EC-Council HackAI Challenge @ RACEx360 Securing the AI-Powered Enterprise
Can you
hack AI?
Red Team. Defend. Secure.
An offensive-security competition built on the attack surface that enterprises are only starting to defend. Online qualifier 10–18 September. One 90-minute attempt. Top scorers take the stage at the Grand Finale.
Closes 10 Sep 2026 · 100 slots targeted
EC-Council HackAI Challenge @ RACEx360 Securing the AI-Powered Enterprise
Can you
hack AI?
Red Team. Defend. Secure.
An offensive-security competition built on the attack surface that enterprises are only starting to defend. Online qualifier 10–18 September. One 90-minute attempt. Top scorers take the stage at the Grand Finale.
Closes 10 Sep 2026 · 100 slots targeted
One 90-minute attempt per participant
Cash + CEH vouchers for the podium
RACEx360, Taj West End, Bengaluru
Judging panel + certification pipeline
Why compete
Proof, not
a certificate.
AI is expanding the enterprise attack surface faster than most teams can map it. This is a stage for the people who can actually test, break and defend it.
- 01
Enterprise-relevant scenarios
Not toy CTF puzzles. Challenges are modelled on the AI systems companies are shipping right now — RAG stacks, agentic workflows, NL2SQL layers, training pipelines.
- 02
A scoreboard that means something
Individual entry, individual timer, individual score. Your rank is your work, measured against a deliberately selective field.
- 03
The RACEx360 stage
Qualify and you compete live at the Grand Finale in front of security leaders, CISOs and the industry audience RACEx360 convenes.
- 04
Direct line to EC-Council
As title sponsor, EC-Council has direct access to top performers for recruitment conversations and the certification pipeline. Podium finishers receive CEH vouchers.
Challenge arena
Ten ways to break
an AI system.
Qualifier vectors are open to every registered participant. Finale vectors are reserved for those who make it through.
Qualifier
Qualifier
Qualifier
Qualifier
Qualifier
Qualifier
Qualifier
Qualifier
Qualifier
Finale
Finale
Finale
Finale
Finale
// The challenge mix may vary by round. The competition is fully browser-based — no local setup required.
How it runs
Two rounds.
One clock each.
Register as an individual. The qualifier site opens on 10 September
and stays open for nine days. Your 90 minutes start the moment you
begin, so pick your window.
Qualifier
One attempt per participant, taken remotely at a time of your
choosing inside the nine-day window. The timer starts when you
open the challenge and does not pause. Top performers advance.
Grand Finale
Finalists compete live in Bengaluru on advanced vectors,
including model internals, supply chain and agentic privilege
escalation, judged by an EC-Council panel, with winners
recognised on stage.
Prize pool · ₹1,75,000
What the podium pays.
// All prizes are awarded in EC-Council's name as title sponsor. Finalists are named on the public leaderboard.
Who should register
Built for hands-on people.
Penetration testers AppSec engineers Bug bounty hunters Security researchers AI / ML security practitioners SOC & security engineers CTF players Exceptional students
No formal eligibility bar and no team requirement — this is an individual entry. But the challenges assume you have broken something real before. If you are starting out in security, the qualifier will be steep.
Key dates
From here to the stage.
Powered by
Final call
Register before
10 September.
100 slots. Nine days of qualifier. Ninety minutes to prove it.
FAQ
Before you register.
Is this an individual or team competition?
Individual. You register, compete and are scored on your own — there are no teams in either round.
What does entry cost?
₹2,000 per participant. Registration closes end of day on 10 September 2026, and is confirmed only when payment is complete.
When exactly is the qualifier?
The challenge site is open from 10 to 18 September 2026. You choose when to start inside that nine-day window.
How long do I get?
One attempt of 90 minutes, timed from the moment you begin the challenge. The clock does not pause and there are no second attempts.
Is the qualifier online?
Yes. Both rounds are browser-based, and the qualifier is fully remote. Only the Grand Finale is in person.
Where is the finale?
RACEx360 at the Taj West End, Bengaluru, on 25 September 2026. The finale round runs for two hours with a maximum score of 200.
How is it scored, and who runs the platform?
EC-Council operates the challenge platform, participant onboarding, the individual 90-minute timers, scoring, the leaderboard and technical support. The qualifier is scored out of 100; scores are validated on 19–20 September before finalists are announced.
Do I need to set anything up locally?
No. The competition is entirely browser-based. You will receive access credentials and instructions when the qualifier window opens on 10 September.