Overview

Assigning challenges to your team is an effective way to test their skills, improve problem-solving abilities, and enhance cybersecurity knowledge. In AppSecEngineer, challenges can be assigned through Tournaments and Interviews, allowing you to tailor exercises based on your team's training needs.

Note: Challenge assignments can only be managed by an enterprise admin and are not available for individual accounts.

What Are Challenges?

Challenges in AppSecEngineer consist of two types:

1. Pre-Built Challenges – These are predefined challenges available in the Challenges section.

2. Custom Challenges – These are user-created challenges using the Build Your Own Challenge feature.

Both types can be used in Tournaments and Interviews to evaluate security skills effectively.

Assigning Challenges Through Tournaments

Tournaments allow you to group multiple challenges into a structured format. Follow these steps to assign challenges using tournaments:

Step 1: Create a Tournament

• Navigate to the Tournaments section in the platform.

• Click on Create New Tournament.

  The AppSecEngineer tournaments dashboard allows users to manage security tournaments. The page displays a list of active and expired tournaments with details like start date, status, and duration. The "Create a Tournament" button is highlighted for initiating a new tournament, and the "Tournaments" menu option is emphasized for easy navigation.

• Provide a Tournament Name, description, and start/end dates.

  The AppSecEngineer platform's tournament creation form, showing required fields such as name, description, dates, duration, and teams. The "Submit" button is highlighted, but several fields are marked incomplete.

Step 2: Attach Challenges

• In the tournament setup, select the challenges you want to include:

• Choose from the available Challenges section.

  The AppSecEngineer platform's tournament creation page, displaying options to attach challenges or custom challenges. The "Attach a challenge" and "Attach Custom Challenges" buttons are highlighted with a red outline and arrow. No challenges are currently attached.

• Add Custom Challenges if you have created any.

  A pop-up modal on the AppSecEngineer platform allowing users to attach custom challenges to a tournament. The filter is set to "Java," displaying multiple Java-based challenges with different vulnerabilities. Three challenges are selected: windy-horror (Command Injection) ash-bunk (SQL Injection) polite-store (Sensitive Data Exposure Through Logs) Other challenges are listed with vulnerabilities such as Insecure Deserialization, Session Fixation, and SQL Injection. The "Attach" button is visible at the bottom.

• Ensure that both types of challenges align with your team's skill level.

  The image shows the tournament creation interface on AppSecEngineer, where three custom challenges—polite-store, ash-bunk, and windy-horror—are attached. The Submit button is highlighted, indicating the final step in setting up the tournament.

Step 3: Assign to Team Members

• Add participants from your team.

• Set difficulty levels and scoring rules.

• Finalize the tournament settings and Publish.

Once published, team members will receive notifications to participate in the tournament.

 Not sure which challenge to assign? Learn how to efficiently browse and locate the right challenge in our Find a Challenge guide.

Assigning Challenges Through Interviews

Interviews function similarly to tournaments but allow you to assign challenges to external users as well. This makes them ideal for hiring purposes, evaluations, and skill assessments.

Steps to Assign Challenges via Interviews:

1. Navigate to the Interviews Section

• Go to Admin → Interviews.

2. Create a New Interview

• Click Create Interview and provide necessary details.

• Set challenge difficulty and objectives.

  The screenshot shows the interview management interface on AppSecEngineer. The "Create an Interview" button is highlighted, allowing admins to initiate new interviews. A list of past interviews with details such as name, start date, status (expired or finalized), and duration is visible. The "Interviews" section in the left sidebar is also highlighted.

3. Attach Challenges

• Similar to tournaments, you can add predefined and custom challenges.

4. Assign the Interview

• Unlike tournaments, Interviews allow you to invite external users by entering any email address.

• Share the interview link with participants.

  The screenshot shows the "Creating an Interview" form on AppSecEngineer. The form includes fields for interview name, description, start and end dates, user emails, pass percentage, and duration. Required fields are highlighted in red, indicating missing information. The "Submit" button is highlighted, allowing admins to finalize and create the interview.

After publishing, interviewees will receive an invitation to attempt the challenges.

Want to create a custom challenge tailored to your team's needs? Check out our Build Your Own Challenge guide to design security exercises from scratch.

Conclusion

Using Tournaments and Interviews, you can efficiently assign challenges to your team, track their progress, and enhance their cybersecurity skills. Whether for internal training or recruitment, these features ensure a structured and practical approach to learning and assessment.