The numbers of software vulnerabilities and misconfigurations keep growing year over year. Addressing them is most effective early in the process, by designing and building systems with security top of mind. This requires concerted efforts of "builders": software developers, QA, architects, and IT specialists. Unfortunately, too often the task of securing software falls to "breakers", such as pentesters and security researchers, who expose problems and push for improvements.

Widespread software weaknesses can be partially explained by the engineers' having insufficient understanding and knowledge of security issues. One of the most effective ways to improve this knowledge and skills is to "gamify" the learning process. This will add rewards, healthy competition and stimulate the acquisition of practical skills.

Unfortunately, over the years, "gamified" training has almost exclusively been available to those on the "offensive" security side. Security competitions, challenge sites, and hands-on security certifications all provide excellent opportunities for building practical attack security skills. There is a shortage of such opportunities for professionals on the "defensive" side.

In this talk, we will discuss this imbalance in greater depth and propose ways of making acquiring practical defensive security skills more effective.

We will also describe an open-source defence competition framework that we are releasing and share our experiences running defence-style competitions.