This talk compares and contrasts CTF challenges, including previous NorthSec challenges, with outcomes from real-life penetration tests and security program assessments.