Carolina Cyber Network faculty and member institutions have an opportunity to step inside one of North Carolina’s most realistic cyber defense exercises.
Operation Tobacco Road is a full-scale exercise led by the North Carolina National Guard Cyber Security Response Force. It places participants inside a simulated North Carolina community experiencing a coordinated cyberattack, using web servers, domain controllers and segmented departmental networks modeled after real public-sector environments.
Participants work alongside professionals and peers from across the state to monitor activity, identify suspicious behavior and report findings as the scenario develops. Rather than ending an attack immediately, the exercise allows participants to observe how an intrusion unfolds, recognize the evidence it leaves behind and see how technical findings guide a broader incident response.
The same National Guard team that leads Operation Tobacco Road supports cyber defense missions across North Carolina, including incident response, vulnerability assessments and continuous monitoring for public-sector organizations. That connection gives faculty a current view of the work taking place beyond the classroom and practical insight they can bring back to their programs.
Technical participants gain experience with network monitoring, Active Directory, vulnerability management and structured incident response. Each day concludes with a Purple Team discussion in which the Red Team explains the attacks it conducted. Participants can compare what they observed with what actually happened, helping them better understand attacker behavior, defensive visibility and the decisions made during an active incident.
In 2026, Operation Tobacco Road is being offered twice, with a summer session held in August and a fall session coming in October. The upcoming five-day technical exercise will take place October 5–9. A one-day tabletop exercise will be held October 7, with an emphasis on incident coordination, leadership decisions and interagency response.
The tabletop option may be especially useful for faculty, program leaders and administrators who want to better understand the organizational side of cyber incident response without serving in a primarily technical role.
There is no registration cost, and lodging is provided. Participants need to bring a laptop, while the remaining exercise resources are supplied on-site.
For CCN member institutions, Operation Tobacco Road offers more than professional development. It provides direct exposure to the capabilities employers and public agencies need, strengthens connections with North Carolina’s cyber defense community and gives faculty practical examples that can inform instruction and program development.
Faculty who can participate this October are encouraged to explore the opportunity now. Those unable to attend should put Operation Tobacco Road on their radar for 2027 and begin considering how it could support faculty development and strengthen applied cybersecurity instruction at their institutions.
Learn more about Operation Tobacco Road and registration at csrf.nc.gov/operation-tobacco-road.
