The NATO Cooperative Cyber Defense Center of Excellence (CCDCOE) launched Exercise Crossed Swords 2026 in Tallinn, Estonia on Monday, with the execution phase of the exercise scheduled to continue until Friday.
More than 250 people from more than 40 NATO and non-NATO countries are training to plan cyber operations and synchronize them with kinetic military action.
Participants come from national cyber forces and the units that support them, including military cyber operators, threat hunters and digital forensics experts. At the command level, the exercise refines how personnel direct offensive and defensive cyber assets, while practical specialists hone their tactical skills. The cyber exercise is also linked to a training event for special operations forces.
“The main operational challenge we are testing is timing. Cyber effects must strike at the right time to support kinetic or special operations action – not in parallel, but in sequence, with timing measured in minutes, not hours. This year, that becomes more difficult, as AI is now in the loop on both sides,” said Crossed Swords 2026 exercise director Jozef Kostelansky.
New this year is a dedicated AI agent course, in which participants build, deploy and evaluate agents and operate side by side with them. The exercise environment runs on locally hosted AI and, for the first time for Crossed Swords, also uses OpenAI’s Daybreak cyber defense offering.
“By introducing AI agents into the operational workflow, Crossed Swords 2026 directly addresses one of the most significant changes in the modern cyber threat landscape. We are training our participants to harness the power of AI while maintaining the essential human oversight required for complex, multi-domain mission success,” Kostelansky said.
The exercise also pairs national cyber forces with civilian partners so that protection of critical infrastructure is integrated into their plans. More than 20 organizations from industry, academia and the NGO sector support the event with their know-how, targeting systems and specialist tools. Among them are Bitdefender, ESET, Elastic, Mandiant, OpenAI, Stamus Networks, TryHackMe and the International Committee of the Red Cross (ICRC).
Crossed Swords has its roots in a red team workshop held in 2014 and has since expanded to include command-level training and combined cyber and kinetic operations. Participation has almost doubled since 2022, when around 120 people from 24 countries took part, and last year’s edition had 240 participants from around 40 countries.
CCDCOE’s largest Locked Shields exercise involved more than 4,000 participants from 41 countries in 2026.
Related: Sevii targets attacks at AI speed with preemptive autonomous defense
Related: Security awareness training is not dead, but it needs to be rethought
Related: More than 370 organizations participate in GridEx VIII network security exercise
