2026 AWSN Incident Response Competition

Retrospect Labs and the Australian Women in Security Network (AWSN) have once again partnered to deliver a competition-style incident response exercise for women working in, studying, or interested in cyber security across Australia.

This competition provides a unique opportunity to develop and apply both technical and strategic incident response skills while working through a realistic cyber security incident in a safe and supportive environment. Participants can register individually and be placed into a team of up to five people with a mix of backgrounds and skillsets, or register as a team of 3-5 participants.

Over 10 days, teams will investigate a fictitious organisation impacted by a cyber incident, analyse evidence, identify findings, and respond to a range of technical, strategic, and organisational challenges. At the conclusion of the event, submissions will be reviewed by a judging panel, with prizes awarded to the top-performing teams.

This competition could not have happened without the support of the event's key sponsor, the Australian Signals Directorate (ASD).

Note: This event will feature a brand-new scenario, so those who have previously participated in a Retrospect Labs competition are strongly encouraged to get involved again.

New for 2026 - Incident response training labs

To further support skill development and make the competition more accessible to participants at different stages of their cyber security journey, we are introducing a new capability development stream for 2026.

Selected participants will receive access to standalone, hands-on incident response training labs prior to the competition. Designed for participants with limited digital forensic or incident response experience, these practical exercises aim to build confidence, develop technical analysis skills, and provide additional exposure to common incident response workflows before the competition begins.

Participants will have access to two self-paced training labs, each focused on introducing common incident response and digital forensics concepts. Participants can choose to complete either one or both labs, depending on their experience level, interests, and availability.

To further support learning outcomes, participants will also be provided with detailed answer guides and supporting material, allowing them to review their findings, understand the investigation process, and learn from the exercises at their own pace.

As part of the registration process, participants will have the opportunity to nominate for a place in the training labs by Friday 25 September 2026. Those who wish to be considered will be asked to answer a small number of questions relating to their experience and background. This will help us understand participants' experience levels and allocate training places to those who are likely to benefit most from the additional hands-on learning opportunity.

Note: Training lab places are limited to 100 participants.

What will participants gain?

Through the training labs, participants will have an opportunity to:

• Learn common incident response frameworks and methodologies.

• Develop an understanding of Digital Forensics and Incident Response (DFIR) concepts and techniques.

• Become familiar with common cyber security terminology, including Indicators of Compromise (IoCs) and adversary Tactics, Techniques and Procedures (TTPs).

• Gain hands-on experience investigating realistic cyber security incidents.

• Become familiar with Retrospect Labs' Gauntlet platform and Response Lab environment.

• Learn how common DFIR tools are used during investigations.

• Develop an understanding of the thinking and decision-making involved in incident response activities.

• Build confidence before participating in the competition itself.

The training labs are designed to provide participants with a practical pathway to further develop their skills and be better prepared for the competition.

What does the competition involve?

For ten days, starting on Friday 6 November 2026, participants will work through a realistic cyber incident impacting a fictitious organisation.

The scenario has been designed to reflect the tactics, techniques and procedures (TTPs) used by modern adversaries and test a broad range of incident response skills.

Participants will analyse forensic artefacts, identify Indicators of Compromise (IoCs), investigate malicious activity, and develop an understanding of how a cyber incident unfolded. Teams will also undertake tasks relating to media management, executive communications, legal and regulatory considerations, and broader incident response decision-making.

Throughout the exercise, teams will submit responses to a range of incident response activities and challenges using Retrospect Labs' cyber security exercise platform, Gauntlet.

Following the competition, submissions will be reviewed by a panel of judges and the top-performing teams will be recognised during the closing ceremony.

Not only will the winning team earn the title of Winner of the 2026 AWSN Incident Response Competition, but there will also be some fantastic prizes up for grabs.

Prizes

The full list of prizes is still being finalised and will be announced closer to the competition.

When is it running?

Training labs (selected participants):

• Training opens: Wednesday 7 October 2026

• Training closes: Friday 16 October 2026

Competition:

• Competition official opening: Friday 6 November 2026 at 9:00am (AEDT)

• Competition official close: Sunday 15 November 2026 at 11:59pm (AEDT)

Closing ceremony:

• Monday 30 November 2026 (timing to be confirmed)

In the lead up to the competition, there will also be several virtual sessions that participants can choose to attend. These sessions will feature industry professionals, cyber security practitioners and guest speakers who may share practical tips and insights, discuss their careers, and provide perspectives from real-world cyber incidents. More information on these sessions will be made available closer to the event.

Who's this for?

Anyone in Australia who identifies as a woman, works in cyber security, studies a related field, is looking to transition into the industry, or is interested in learning more about incident response is encouraged to participate.

Previous incident response experience is not required.

While familiarity with cyber security concepts, digital forensics, Security Operations Centres (SOCs), or common incident response frameworks may be beneficial, the competition is designed to cater to a wide range of skill levels.

Whether you are highly technical, strategically focused, or simply eager to learn, there is a place for you on a team.

Registration

There are two registration options this year:

1. Register as an individual ($15 registration fee): You will be asked a few questions to give us an understanding of your experience. This information will be used to put together teams based on individual strengths, so please answer the questions as best you can. Teams will be made up of women from around Australia, so you might be working in a team with people from a different town, city, or state!

2. Register as a team ($45 registration fee): You can form your own team of 3 to 5 individuals. Teams would benefit from having a mix of skills in the fields of computer forensics, communications and legal/privacy. The registration form requires you to provide a name and email for each team member.

We understand that some of you may be experiencing financial difficulties or are unable to pay the registration fee. If this is the case, we would still love you to participate, so we ask that you reach out directly to: programs@awsn.org.au

Once you have registered and the teams have been finalised, your team will receive an email with some further information and instructions (note that your email will be shared with your team members). Closer to the competition start date, you will be invited to a Slack channel, which will contain a space for you to communicate with your team and to receive any communications from the competition organisers during the event.

Please note that places are strictly limited to 400 participants. Once tickets are fully allocated, you can put your name on the waitlist and we will contact you if a space opens up.

• Registrations open: Friday 7th August 2026 at 8:00am (AEST)

• Registrations close: Monday 19 October 2026 at 11:55pm (AEST), if places are not fully allocated prior.

Your team will also be given access to Retrospect Labs' cyber security exercise platform, Gauntlet. Gauntlet will be used for distributing the scenario (known as injects), forensic artefacts, and is where you will submit your task responses.

Gauntlet and Response Lab

All participants will be provided access to Retrospect Labs' cyber security exercise platform, Gauntlet.

Gauntlet is used to distribute competition materials, forensic artefacts, scenario injects, and task submissions throughout the competition.

Participants will also receive access to Response Lab, a cloud-based forensic analysis environment pre-configured with the tools required to complete the technical aspects of the exercises.

Response Lab can be accessed directly from an internet browser, removing the need to build and maintain your own virtual machine environment.

What else do I need to know?

Participants can work through both the training labs and competition at their own pace.

The competition is designed to accommodate study, work and personal commitments, allowing teams to complete activities outside standard business hours if required.

Teams can begin the competition whenever they choose after opening day, but all submissions must be completed before the official competition close.

Participants will not be assessed on how quickly they complete the competition.

Out of respect for the organisers and the judges taking their time to run this competition, as well as for your other team members, we ask that anyone who can no longer participate to notify us of their withdrawal using this Early Dropout Form: 2026 AWSN Incident Response Competition

Any queries about this competition can be directed to: competition2026@retrospectlabs.com