Cyber Guard 2026: Inside the Live Fire Exercise That Tested Singapore's Critical Infrastructure Defenders

CyberproAI delivered Cyber Guard 2026 in Singapore, a ten-day live fire cyber exercise commissioned by the Cyber Security Agency of Singapore (CSA). The programme brought together Critical Information Infrastructure Operator (CIIO) teams and cybersecurity professionals from across Singapore's critical infrastructure sectors for one of the most realistic tests of their incident response capabilities to date.

The objective was straightforward: put Singapore's critical infrastructure defenders inside a live, evolving intrusion modelled on real advanced persistent threat tradecraft, and measure how they perform as individuals, as teams, and as organisations. The exercise ran in two cohorts, each a full five-day live drill.

Why Live Fire

Tabletop exercises test decision-making. Capture-the-flag events test individual skill. Neither tests what matters most: how a team operates as a unit when a real intrusion is unfolding in real time, across a real network, with pressure mounting by the hour.

Cyber Guard was designed to close that gap. Powered by Cympire's hyper-realistic cyber range and live-fire capabilities, the exercise placed every team inside a fully operational simulated enterprise, complete with workstations, servers, domain infrastructure, firewall systems, and a live AI-powered platform at the core of the target organisation's business, and subjected them to a continuous, escalating attack over three days.

No scripted playbook. No pause button. Just the tools, the telemetry, and the clock.

The Scenario

The target organisation was a fictional Singapore maritime logistics operator, chosen to reflect the kind of critical infrastructure environment CIIO teams are responsible for defending: operationally complex, digitally interconnected, and consequential if disrupted.

CyberproAI designed and built a complete digital estate on the Cympire platform to make the investigation immersive. Replicating an authentic enterprise environment and network topology, the simulated environment spanned multiple network zones with dozens of machines, from internet-facing perimeter services through corporate workstations to core servers and an AI-powered business platform. Every component was functional. Every screen held clues. Every clue mapped to a real step in the attack.

The scenario included a public-facing website, a customer portal, an internal staff hub, document libraries, an AI-powered assistant, and a full operations dashboard, the kind of estate a real maritime operator would run, and the kind of estate a real adversary would target.

The Intrusion

The attack was designed as a single continuous intrusion that advanced through three phases across the three exercise days, modelled on documented APT behaviour against critical infrastructure.

Phase 1 — Initial Access

The intrusion began at the perimeter, exploiting a known vulnerability to gain an initial foothold. From there, the attacker harvested credentials, established persistent command-and-control access, and opened the door to internal systems.

Phase 2 — Entrenchment and Escalation

With a foothold established, the attacker embedded deep into the environment: deploying multiple persistence mechanisms, escalating privileges, disabling defensive controls, harvesting credentials from memory, and mapping the internal network for high-value targets, including the organisation's AI platform.

Phase 3 — Domain Compromise and Impact

The final phase escalated to full domain compromise and multi-vector impact: data exfiltration, public-facing service disruption, AI system manipulation, and ransomware deployment with recovery mechanisms disabled.

Each day reset to a fixed starting point, ensuring no team was penalised for the previous day's outcomes. Each day also included a structured shift handover, requiring teams to transfer a live incident cleanly between rotations, a critical skill rarely practised outside of real events. The exercise concluded with a formal handover to a simulated national CERT.

A New Dimension: AI-Specific Threats

Cyber Guard 2026 went beyond conventional network intrusion. The scenario incorporated AI-specific attack vectors that reflect the emerging threat landscape for organisations adopting AI-powered systems.

The attacker targeted the organisation's AI platform, manipulating its data sources and exploiting vulnerabilities specific to AI systems. For many participating teams, this was their first hands-on encounter with AI-specific threats in an operational context, a deliberate design choice to build awareness and response capability for risks that are already emerging in production environments.

What Participants Said

"The best exercise, environment and simulation I have ever joined." Rated 10/10 — Security Analyst, Oil & Gas, 8 years' experience

"I liked that AI was incorporated, as it is relevant to today's landscape. It gave a good idea of what kind of threats one can expect when an organisation chooses to leverage AI in its environment." Rated 10/10 — Cyber & Governance Team, Maritime & Ports, 2 years' experience

"The actual exercise closely replicates our organisation's environment. The scenarios are quite realistic and challenging, in a good way." Rated 9/10 — Cyber Security Specialist, Maritime & Ports, 3 years' experience

"The instructor is experienced in the domain and can articulate real-world situations for better relevancy." Rated 10/10 — SOC Engineer, Land Transport, 9 years' experience

"It has been an exciting and fruitful exercise. Thank you for the knowledge shared. The Splunk hands-on exercise was the highlight." Rated 10/10 — Manager, Power Generation, 30 years' experience

"This kind of exercise is very helpful for me. I gained new knowledge and exposure to new technical terms." Rated 10/10 — Control & Instrumentation Engineer, Energy & Infrastructure, 4 years' experience

Looking Ahead

Cyber Guard tested 24 CIIO teams in realistic conditions, delivering measurable insight into resilience across Singapore's critical sectors and reinforcing national cyber readiness. It also reflects the strength of our partnership with CSA and our shared commitment to sustained preparedness." — Elad Menashe, General Manager, APAC, CyberproAI

Cyber Guard 2026 demonstrated that readiness is not built in a classroom, it is built under pressure, against realistic threats, with real consequences for every missed alert and every delayed decision. The programme gave participating teams a measurable baseline of their capabilities and a clear path to improvement.

Cyber Guard 2026 was delivered by the CyberproAI Group for the Cyber Security Agency of Singapore (CSA).