Looking Back at Hardening 2026 Agentic Collapse

The following article is just some of my thoughts after attending my third Hardening event in Japan. It’s based on my personal experiences, so there isn’t much structure, but I’ve just finished making this personal website and needed an excuse to post something on the blog.

What exactly is Hardening?

Very briefly, Hardening is an event that takes place every year somewhere in regional Japan, spread over 3-4 days. I’ve always thought of it as a reverse CTF. In a CTF, the goal is to break into a platform and find flags, and the highest score wins. In Hardening, you and your team (generally a varied mix of students and professionals, with differing experience in IT management and cybersecurity) are handed a smorgasbord of virtual machines representing the business operations of a small e-commerce firm.

You have to protect these from a group of dastardly hackers called Kuromame 6 (lit. Black Bean 6; I have no idea where the name comes from). The systems as received are incredibly vulnerable (probably a realistic depiction of many corporate IT systems) whilst handling normal business operations: managing stock, invoicing buyers, creating promotional materials for the virtual items.

Each team has a collection of public-facing websites (e-commerce stores). Over the course of the 8-hour Hardening day, a crawler regularly visits these sites and makes purchases, increasing your team’s score. On top of this, each team has missions to complete, plus a full analysis, work report and presentation to deliver afterwards on Softening Day. Many of the event’s sponsors also make their products and custom solutions available on a marketplace.

My personal experiences with previous Hardenings

I first took part in Hardening 2024 Convolutions, in Tomigusuku, Okinawa prefecture. I signed up, joined a brilliant team with some great industry colleagues (many of whom I’ve bumped into since) and focused mainly on technical tasks. I remember spending a hell of a lot of time adjusting firewall settings and trying (mostly in vain) to stop the prices being set to 0 on all of our product pages.

What really took me by surprise was how much character the event had, and how much fun it was. The day after being locked in the Karate-Kaikan for 8 hours, I was suddenly rowing a dragon boat down a canal in a race, then enjoying an excellent BBQ on an Okinawan beach. I attend quite a lot of events in the security industry, and most of them are much drier affairs than Hardening. Our team did quite respectably and took home a sponsorship prize from Barracuda Networks, whose WAF we used quite effectively.

My second attempt was last year at Hardening 2025 Invisible Divide, also in Tomigusuku. My 2024 team had done quite well, but the event had kicked something of a competitive drive into me and I wanted another shot. This time I put myself forward as team leader, and also directed the business side of the team (the paperwork, communications and other non-technical tasks). We put in a valiant effort and came a close second, also receiving sponsor prizes from Barracuda and Softbank.

I really appreciate my teammates that year. I had some “unorthodox” approaches to the tasks at hand, and they went along with some of them whilst shaping us into an effective and competitive team. (I’m pretty sure they initially thought I was nuts.)

Hardening 2026 Agentic Collapse

This week, I took part in Hardening 2026 Agentic Collapse, this time in Hakodate, Hokkaido. What changed is that I took part as a member of my employer’s sponsorship team. My employer, Kobe Digital Labo (KDL), offers bespoke IT solutions and cybersecurity consulting, and my colleagues and I (all previous Hardening participants) really tried to take an approach based on our past experiences.

In 2025, my team managed to automate a lot of things: password changes, password policy changes, backups and so on. We even made scripts that automatically took screenshots, which made writing the report later a lot easier. I wanted to create something that would take some of the load off other teams, because it’s very easy to get overwhelmed when you’re given an unfamiliar network environment and told to protect it for 8 hours.

Based on that experience, I decided to make an automated backup solution for our potential customers. Without going too much into how the sausage is made, I developed a product that dumps databases, collects all the key folders on the server, compresses them, and fires them over to KDL’s marketplace server (which we understood wouldn’t be attacked by Kuromame 6). Users could then pull backups back over and restore files or undo damage if their server had been attacked. It was tailored to be quick and easy to deploy in the Hardening environment.

My colleague took a similar “what did I wish I had when I was in the thick of it” approach and developed a slick server uptime monitoring tool with Discord integration. It lets teams know almost instantly when a server dies, which is handy not just during attacks but also for realising when you’ve overcooked the firewall settings.

Our products were very well received by the participating teams, and we actually sold out! Having had a couple of runs in the trenches myself, it was nice to support other teams and take part in the event from a different role.

The merits of Hardening

Something keeps me coming back to Hardening, and I’ve spent a while mulling over exactly what that is.

From a practical viewpoint, it’s a fantastic opportunity for early-career cybersecurity specialists to experience a real trial by fire. You aren’t following a runbook in calm conditions; you’re juggling firewall changes, missions, communications and paperwork, all while a team of well-equipped, experienced hackers tries to sabotage your operations. It lets people experience a fairly realistic worst-day-ever scenario, but without real consequences.

It also has a habit of feeding back into real work. Both of our products this year came straight out of problems we’d hit as competitors, because a day under that kind of pressure shows you exactly what’s missing. The sponsor marketplace works both ways, too: teams get to try real products under real pressure, and vendors get brutally honest feedback.

And somehow it’s also fun: mixed teams of students and professionals, sponsors in the room, and a great chance to explore parts of Japan I would otherwise never travel to. This year’s event was in Hakodate, which, being an out-of-the-way town, I’d likely never have visited otherwise. Goryokaku, the famous star-shaped fortress that was the site of the Battle of Hakodate, the final battle of the Boshin War, is well worth a visit.

The food in Hokkaido is to die for.

I also can’t recommend the night view from the top of Mt. Hakodate enough.

I’ve left every event with new contacts, new ideas, some newly acquired skills and a new appreciation for a different part of regional Japan.

What’s next?

Having been a competitor twice and now a sponsor running a marketplace product, I hope to join Hardening again. I might do more sponsor work, but I’m also interested in the support agent role, directly aiding and assisting the teams. Watch this space.

And if you’re reading this, are a student or professional based in Japan, you should take part too! Having little IT or cybersecurity experience isn’t a problem. You’ll be teaming up with people who do, and it’s an incredible chance to dip your toe into the industry and see what it’s really like.

Finally, a huge thank you to the Hardening organisers. Putting on an event this ambitious, this well run and this much fun year after year takes enormous effort, and I’m grateful to have been part of it both as a competitor and on a sponsor team.