiselect" } } },
"then": {
"properties": {
"inputType": { "enum": ["dropdown", "checkboxes"] },
"values": { "type": "array", "minItems": 1 }
}
}
},
{
"if": { "properties": { "dataType": { "const": "checkbox" } } },
"then": { "properties": { "inputType": { "enum": ["checkbox"] } } }
}
]
},
"componentEntry": {
"type": "object",
"required": ["name"],
"properties": {
"name": {
"type": "string",
"enum": [
"NGINX Authentication Cluster",
"REST API",
"SOAP API",
"MCP API",
"MCP Server Runtime",
"MCP credentials.db",
"MCP Skill",
"MCP Tool",
"MCP Tool & Skill Marketplace",
"Forderly Back-End",
"MyRobot Integration",
"Forderly Database",
"Forderly Database Manager",
"Forderly SaaS LLM",
"Drone LLM",
"Forderly Mobile App LLM",
"Robot LLM",
"Lying Leaking and Manipulating LLM",
"GIS Database Manager",
"Forderly GIS Database",
"Drone Fleet Coordinator",
"Forderly Drone App",
"Robot (XYZ Modular / BYOR)",
"Robot Debug Port",
"Kiosk",
"Printer",
"Staging Station",
"Mobile Phone",
"Restaurant",
"Forderly Admin Console",
"Forderly Customer Console",
"MyRobot API",
"Jenkins CI/CD Pipeline",
"Other"
]
},
"customValue": {
"type": "string",
"description": "Only present when name is \"Other\"."
}
},
"if": { "properties": { "name": { "const": "Other" } } },
"then": { "required": ["name", "customValue"] },
"else": { "properties": { "customValue": false } },
"additionalProperties": false
},
"customFieldValue": {
"type": "object",
"additionalProperties": false,
"required": ["fieldId", "value"],
"properties": {
"fieldId": {
"type": "integer",
"description": "Must match the id of an entry in the top-level customFields array."
},
"value": {
"anyOf": [
{ "type": "string" },
{ "type": "boolean" },
{ "type": "array", "items": { "type": "string" } }
]
}
}
},
"finding": {
"type": "object",
"additionalProperties": false,
"required": [
"id",
"threatSummary",
"threatScenario",
"impactStatement",
"mitigation",
"documentReferences",
"severity",
"impactedComponents",
"customFields",
"inReport",
"createdAt",
"lastModifiedAt"
],
"properties": {
"id": { "type": "integer" },
"threatSummary": { "type": "string", "minLength": 1 },
"threatScenario": { "type": "string", "minLength": 1 },
"impactStatement": { "type": "string" },
"mitigation": { "type": "string" },
"documentReferences": { "type": "string" },
"severity": {
"type": "string",
"enum": ["", "Critical", "High", "Medium", "Low", "Informational"]
},
"impactedComponents": {
"type": "array",
"items": { "$ref": "#/$defs/componentEntry" }
},
"customFields": {
"type": "array",
"items": { "$ref": "#/$defs/customFieldValue" }
},
"inReport": { "type": "boolean" },
"createdAt": { "$ref": "#/$defs/isoDateTime" },
"lastModifiedAt": { "$ref": "#/$defs/isoDateTime" }
}
}
}
}
What are these Custom Fields exactly?
We don’t know - you tell us ;) The contest includes 2 parts - identifying threats and documenting them. Custom Fields will allow you to document the threat however you want, using whatever terminology you would like to use. If you use Custom Fields we ask you use the description field to provide the judges some context about your custom fields to help them interpret your findings as you intended.
Yes, we could give you some explicit examples but then everyone will include those and this would defeat some of the goals for this event.
How will submissions be judged?
Submissions will be judged on overall quality, using the following criteria:
Things that we really care about (but not limited to):
- Good documentation of threats.
- The total count of plausible threats.
- Results that are more actionable for a development team.
- Identification of discrepancies between diagrams and their associated flow descriptions.
Things to avoid:
- Duplicate findings in everything but location. For example, if you discover a vulnerability that applies to multiple locations in the system, cite all the locations as a single finding; repeating a finding over and over will make the judges’ job more difficult.
- Duplicating the same finding multiple times throughout the document, possibly with slightly different words.
- Findings that require a particular tool to be able to read (e.g a 100,000 line file that can only be read by a particular application that the judges might not have); these are unlikely to be evaluated by the judges and may invalidate your submission.
The goal of this event is to test your threat modeling skills - for you to identify threats in the provided design and document them using the recommended format. While there are tools to model applications and identify threats, using these is against the spirit of the event. We want to see how you have internalized the design and what threats you are able to identify. Judges discretion on how to handle these submissions.
Wow you are being really vague about judging.
That is by design (pun intended!). Threat modeling enables engineering team members - software engineers, quality assurance, managers, and customer support - to make informed decisions about their system’s security and privacy. The better your submissions would do this, the more likely you will be to win.
We want to see different threat modelers’ approaches, what assumptions they make, and how they structure their results for development teams.
What if I only find one or two things?
Submit them! Your findings may be better documented or more interesting than someone who finds a litany of issues. Besides, you have no chance to win if you don’t submit findings!
Can I use a threat modeling tool?
We request that you don’t. The goal of this event is for you to identify and document threats in the provided design. While tools exist to model applications and identify threats, using these is against the spirit of the event. Judges discretion how to handle these submissions.
Can I use an AI to identify issues?
Treat an LLM like a tool in your belt to handle heavy lifting, but keep human agency at the wheel. DEF CON is about the joy of discovery, creativity, curiosity, and a healthy dose of mischief, not a corporate AI on autopilot.
How many contestants are allowed to register/submit results?
We are not putting any restrictions on the number of registrations or submissions.
Our ability to process all submissions will depend greatly on the number of results we receive, number of threats in those results, how closely to the contest deadline results are submitted, etc. If we receive a small number of results this is not likely to be an issue, but if we receive a large number of results we may need to be more judicious when reviewing all valid submissions before results are due to DEF CON Contest & Events (e.g. only reviewing well-documented and easy-to-understand submissions following the recommended format).