Saif Alzaabi secured first place in the ADNOC AI Hackathon for government cybersecurity professionals, as a four-hour contest testing the defence of simulated energy infrastructure concluded at ADIPEC 2026 in Abu Dhabi.Theyab Alzaabi finished second and Rowdah Alhosani took third in the competition held on 4 November at ADNEC Centre Abu Dhabi. The three winners were honoured the following day at an awards ceremony organised as part of the ADNOC CyberAware programme.
The final brought together 22 participants from UAE government entities after an online qualifying stage attracted more than 400 registrations. Twenty-three competitors had qualified for the final, although one did not participate in the on-site contest.
ADNOC hosted the competition in partnership with the UAE Cyber Security Council, while Exploit3rs Cybersecurity Academy developed and operated its technical challenges. The initiative concentrated on practical skills needed to identify vulnerabilities, investigate attacks and protect energy-sector networks against increasingly sophisticated threats.
The three highest-ranked contestants each solved nine of the ten interconnected challenges. Nobody completed the entire set, underscoring the difficulty of the simulated security problems presented to participants during the individual competition.
A central feature was HELIOS, a virtual energy infrastructure environment created by Exploit3rs specifically for the final. It reproduced elements of an energy grid control centre, including an externally accessible operations portal and a separate industrial network using technologies associated with energy operations.
Each competitor received an independently deployed version of the network, isolated from other contestants and from functioning industrial facilities. The arrangement allowed participants to test and exploit deliberately introduced weaknesses without risking disruption to actual energy infrastructure.
The technical tasks required knowledge of web application security, cryptography, network forensics, reverse engineering, privilege escalation and industrial control system protection. Competitors had to work through connected problems rather than answer questions about cybersecurity principles alone.
Juma Alshamsi, founder and chief executive of Exploit3rs Cybersecurity Academy, said the exercise was designed to give government cybersecurity specialists experience of attacking systems similar to those they are responsible for defending. He said identifying weaknesses in the controlled environment could help participants recognise and address comparable vulnerabilities in their professional work.
The competition formed part of CyberAware activities at ADIPEC, which ran from 2 to 5 November. The programme also included discussions and exercises examining artificial intelligence-enabled cyber threats, crisis response and the protection of critical operations.
The UAE Cyber Security Council said its awards ceremony with ADNOC recognised leading participants from both the government and university cybersecurity hackathons. The two competitions were distinct, with the Exploit3rs final reserved for professionals representing government entities.
Exploit3rs used its Hacking Dungeon training platform to manage registrations, qualification exercises, the deployment of virtual environments and scoring. The online preliminary round took place from 12 to 15 October and comprised eight practical challenges designed to evaluate entrants' technical capabilities.
Qualifiers advanced on the basis of their performance in that stage. The final was conducted individually rather than in teams, with participants using their own laptops to attempt the simulated attacks within a fixed four-hour window.
The academy's published competition rules prohibited sharing solutions and using generative artificial intelligence to solve challenges. Those restrictions applied even though the broader programme examined the implications of AI for cyber attacks and defence.
During the final, the Hacking Dungeon platform provisioned a separate virtual energy network for each competitor. A live scoreboard at the venue displayed progress and rankings as the technical exercises unfolded.
The organisers said all challenge environments were built and tested for training purposes and operated independently of real operational systems. This separation was intended to preserve the realism of the exercises while avoiding exposure of production networks to deliberate exploitation.
The event format required contestants to approach the simulated infrastructure from an external entry point and progress through multiple layers of security. Its combination of web-facing services and isolated industrial components was intended to reflect the different kinds of systems defenders may encounter in energy operations. The scoring structure rewarded successful technical work under time pressure, while the isolated deployments meant that one participant’s actions could not interfere with another participant’s environment. The academy administered the exercise throughout the competition.
The competition's final was scheduled from 9.30am to 1.30pm on 4 November, with the awards ceremony scheduled for 5 November. Its rules provided for certificates for finalists and recognition for the leading performers.
Topics
Spotlight