The DARPA Cyber Grand Challenge final was held on August 4, 2016, in Las Vegas. DARPA, the U.S. Defense Advanced Research Projects Agency, designed it as the world’s first all-machine cyber hacking tournament: a competition in which fully autonomous systems, with no human intervention during play, defended themselves and attacked opponents in a live capture-the-flag contest.
Each competitor fielded a Cyber Reasoning System, software meant to do automatically what skilled human security researchers do slowly by hand. During the event these systems had to scan unfamiliar programs, discover previously unknown vulnerabilities, generate working exploits against opponents, and write and deploy defensive patches to protect their own services, all within seconds rather than the weeks or months a human team typically needs. The contest narrowed from more than 100 teams down to seven finalists, and DARPA awarded prizes of 2 million, 1 million, and 750,000 US dollars to the top three.
The point of the challenge was to demonstrate that the cycle of finding and fixing software flaws could be automated, a response to the reality that human experts are scarce and that vulnerabilities are discovered faster than they can be patched. DARPA described the event as proving that it is possible to automate cybersecurity.
For a business reader, the Cyber Grand Challenge is a landmark in applying AI to defense: it showed, in a public arena, that machines could carry out the full loop of vulnerability discovery and remediation, foreshadowing the AI-assisted security tools that followed.