AWSN - 2025 Incident Response Competition

*** Places are now fully allocated but you can still join the waitlist ***

Overview

Retrospect Labs has partnered once again with the Australian Women in Security Network (AWSN) to deliver a competition-style incident response event for anyone identifying as a woman working in, studying, or interested in cyber security in Australia. This competition is an excellent way to get hands-on experience in a controlled environment, and is suitable for both those who are technically or strategically inclined – technical skills are not a pre-requisite, just a willingness to learn!

The competition is a great opportunity to work through a realistic cyber incident – in a self-paced fashion – over 10 days (including two weekends, for those that can’t get around to it during the week!) Our judging panel will go through all responses once the competition ends, after which, at our closing ceremony, the winning teams will be announced and prizes allocated.

This competition could not have happened without the support from the event’s key sponsor, the Australian Signals Directorate (ASD).

Note: This event will feature a brand-new scenario, so those who have previously participated in a competition provided by Retrospect Labs, are still encouraged to get involved and participate again in this competition.

What does the competition involve?

For ten days, starting on Friday, 28 November 2025, participants will work their way through a scenario that simulates a real-world cyber incident, impacting a fictitious organisation. This scenario has been designed to test a broad range of relevant incident response skills. You’ll get a chance to practice your forensic analysis skills, dissect various forensic artefacts, and identify Indicators of Compromise (IoCs), as you build a picture to  understand what malicious activities have occurred and the methods employed by the adversary (known as their Tactics, Techniques, and Procedures – TTPs). You’ll also have a chance to flex your strategic incident response skills, from managing the public response to an incident, to managing expectations of Executive Leadership Team (ELT) members, and considering the legal implications of the unfolding incident and its corresponding response. If you have an interest in, skills pertaining to, or are just willing to learn about incident response, you will fit well into a team.

Throughout the exercise, teams will use our cyber security exercise platform, Gauntlet, to complete a number of tasks common to incident response. These tasks and their responses will be reviewed by a panel of judges who will evaluate the team’s performance. At the conclusion of judging, the top three teams will be crowned winners during a virtually hosted closing ceremony.

It's important to note that not only will the winning team earn the title “Winner of the 2025 AWSN Incident Response Competition”, but there are also some awesome prizes up for grabs for the top three placed teams.

The full list of prizes is still yet to be confirmed, but we will announce all of the amazing prizes when we can!

‍When is it running?

Competition Official Opening – Friday, 28 November 2025 at 9am (AEDT)

Competition Official Close – Sunday, 7 December 2025 at 11:59pm (AEDT)

Closing Ceremony – Monday, 15 December at 5:00PM (AEDT)

In the lead up to the event there will be several virtual sessions that you can choose to attend. These sessions will give you a chance to hear from various industry professionals who may share some tips & tricks that you can leverage throughout the event, provide some insight into what they do, and/or discuss an incident that they were personally involved in! More details on these sessions will be available closer to the event.

Who's this for?

Anyone in Australia who identifies as a woman, working in cyber, studying a related degree, or if you are simply interested in learning more about incident response and have some basic cyber skills or knowledge, we encourage you to register and to give it a go!

It would indeed be beneficial to have some SOC/Incident Response skills (some familiarity with common incident response tools or incident response frameworks). However, you do not need to have these technical skills to participate in a team.

We don’t expect you to know everything about incident response, but we want you to want to learn along the way, find out what you do enjoy about IR, and get excited about it!

Registration

For this year’s competition, we have decided to open up two registration options!

Individual: You register as an individual, where you will be asked to answer a few quick questions that will give us an understanding of your experience. This information will be used to put together the teams, so please answer the questions as best you can! Teams will be made up of women from around Australia – so you might be working in a team with people from a different town, city, or state! This registration option will cost $15.

Team: If you already have a team ready that you would like to go through the competition with, register together with our second option and sign up as a group of 3-5 women. In this case, you will be asked to provide a name and email address for each team member, and you will not be assigned members outside of your registered team. This registration option will cost $45 (altogether – not $45 each).

These costs are non-refundable.

We understand that some of you may be experiencing financial difficulties or are unable to pay this fee. If this is the case, we would still love you to participate, so we ask that you reach out directly to: programs@awsn.org.au

Once you have registered and the teams have been finalised, your team will receive an email with some further information and instructions (your email will be shared with your team members if you sign up as an individual). Closer to the competition start date, you will be invited to a Slack channel, which will contain a space for you to communicate with your team, and to receive any communications from the competition organisers during the event.

Please note that places are strictly limited to 300 participants. Once tickets are fully allocated, you can put your name on the waitlist, and we will contact you if a space opens up.

We kindly ask that by registering for a place, you demonstrate a commitment to active participation in this competition, as your engagement is essential to the success of your team.

Registrations Open – Monday, 6 October 2025 at 9am (AEDT)

Registrations Close – Friday, 7 November 2025 at 5pm (AEDT) – If places are not fully allocated prior.

Response Lab

All teams will again be provided access to an isolated, cloud-based forensic environment, which we call Response Lab. This environment will be primed with all the tools you require to analyse the technical artefacts involved throughout the competition. To make access as simple and streamlined as possible, you can jump into the virtual machine via your internet browser, through Gauntlet! That means you don’t need to set up your own virtual machines or forensic labs! Unless, you want to of course.

What else do I need to know?

Participants will be able to control the pace of the exercise and will have the flexibility to compete outside of workhours. In collaboration with your team, you can start the exercise whenever you like and work through it at your own pace – but everything must be completed by 7 December 2025.

Participants won't be judged on how long they take to complete the challenge.

This can be used during the competition as well, as there may be someone on the wait list that can join in your stead.

Watch the following webinar recording if you would like to know more about the competition.