Cyberswarm Incident Response (IR) 2026

Cybersecurity Training and Exercise Bootcamp

Summary:

The Center of Information Assurance and Security (CIAS)  and the department of Computer Science, California State University, Sacramento, will host a two-day cybersecurity training and exercise event that brings together industry professionals and academia to provide hands-on cybersecurity education for students from the Sacramento region. Participants will access cloud-based cyber range environments to conduct live penetration testing as part of the red team while also defending enterprise systems through blue team operations. The event will expose students to realistic cyberattack and defense scenarios, strengthen their practical technical skills, and provide valuable opportunities to network with cybersecurity professionals, faculty, and potential employers.

Two-day training/exercise:

• Day 1 - Training Day (8 hours): Parallel instruction for the Red Team (offensive tradecraft) and Blue Team (detection, monitoring, incident response).

• Day 2 - Live Exercise Day (4 hours): A controlled, refereed ("White Cell") attack-defend competition. Red Team attempts to gain and maintain access to the domain; Blue Team must keep services available, detect intrusions, and respond.

Dates: October 30-31,2026

Objective:

• Provide supervised, hands-on experience with enterprise defensive tooling  offensive tradecraft in a legal, contained environment.

• Reinforce the incident response lifecycle: Preparation - Identification - Containment - Eradication - Recovery - Lessons Learned

• Learn offensive lifecycle in a defensive-education context: Recon - Scanning/Enumeration - Initial Access - Privilege Escalation - Lateral Movement - Persistence, mapped to MITRE ATT&CK, so Blue Team learns to recognize each stage.

• Build teamwork, communication, and documentation skills;

Roles

• Red Team - attempts to achieve defined objectives within the Rules of Engagement.

• Blue Team - defends the environment: monitors Security Onion, tunes/reads Palo Alto logs, investigates alerts, contains and eradicates footholds, and keeps in-scope services available.

• White Cell (Industry Officials and Faculty) - referees the exercise, injects scenario events if needed, scores both teams in real time, and holds sole authority to pause or stop the exercise.

Organizing Parties:

• California State University, Sacramento

• California National Guard

• California Cybersecurity Integration Center (Cal-CSIC)

Students:

All college and university students in the Sacramento region are encouraged to participate.

Regular registration is closed. Observer registration is open.