Got it! Thanks.

Our product is not a CTF! It inserts honeypots in our customer's infrastructure (through WAF and/or DNS configuration) to categorize attacks (manual vs. automated, targeted vs. random, persistent vs. changing) and attackers (profile creation, activity tracking despite IP rotation, skill assessment).

We then produce Threat Intel data feeds, instrument scenario seen on the honeypots and automatically replay them against our customer's assets, etc.