[riffraff]

I hope someone more knowledgeable can chime in, but AFAIU, each player acts as the manager of a certain set of services, and as an attacker against all the others.

Such services contain bugs, so what each player must do is identify the bugs, fix them or mitigate them, and at the same time exploit them to gain access to the boxes of the other players.

So basically the programs in the competition do

* vulnerability identification

* vulnerability mitigation

* identification of the best target to attack (presumably based on the first thing, not sure if other things factor in)