As a result, I've been able to challenge students to solve interactive software security challenges on the midterm and final with automatic grading - something that would have been impossible with pen and paper.
Scalability is really the major challenge. We're rolling out more CBTF rooms and rolling out access to other departments due to demand, but it's definitely more resource-intensive than pen-and-paper. One possibility is to treat CBTFs as computer labs when not actively administering exams (or maybe even vice-versa), something we're looking into doing.