Keeping Up Was Never the Point: Five Days at Singapore Cybersecurity Camp 2026

The SCC 2026 cohort.

One of this year's participants saw SCC in 2025 and didn't apply. They were worried they wouldn't keep up, and that the topics would sit above their ceiling.

They came this year. Their favourite trainings ended up being OT security and threat intel. Two of the more niche things on the schedule.

We put that student's worry to this year's co-leads. Their answers are at the end.

Singapore Cybersecurity Camp 2026 ran from 7 to 11 September at NUS. It's the second edition, modelled on the Global Cybersecurity Camp (GCC): five days of hands-on trainings, a team project running underneath, a networking night, and a prize presentation to close it out. It's organised by Division Zero (Div0), supported by CSA and the CyberSG TIG Collaboration Centre, with CREST and OffSec as prize sponsors and NUS Enterprise as venue sponsor. Around 55 students applied, the organisers planned for 25, and 22 took part.

Seven trainings in five days, with the project squeezed into the evenings.

Built by people who sat in the seats

The camp was run by three co-leads, Amelia, Jingkai and Yu Kai, and none of them came to this cold. Yu Kai did SCC 2025 and it's what pushed him to co-lead the second run. Amelia went through both SCC and GCC and wanted to bring the GCC experience home to students here. Jingkai was a participant too, and says what stayed with him were the hands-on lessons and "the mentors who took time to explain their thinking."

He's also clear about why he signed up to run it:

"Throughout my time in cybersecurity, it's been the people around me — mentors, peers, and strangers at CTFs and meetups — who pushed me to question what I knew and go after what I didn't. SCC felt like a chance to create that same environment for others." — Jingkai

On who they wanted in the room, the three answers line up more than you'd expect. Jingkai wanted people "comfortable being uncomfortable." Amelia wanted motivated students who were curious and keen to explore more of the field. Yu Kai went further: when he reviewed applications, interest counted for more than aptitude.

Day 1 icebreaker, Monday morning. Strangers with worksheets.

Who was in the room

SCC is open to students at polytechnics, ITEs, junior colleges and universities, plus full-time NSFs, and applicants sit a short technical test. This year's 22 came from polytechnics, junior colleges and universities, plus NSFs. Within that, the reflections show how wide the range was. One participant was a Year 2 cybersecurity and digital forensics student whose coursework had mostly been networking and system security. Another was doing an MSc in cyber security. Another described themselves as largely self-taught, with gaps they knew about. Another called themselves a beginner who came in with no direction and mostly wanted to make friends. For one participant, SCC was their first external cybersecurity event.

Several wrote about finding parts of the week hard. One participant wrote that there were moments they had no idea what they were doing and got stuck for a while, and that figuring it out slowly turned out to be one of the more enjoyable parts.

Monday again. Circle game before the first training.

Monday to Wednesday: the trainings

Amelia's goal for the content was simple: expose students to the stuff school doesn't cover. Threat modelling. Threat intelligence. OT.

"One of my biggest takeaways as a participant was realising how broad cybersecurity is. It is not just about red and blue teams, or attack and defence." — Amelia

Going by the reflections, that landed. The OT session on Monday came up again and again. One participant wrote about using their Linux terminal to control a motor fan's spin direction and short-circuit the "nuclear reactor". Another had never considered hardware security as a career path before that session.

Tuesday was a full day of threat modelling with Donavan, and it split the room. One participant thought the lab ran too long for something less technical and would've preferred the time go to pwn. Another said it changed how they think about security entirely: finding threats and attack paths at the design stage, not bolting security on after the thing is built. A third singled out the class discussions for probing their thinking further.

On Wednesday, the mobile security session had one participant writing Frida scripts to bypass root detection on Android apps. The afternoon was AI fluency, though AI showed up well beyond that one session. One participant was surprised by how far things had shifted: instead of looking down on AI, many mentors encouraged using it to guide their thinking.

Wednesday night

Networking night was the one part of the week all three co-leads brought up.

It didn't start well. Amelia describes a room where students and guests didn't know each other or how to approach one another, so there wasn't much interaction. The fix was low-tech: split everyone into small groups for a quick roundtable intro.

"The simple activity worked well — participants and guests became much more engaged, and many continued their conversations even after the session ended." — Amelia

Networking night roundtable, Wednesday evening.

For Jingkai, the night was about initiative: participants taking the first step with a professional or a GCC alum, and being willing to ask questions. For at least one student it was their first networking event, ever. Another called it their best networking session to date. Guests came from INTfinity, OffSec and CREST, alongside GCC alumni. One participant came away with a line from one of them: AI won't replace security people, but the people who use it will replace the ones who don't.

Thursday and Friday

Binary exploitation, Thursday.

Thursday morning was binary exploitation, and it rewired at least one participant's thinking. The same student who'd been writing Frida scripts the day before summed it up as realising that letting someone write 512 bytes into a 16-byte buffer can hand an attacker full control of a system. Every program they write from now on is going to get that question asked of it.

The YARA rule creation session that afternoon had the most Singapore problem of the week: the slide told everyone to switch to their phone hotspot because NUS was blocking the trainer's MWDB server.

YARA rule creation, Thursday afternoon.

Friday morning closed out the trainings with Davis Zheng's session on proactive engagement with live threat actor infrastructure. One participant said it showed them how security teams can move beyond simply waiting for alerts.

Elsewhere in the week, another participant called the live malware analysis their most amazing session and wanted it to run a full day.

The project, and the honest bit

Underneath all of that, teams were working on one of four problem statements. From the reflections, at least two dealt with shadow AI and with data loss prevention for confidential info going into LLMs. Real problems that companies are dealing with now.

The project ran alongside the trainings, and not everyone loved that. One participant put it plainly: having the project run concurrently was "kinda hectic," and they felt split between the two. We put that to the co-leads.

Their answers don't dodge it. The format came from GCC, but GCC is an overnight camp with accommodation, and most of the project work was meant to happen there after hours. SCC isn't residential. The schedule blocked out Tuesday and Thursday evenings for project work, which meant staying back, continuing online, or working on the project during trainings.

"Given the choice, I would have tried another approach, but with logistical and manpower constraints, it is not as straightforward... Unfortunately this is just one of the compromises that we had to accept for a more full-fledged SCC." — Yu Kai

Jingkai says they already scaled it back this year. Teams only had to submit a concept, not a working tool. He also admits more can be done for different kinds of learners without losing the intensity. Amelia's position is that the pressure was partly the point: five days is short, and they wanted people to push.

What they'd change

The project wasn't the only thing on their list. Amelia would send the pre-reading earlier. It went out late this year and some students may not have had time to prepare. She'd also look at the project structure: let teams write their own problem statements, or cut from four to two so teams can go deeper. Jingkai wants a more accessible venue; NUS was unfamiliar ground for some participants and could make them late on certain days. Yu Kai wants more food (he doesn't think it was enough to keep people going), more hands-on content like car and medical device hacking even if it's above the advertised level, and more participants overall.

Friday afternoon

Project presentations, Friday.

The best story of the week came out of Friday's presentations. One team lost three of its four members to illness. The organisers gave the remaining participant the choice to present alone or skip. He presented.

"What struck me was that throughout his presentation, he consistently referred to the work as 'we' rather than 'I'. Despite being the only team member present, he continued to recognise his teammates' contributions." — Amelia

Prize presentation, Friday afternoon.

The week wrapped up with prizes and a closing address from Emil Tan, founder of Div0.

Closing address by Emil Tan, Founder, Div0.

Keeping up

Back to the student who skipped 2025.

Amelia's answer is practical. SCC is aimed at students with some intermediate knowledge, but people show up at different stages, and feeling unprepared is normal. You don't need to know everything before you join.

Jingkai's answer is the one this piece is named after:

"Keeping up was never really the big picture. SCC is not a test of what you already know. Instead, it's a space to be challenged and figure things out alongside others who are doing the same." — Jingkai

Yu Kai flipped it around. If you came to this camp and didn't struggle with any of the material, the co-leads failed to find hard enough content for you. Failure is expected, and encouraged.

One participant had advice of their own for next year's cohort: embrace the imposter syndrome. They walked in feeling overwhelmed by the talent in the room and sure they didn't belong. As the week went on, that gave way to having fun and learning from the people around them.

The student who skipped 2025 wrote that they're glad they didn't skip this one.

If that's you, SCC is coming back in 2027, with dates and applications still to be announced. Updates will be at scc.div0.sg, or email scc@div0.sg.

---

This article was drafted and edited with the help of AI. The accounts, quotes and reflections in it belong to the SCC 2026 co-leads and participants, and every claim was checked against their original responses. Quotes from the co-leads are lightly edited for length and clarity. Participant reflections are quoted or paraphrased without names.

Disclosure: SCC is organised by Division Zero (Div0). Div0 and v0id_deck are closely linked partner organisations.