// Division 5 - Cyber Tabletop Exercises

project

IRONBARK.

Train like it's real.

Interactive cyber incident exercises built around real Australian attacks.
Expert facilitation. No jargon. Just your team and a ticking clock.

promo tabletop image
⬤ Threat Feed
INCIDENT DETECTED: Medibank data exfiltration — 9.7M customers affected /// INCIDENT DETECTED: Optus breach — 9.8M records exposed /// INCIDENT DETECTED: Latitude Financial — 14M+ records compromised /// INCIDENT DETECTED: Medibank data exfiltration — 9.7M customers affected /// INCIDENT DETECTED: Optus breach — 9.8M records exposed /// INCIDENT DETECTED: Latitude Financial — 14M+ records compromised ///
// WHAT IS PROJECT IRONBARK

CYBER INCIDENTS

LIKE YOU'VE NEVER

EXPERIENCED.

Project IRONBARK is a series of cyber tabletop exercises your team will actually remember.

Based on real Australian incidents, your team watches the crisis unfold on screen, fielding alerts, managing pressure from above, and examining real evidence before making the decisions that determine how it ends.

No dry PowerPoints. No months of planning. Just real world scenarios to put your team to the test.

// WHAT MAKES IT DIFFERENT

NOT ANOTHER

BORING

EXERCISE.

Don’t run another tabletop tool that’s just a PDFs with questions. Make this a simulation that your team will remember.

// Scenario

Real Australian Incidents

Every scenario is reconstructed from an actual breach on Australian soil. Not hypothetical. Not foreign. Researched from the threat groups targeting Australian organisations, and from the breaches your board is already reading.

 

// FORMAT

Engaging Video Content

Actors play the key players in your crisis: the executives, the analysts, the board. You watch the incident unfold on screen and decide what happens next. 

// Interaction

Decisions That Branch

Your choices have consequences. Escalate early and buy time. Miss a signal and watch the damage compound. The platform tracks your decisions and scores your response.

 

// Props

Simulated Evidence

Examine a ransom note, a Slack thread, an unusual firewall log, a board notification. Evidence you can actually interrogate, not descriptions of it.

 

// No Prep

Run by a Division 5 Expert

Every session is run by a Division 5 expert who knows these incidents from the inside. They guide the exercise, challenge your team’s thinking, and deliver a live debrief grounded in real-world response experience.

// Outcomes

Scored Debrief Report

After the exercise, IRONBARK generates a report showing where your team excelled, where they hesitated, and what a real response team would have done differently.

 
// HOW IT WORKS

FROM CALM TO

CRISIS

IN MINUTES.

01

// SETUP

Choose The Incident

Select from a growing library of incidents based on real Australian breaches. Each scenario is tagged by sector relevance, threat type, and complexity. So you start with something that looks and feels like your environment.

02

// THE BRIEFING

The Incident Starts

A cinematic video briefing drops your team into an active incident. Calls come in. Pressure builds.  Your Division 5 facilitator sets the scene, controls pacing, and forces decisions…there is no pause button.

Mobile Phone Call Preview Screen

03

// INVESTIGATION

Examine the Evidence

Work through simulated artefacts: network logs, ransom notes, internal comms, threat intelligence feeds. The platform reveals new evidence as your investigation progresses…just like the real thing.

 

04

// DECISION POINTS

Make the Hard Calls

Do you notify the OAIC now or wait for confirmation? Do you isolate systems and halt operations? Each decision is timed. Each decision has downstream consequences your team will see play out.

05

// DEBRIEF

See What Stood Up and What Didn't

Your Division 5 facilitator walks through the full incident timeline, mapping your decisions against recognised best-practice frameworks. You see what worked, what introduced risk, and where capability or governance gaps remain. 

// SCENARIO LIBRARY

BASED ON

ACTUAL BREACHES

IN AUSTRALIA.

Every scenario is reconstructed from real threat actors and tactics. The names are changed. The decisions aren’t.

⬤ CRITICAL : Ransomware

Operation Open Day

A prominent ransomware group has targeted your school. Systems are encrypting. Staff are locked out. The group has a history of targeting Australian education, and now it’s your turn to respond. Every decision your team makes in the next minutes will determine the outcome.

// Coming Soon

More Scenarios in Development

New scenarios added regularly across sectors including healthcare, critical infrastructure, financial services, and government.

Exercise IRONBARK // Incident Console
ironbark.init --scenario "black_friday_protocol" --team 8
Loading scenario assets... [████████████████████] 100%
⚠ ALERT: Unusual outbound traffic detected on PROD-DB-02
⚠ ALERT: EDR agent unresponsive on 14 endpoints
Your CISO is calling. Decision required in: 03:47
// WHAT IS PROJECT IRONBARK

MOVE FROM

CHECKBOX

TO CAPABLE.

There’s a difference between completing an exercise and actually being ready.

EXERCISE IN A BOX

Based on real Australian incidents
Immersive video experience
Expert Facilitated
Branching decisions with consequences
Scored debrief report
Runs in 2-3 hours
Cost per exercise

FREE

GENERIC EXERCISES

Based on real Australian incidents
Immersive video experience
Expert Facilitated
Branching decisions with consequences

Sometimes

Scored debrief report
Runs in 2-3 hours

Sometimes

Cost per exercise

$5,000–$25,000

IRONBARK

Based on real Australian incidents
Immersive video experience
Expert Facilitated
Branching decisions with consequences
Scored debrief report
Runs in 2-3 hours
Cost per exercise

$4,000

// GET ACCESS

READY TO PUT YOUR RESPONSE TO THE TEST?

Project IRONBARK is available now for teams across Australia. Get in touch with the Division 5 team to discuss the right scenario and licence for your organisation.

Want a custom scenario built around your sector or threat model? Get in touch with the Division 5 team