Singapore Poly to offer ethical hacking services, give students real-world experience

AI generated

SINGAPORE - Singapore Polytechnic has become the first tertiary institution in Singapore to help small and medium-sized enterprises hunt for weaknesses in their computer systems before hackers can exploit them.

Known as penetration testing, the service involves systematically probing a company’s systems for security gaps and vulnerabilities that could leave it open to cyber attacks. The service will be free unless advanced tools are required.

Offering the service within the institution will also expose its students to real-world experience as the country grapples with a persistent shortage of cybersecurity talent.

Liew Chin Chuan, director at SP’s school of computing said that SMEs may not have the budget or in-house expertise to defend themselves against cyber threats.

“SP can give students authentic industry experience while helping real businesses strengthen their defences,” said Liew on Aug 19.

The penetration testing service is part of a broader initiative called CASTLE, launched on Aug 19, which also provides SMEs with advisory services and awareness training, while giving students exposure to real-world cybersecurity work.

The institution obtained the license to offer penetration testing services in January 2026 from the Cybersecurity Services Regulation Office, a regulatory arm set up by the Cyber Security Agency of Singapore.

Two out of 15 cybersecurity faculty staff from SP’s School of Computing have been approved to offer the service, and will guide students through penetration testing tasks such as identifying and assessing vulnerabilities in companies’ systems.

About 540 students a year are expected to gain exposure to such work, while all 15 faculty members are expected to be certified by end-2027.

Most SMEs will not have to pay for the penetration testing service, as the tools used are already covered under SP’s curriculum budget and available to staff and students.

However, companies may have to bear some costs if a project requires more advanced tools that SP does not already have access to.

SP is currently conducting penetration testing for one SME, while another seven companies have expressed interest in the service.

Before taking on a project, the polytechnic will assess its scope and whether the work provides relevant learning opportunities that can help students meet their academic objectives.

Phang Kai De, 21, who is pursuing a diploma in cybersecurity and digital forensics at SP, took part in a penetration testing project for an SME in April.

He was involved in the reconnaissance phase, gathering publicly available information such as names and e-mail addresses to identify potential entry points into the company’s systems.

He then checked for vulnerabilities such as outdated or misconfigured software, before documenting his findings and recommending steps the company could take to address them.

“I worked with simulated systems in the past and the experience didn’t feel that authentic. I didn’t just learn technical skills, I also learnt how to communicate with clients and explain my findings,” said Phang.

The push to give students more real-world experience comes as Singapore continues to grapple with a shortage of cybersecurity professionals, a point made by Acting Minister for Manpower Jasmin Lau on Aug 19.

Singapore was short of more than 4,000 cybersecurity professionals, according to a 2024 report by ISC2, the world’s leading member association for cybersecurity professionals.

Job site Indeed said cybersecurity job postings in Singapore rose 57 per cent from 2024 to 2025, the largest increase it recorded in three years.

“At the same time, technology changes so fast, so there is a need in our academia to keep as updated as possible with the latest technologies to ensure that our talents are effective the day they step out of school,” said Lau, who is also Senior Minister of State for Digital Development and Information.

One way SP is trying to bridge this gap is through a security operations centre (SOC) set up with ST Engineering, where students can gain experience monitoring and responding to cyber threats in a live SME environment.

Unlike penetration testing, which involves looking for weaknesses in a company’s systems, an SOC continuously monitors systems for suspicious activity and responds when potential threats emerge.

Other than SP, Republic Polytechnic is the only other polytechnic that has a physical SOC today.

The SOC will have one manager and two analysts from ST Engineering, who will train up to 20 SP students each year. Students will spend 10 months there as interns and receive an allowance.

Mr Lim Meng Hwee, head of Cybersecurity Solutions & Infrastructure at ST Engineering’s Cyber business, said the live environment would help shorten students’ transition from school to the workplace by allowing them to apply what they have learnt while responding to real-world situations.

“Students develop critical analytical and problem-solving skills while learning how to respond to live cybersecurity incidents... In a live environment, they learn to operate under real-time pressure, react quickly, and respond with a sense of urgency,” said Lim.