K2 Cybersecurity SOC Team Takes Second Place at GIS Days 2026

The SOC analyst team at K2 Cybersecurity has taken second place in the Cyber Arena at GIS Days 2026, confirming its standing among the strongest defensive teams in the competition.

K2 Cybersecurity played on the defenders' side (Blue Team) and was responsible for protecting a virtual university. The environment mimicked typical corporate IT: user and server segments, a DMZ, and a development and management perimeter.

Incidents the team investigated

The analysts worked through several attack scenarios: web attacks; sensitive data left by a contractor on production services; the creation and upload of a web shell; and lateral movement to neighboring servers.

This year, tasks involving attacks on artificial intelligence received particular attention. K2 Cybersecurity investigated a case in which an AI assistant built into an email client was manipulated in an attempt to make it reveal sensitive information.

Detection was the hard part

According to Kirill Rupasov, technical director of the SOC at K2 Cybersecurity, the attacking teams' actions were detected very poorly. The SIEM, the SOC's main tool, did not give a complete picture of what was happening.

What helped, he said, was the team's experience with WAF (Web Application Firewall) and NTA (Network Traffic Analysis) tools. They allowed a deep analysis of web application backends and precise detection of anomalies in network traffic.

Rupasov noted that the company has taken part in the Cyber Arena at GIS Days for several years, and that team coordination is what lets it consistently demonstrate high expertise under conditions as close to real ones as possible.