Hack The Box

Sister work package to the SpecOps enterprise-network range: the same buyer paid a second vendor for critical-infrastructure range scenarios. The notice does not state how many scenarios, so no per-environment figure. Awarded 2024-12-12, contract 2025-01-02 to 2025-06-30. AISI's own paper (arXiv 2603.11214, 11 Mar 2026) reports results on two bespoke ranges built by two firms, SpecterOps and Hack The Box: "The Last Ones", a 32-step corporate network attack (about 14 hours for a human expert), and "Cooling Tower", a 7-step industrial control system attack (about 15 hours). Neither this notice nor the paper says which contract covers which range or whether a contract covers more than one, so no per-range price is derived.

The payer's own page, UK Contracts Finder (official API record), DSIT award notice: Cyber Evaluations, WP1, Cyber Range Scenarios

Hack The Box pays a community creator, per Sherlock, to build one defensive-investigation scenario (attack artefacts and logs plus a scored question set, one scored task); the guaranteed part is the floor and the quality bonus the ceiling. The date is the one printed beside the post's title. Hack The Box is the firm UK AISI paid for range scenarios (held). One row for the whole rate card, from the lowest tier's guaranteed floor to the top tier's ceiling, so one programme's tiers do not weigh as several programmes in the median. Its tiers: very easy up to $125 ($100 guaranteed), easy up to $250 ($200), medium up to $500 ($400), hard up to $800 ($650), insane up to $1,250 ($1,000).

The payer's own page, Hack The Box blog, Sherlocks Submissions Process

Hack The Box pays a community creator, per challenge, to build one capture-the-flag challenge (a single scored task): 50% when it passes internal evaluation and the rest two weeks after release; the guaranteed part is the floor and the quality bonus the ceiling. The post is from 12 November 2021 and is still live. Content is aimed at human players, the same firm AISI paid for range scenarios (held). One row for the whole rate card, from the lowest tier's guaranteed floor to the top tier's ceiling, so one programme's tiers do not weigh as several programmes in the median. Its tiers: very easy up to $150 ($100 guaranteed), easy up to $250 ($200), medium up to $400 ($300), hard up to $500 ($400), insane up to $650 ($550).

The payer's own page, Hack The Box blog, New Challenge Submission Process

Hack The Box pays a community creator, per machine, to build a full vulnerable machine (one cyber range environment) for its platform; the guaranteed part is the floor and the quality bonus the ceiling. The post is from 18 May 2021 and is still live, so the tier may have moved. Hack The Box is the firm UK AISI paid GBP 590,500 for critical-infrastructure range scenarios (held), and these are payments to outside creators for content aimed at human players. One row for the whole rate card, from the lowest tier's guaranteed floor to the top tier's ceiling, so one programme's tiers do not weigh as several programmes in the median. Its tiers: easy up to $300 ($250 guaranteed), medium up to $600 ($500), hard up to $850 ($700), insane up to $1,100 ($900).

The payer's own page, Hack The Box blog, New Machine Submission Process