How We Fared in the Cyber Grand Challenge

Summary: In DARPA's Cyber Grand Challenge qualifying event on June 3, 2015, Trail of Bits' Cyber Reasoning System was given 131 purposely built insecure programs and, over 24 hours, identified vulnerabilities in 65 and rewrote 94 to eliminate bugs. The system ranked second in verified bugs found and fourth in patch effectiveness, but a last-place performance score among the top ten teams left it ninth overall, below the seventh-place threshold for the August 2016 final.
What you should know: The CRS self-measured an overall score of 106, which would have placed it second, while the official measurement was 21.36 and ninth place - a gap driven by optimizing for memory overhead when the official tools measured 76% CPU overhead. A system that finds and patches real bugs can still lose on a measurement it cannot see.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026