It can be a security tool, a project that defends against or detects a real threat, or an application that is built to be secure from the start. Judges will look at how well the team understood the threat it is addressing, how well the solution works, and how clearly the team can explain its security decisions.