Cyber Guard 2026: National CIIO Live-Fire Exercise
Cympire↗
10-day event delivered as two five-day programs for Singapore's CIIO cyber operations teams
24 CIIO teams trained across ten critical-infrastructure sectors
A single, continuous 31-step intrusion run over three days against a simulated maritime logistics company
AI assistant integrated throughout the exercise for natural-language threat intelligence and hunting guidance
Client intends to institutionalize the program as a tier of the national training pipeline
Overview
CyberproAI delivered Cyber Guard 2026, a 10-day event with two five-day programs for the cyber operations teams of Critical Information Infrastructure Owners (CIIOs) across Singapore's water, energy, ports, banking, transport, and other essential-service sectors. Commissioned by Cybersecurity Agency of Singapore following a significant, publicly reported cyberattack on the nation's critical infrastructure, the program extended CyberproAI's existing national-tier incident response training down to the first-responder teams embedded within operating companies, calibrated for rapid detection and initial containment rather than deep forensic investigation. Delivered across two weekly cohorts, the exercise combined instructor-led training with a continuous, three-day live intrusion against a simulated maritime shipping and logistics company, run under real operational time pressure and concluding in a rehearsed handover to the national CERT. 24 CIIO teams were trained across ten critical-infrastructure sectors, roughly 72 to 74 participants in total, and every team was evaluated consistently across technical skills, teamwork, and process. Participants also worked with an AI assistant integrated throughout the exercise to retrieve threat intelligence and hunting guidance in natural language. Cyber Guard 2026 demonstrates CyberproAI's ability to design and deliver large-scale, government-commissioned live-fire exercises that translate a real attack into a lasting capability gain, while showcasing the realism and adaptability of its AI-driven cyber range platform. The client intends to institutionalize the program as a tier of the national training pipeline.
Objectives
- 1Close the first-responder capability gap identified after a real cyberattack on national critical infrastructure.
- 2Calibrate training for rapid detection and initial containment, distinct from the deep forensic investigation focus of prior national-tier training.
- 3Deliver a single scenario realistic and relevant enough to resonate across ten distinct critical-infrastructure sectors.
- 4Enforce fair, consistent evaluation across intact company teams operating in separate weekly cohorts.
Program Design & Scope
Custom-built digital environment
CyberproAI built a fictional regional maritime shipping and logistics operator as a fully functioning digital environment: a live public website, booking portal, internal staff portal, document library, and AI routing agent, with every screen holding a genuine, working clue tied to a specific step in the attack.
Continuous 31-step intrusion
A single, evolving intrusion ran across three phases: perimeter breach and credential theft (Day 1), persistence and internal reconnaissance (Day 2), and full domain compromise, data exfiltration, and ransomware deployment (Day 3). The scenario was grounded in genuine advanced persistent threat tradecraft active in the region.
Weighted, real-time evaluation
Every team was scored consistently across three weighted dimensions (technical skills 40%, teamwork 30%, and process 30%) via a purpose-built instructor platform, with each day resetting to a fair starting point.
Deliverables
- A remote skills-baseline assessment completed by every participant ahead of in-person training, used to calibrate content to each cohort's level.
- Two days of instructor-led training in detection, incident response, digital forensics, and threat hunting, delivered through live labs.
- A three-day live-fire exercise simulating a continuous intrusion against a simulated CIIO network, concluding in a rehearsed handover to the national CERT.
- A detailed post-exercise report and stakeholder discussion to agree follow-on upskilling actions based on the exercise findings.
Impact
A new tier of Singapore's national training pipeline was successfully piloted, extending an existing national-tier relationship down to the CIIO level.
24 teams trained across two weeks, spanning ten critical infrastructure sectors, with roughly 72 to 74 participants in total.
Consistently high participant feedback reported across both weeks, based on daily written assessments submitted by participants directly.
The client indicated it will run the program alongside its existing top-tier training from next year, moving it from pilot to part of the national pipeline.
Senior client stakeholders received a live demonstration of CyberproAI's AI-driven cyber range capabilities during the delivery window, opening conversations beyond this engagement.
Stay Ahead of the Curve
Get the latest insights on global cyber resilience and AI defense delivered to your inbox.