That's true but only because it mimics real life. The defenders are always at a disadvantage here, they have the boring job but one where one mistake is one too many. And they have to achieve that perfect score while operating within the rules.

On the other side the attackers have the more exciting job and only need one success which they can achieve by using whatever means they see fit.

You'll see this outside of IT just as well, like in sports. Goalkeepers (defenders) vs. strikers come to mind but at least there they all operate within the same set of rules.

I kind of like the dual approach. First team to get in to the box has to try and hold onto it while still maintaining specified services it's supposed to be providing in the simulation. Winner is whoever holds it the longest.

It's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.

That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".

Actually, this could be made like "CS:GO" competition:

- RT is the terro - BT is the AT

The RT has to "plant" an exploit. The BT can either block/track the RT or "diffuse" (find/disable) the exploit.

The "maps" would be the kind of system:

- an AD behind a firewall - a WebServer with datas to extract from a backend DB - and so...

The sponsors could sell either the skills of their pen-testers to hire, or their solution to secure a system, so it might be a good maketing campaing for the winner...