Singapore Polytechnic launches CASTLE as first IHL licensed for penetration testing in Singapore

Singapore Polytechnic (SP) has launched the Cybersecurity Assessment and Security Operations Centre Training Lab for Enterprises (CASTLE), combining cybersecurity services for small and medium-sized enterprises with an operating environment where students can work on industry security challenges. The launch also makes SP the first Institute of Higher Learning in Singapore licensed by the Cybersecurity Services Regulation Office (CSRO) to provide penetration testing services. Through CASTLE, the School of Computing will offer services ranging from basic cyber hygiene assessments to regulated penetration testing, security operations, and employee awareness training, while involving students and staff in their delivery.

The initiative directly addresses emerging security risks highlighted in the Singapore Cyber Landscape 2024/2025 report, which recorded a 21% increase in reported ransomware cases in Singapore during 2024, with manufacturing and professional services among the most affected sectors. Many of these incidents involved longstanding vulnerabilities, according to SP, making basic security weaknesses a primary focus for CASTLE before client organisations move into more advanced assessments and continuous monitoring.

Services span cyber hygiene and regulated assessments

CASTLE is organised around four distinct areas covering cybersecurity hygiene checks, posture assessments, security operations, and awareness training. Under the Cybersecurity Hygiene Check service, SP students and staff examine an organisation’s digital infrastructure to identify immediate gaps and vulnerabilities. These assessments draw upon frameworks and practices from the Cyber Security Agency of Singapore as well as industry partners, with recommendations tailored to help SMEs resolve weaknesses in their existing security controls.

Organisations requiring deeper technical assessment can utilise CASTLE’s cybersecurity posture services, which include penetration testing, vulnerability assessments, and advisory work. SP’s CSRO licence allows the polytechnic to provide regulated penetration testing services to SMEs while giving students hands-on exposure to offensive cybersecurity work.

That practical experience is closely linked to SP’s partnership with Offensive Security, or OffSec. Through this collaboration, students have an established pathway towards the Offensive Security Certified Professional certification, connecting the practical work undertaken through CASTLE with the rigorous technical skills required for the industry credential.

Meanwhile, CyberSAFE@SP covers the awareness component, with students and staff providing business owners and employees with guidance on cyber risks and safer digital practices. SP is also an active member of the global Consortium of Cybersecurity Clinics. This educational outreach serves as an accessible entry point for SMEs before they progress to CASTLE’s technical assessment or security operations services.

Live security operations centre puts students alongside professionals

The programme’s security operations component will run through a new SME Cybersecurity Operations & Training Centre established in partnership with ST Engineering’s Cyber business. SP describes the live, on-campus facility as the first security operations centre of its kind within an IHL.

Inside the centre, students and staff will analyse live threat scenarios alongside cybersecurity professionals, covering security monitoring, threat detection, and incident response while supporting operational security for participating SMEs. The facility will also host training sessions jointly conducted by lecturers and industry practitioners. Furthermore, dedicated internship opportunities at the centre will provide students with deeper exposure to the technologies, processes, and working practices involved in day-to-day security operations.

ST Engineering noted that the centre expands on its existing work with smaller businesses. “The new SME Cybersecurity Operations & Training Centre at Singapore Polytechnic is an addition to our existing facility dedicated to supporting SMEs. Over the past year, we have helped more than 1,000 SMEs take proactive steps to strengthen their cyber resilience. As demand for advanced cyber defence capabilities continues to grow, our partnership with Singapore Polytechnic gives students the opportunity to develop real-world skills and gain experience in delivering cybersecurity services at operational scale, helping to develop industry-ready cybersecurity and digital forensics professionals,” said Mr Goh Eng Choon, President, Cyber, ST Engineering.

SP expects more than 180 students to benefit from CASTLE each year through projects, internships, industry collaborations, and operational training opportunities. In addition, up to 50 SMEs are projected to utilise its cybersecurity services and awareness programmes by mid-2027.

Industry partnerships extend into industrial cybersecurity

The work with ST Engineering and OffSec is accompanied by a memorandum of understanding between SP and Athena Dynamics covering Operational Technology and Industrial Control Systems cybersecurity. This collaboration will expand curriculum capabilities in these critical areas and expose students to security practices used in industrial and operational environments, which SP links to national efforts to strengthen the resilience of critical infrastructure.

Across the wider initiative, ST Engineering, OffSec, and Athena Dynamics will contribute industry expertise, curriculum development, faculty attachments, internships, and access to modern cybersecurity technologies. These collaborative arrangements enable CASTLE to connect academic training with professional assessments, security operations, and industrial cybersecurity work in environments that mirror what students will encounter after graduation.

“Cybersecurity was once seen as a concern mainly for large organisations. Today, SMEs are just as much a target, but many simply don’t have the budget or in-house expertise to defend themselves. CASTLE was built to close that gap. As the first IHL in Singapore licensed to provide penetration testing services, SP can give students authentic industry experience while helping real businesses strengthen their defences,” said Mr Liew Chin Chuan, Director, School of Computing, Singapore Polytechnic.