These rising stars shouldn't be competing against each other to develop the best tool in the shortest amount of time. That ROI bullshit is at the heart of the problem.
If you want to challenge hackers, in the traditional sense, then continue to improve the security of your systems; they will still find ways to impress you.
If you want challenge hackers, in the more "dorm-room entrepreneurial" sense, then hire a bunch of them on 2-year contracts and let them do their own thing; they just might find a way to fill your pockets with cash.