I only started getting into SWE back in early 2021: it was the first time I was actually doing coding and it was because of university! Perhaps (very) unwisely, I took a shot in the dark while choosing my career and opted for Informatics Engineering (which, at least at my university, combined elements of traditional SWE careers and also focused on the business side of things; personally I found it very fun!), even though I had never done real coding before: at most, I’d modify some mods here and there for certain games and believed I was the king of the world for getting two conflicting IDs fixed; those were the days! My career choice mainly boiled down to having a distinct hatred for Physics (I sucked at it) and for Chemistry (I sucked even more at it), which discarded a ton of options for me; I have always liked reading a lot, so I thought studying Law would’ve been a good move, but something deep in my head always made a point to echo my love for technology. I think it’s fair to say a lot of us grew up either with video games or with programming (and I admit I really envy those who had access to both!), and I was incredibly fortunate to grow up with a SNES from my cousin (love you, Eduardo!) and it definitely shaped me: not in the usual “MORTAL KOMBAT IS THE DEVIL’S GAME AND IT MAKES CHILDREN TOO VIOLENT!!” (and, to be fair I became quite good at MKI, and it really felt like the Devil’s game because boy was I hooked), but I realized just how much somebody’s creativity combined with technology could influence somebody’s life so much, it’s insane to think about really.
The Love that couldn’t be
Throughout the years, I’d always have some (distant) interest in cybersecurity. I felt it was an incredible field within the tech world and how it allowed for so much chaos and mayhem (not that I planned on causing any, mind you), but I had this mental burden of thinking the resources I had were not enough to get started in it (and being 100% honest, they really weren’t lol). It was only back in late 2023 that I had the chance to get started in the field as part of a new specialization program my uni had, and I remember feeling this incredible sense of happiness, for being able to FINALLY find a field within SWE that I liked, and immense sadness, for not taking a proper interest in it earlier.
Fast forward to 2024 and what was going to be an extremely promising year for me in cybersecurity came to a halt: lots of unfortunate events in my life happened and I had to focus between passing my uni courses and paying for my degree, which led me to enroll in up to 8 courses + a part-time job at some point due to the urgent need I had to finish my studies at that point. I did have the chance to take Ethical Hacking and Informatics Forensics courses at the Telecommunications Master’s unit at my uni, which I’ll always be extremely proud of since I did amazing, but I could not dedicate any time to honing my skills even further on the side. I really wanted to participate in CTFs, do lots of labs, get some nice certs to find a nice internship in pentesting or ethical hacking, but it all came crashing down.
Rude Awakening
At last 2025 came around and things took a turn for the (much needed) better: things got stable in my life and I got to work on my thesis with pretty much all the time I needed (who would’ve thought taking 8 courses would turn out so well?), and I slowly but surely started doing the things I wanted to for more than a year. It all looked good until I reached the point of wanting to play in CTFs. By now, LLMs were going into full force: vibecoding (unfortunately) became a thing, agents began to rise and everybody had a Claude or GPT subscription. I, naively, thought this was only on the development side of things and that cybersecurity wasn’t as affected by it, so to participate in CTFs and see how they essentially became a Pay-2-Win competition was a heartbreak that I was not ready to feel at all.
For years I’d read about how during a high-level CTF a team would show off some incredible exploit they had discovered through sheer creativity and technical knowledge, how they were a bloodbath but also an incredible place to meet people and also elevate each other’s level, but now? “just give ur binary to codex lol”. And I know, I know, “hate the game, not the player” and I do agree with that phrase: CTFs declining is because of the inhuman efforts of big companies who are risking too much in this technology to shove it in every single place they see, cybersecurity being a prevalent one, and competitions like this unfortunately took the biggest hits.
And yes, I also know somebody can rightfully say “well, just don’t participate in them!” and sure! I could save myself a lot of trouble, but here’s the thing: I like to learn and I like to have fun while I do it; I often find myself really liking competitions as a way to push myself to explore a domain I am not familiar with and become good at it, but if all the competition is nothing more than an API running over and over, what fun is there in that? What fun and benefit to mutual knowledge is there in asking somebody how they solved certain challenge only for them to say “oh I just gave it to Claude lol”? In the last CTF I took part in, after the challenge I came across the following message (DISCLAIMER: this is no personal agenda against the person who posted the message, but it’s a great example of what I mean):
Felicitaciones a todos! Sobre todo a los que lograron resolver los 22!Si a alguien le sirve, esta es la herramienta agentica que hice en emacs para auditoria/bugbounty/ctf[REDACTED]El código y los prompts son open source, y logró 20/22 de los challenges.Gracias a los organizadores por el CTF!Translated to English and summarized, pretty much somebody had used an LLM to solve the challenges and got a 20/22. Of course I could go ham and use this as fuel to become even better and say “haha I beat the machines!”, but, again, where is the fun in trying to go against a machine? What fun is there competing with somebody that just copy-pastes files and the returned flag? And I know somebody may say “BUT HEY, LOOK AT HOW GOOD LLMS ARE THAT THEY CAN SOLVE THESE PUZZLES!!!!” but that’s not the point; my point is that LLMs are taking experiences like this AWAY from people. Say you are somebody totally new to cybersecurity and you want to get started with CTFs now; you genuinely want to learn new things and want to see how other people solve certain puzzles, but here’s the thing: every single writeup you see involves people saying “Oh just connect this MCP to this and boom answer” or something similar; isn’t that just discouraging in every way? Yes, you can use LLMs to teach you certain concepts (now, let’s also take into account the way it got ahold of those concepts LIKELY wasn’t done through ethical means!) but again, cybersecurity is incredible because how much human experiences MATTER when dealing with new concepts. Ask anybody, no matter the field, about how the opinions/experiences of somebody with proven years of experience is one of the best sources of knowledge you can get, so why are we straying away from that? It just makes no sense!
So, what now?
There is a surge in addressing this issue like in the creation of the Save CTFs Fund by OtterSec or this wonderful blog from Axelle Apvrille. For better or for worse (and I’m more inclined for the latter) LLMS are here to stay, but we really shouldn’t let it replace the wonders of human curiosity and, most importantly, human connection, sharing the knowledge with our peers, promoting creativity and innovation rather than glorified plagiarism.
I was unfortunately too late to miss the golden age of CTFs and software development in general (what I wouldn’t give to experience events like the birth of GitHub or the first conventions of Rust), and I really wouldn’t like future generations missing out on wonderful showings of human wonder like those.
It should also go without saying, but if you’re reading this and feel in a similar spot, please, I urge you as a colleague and as a friend: never let your curiosity die. No matter how many times we may be told “we’re missing out if we don’t adapt!”, no matter how many times you’ll hear “software engineering is solved”, no matter if we “reach the singularity!”, human curiosity and that sense of intense wonder to obtain knowledge and experience in an area we’re interested in will always be one of the most beautiful feelings one can experience and it’s something I encourage everybody experiencing. The fun is always in the challenge!