The original text is in EN, taken from the source site. Source ↗

Government

NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training

The NATO CCDCOE exercise in Estonia introduces AI agents and OpenAI Daybreak into joint cyber and kinetic operations training.

By

Eduard Kovacs

| November 3, 2026 (4:49 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) kicked off Crossed Swords 2026 in Tallinn, Estonia, on Monday, with the exercise’s execution phase set to run through Friday.

More than 250 people from over 40 countries, both NATO members and non-members, are practicing how to plan cyber operations and time them with kinetic military action.

Participants come from national cyber forces and the units supporting them, including military cyber operators, threat hunters, and digital forensics experts. At the command level, the drill sharpens how staff direct both offensive and defensive cyber assets, while hands-on specialists hone their tactical skills. The cyber exercise is also tied into a training event for special operations forces.

“The core operational challenge we are testing is synchronisation. Cyber effects must hit at the right moment to support a kinetic or special operations action – not in parallel, but in sequence, with timing measured in minutes, not hours. This year, that gets harder, because AI is now in the loop on both sides,” said Crossed Swords 2026 Exercise Director Jozef Kostelansky.

New this year is a dedicated track on AI agents, in which participants build, deploy and assess agents and operate side by side with them. The exercise environment runs on locally hosted AI and, in a first for Crossed Swords, also uses OpenAI’s Daybreak cyber defense offering.

“By introducing AI agents into the operational workflow, Crossed Swords 2026 is directly addressing one of the most significant shifts in the modern cyber threat landscape. We are training our participants to harness the power of AI while maintaining the critical human oversight required for complex, multi-domain mission success,” Kostelansky said.

Advertisement. Scroll to continue reading.

The drill also pairs national cyber forces with civilian partners so that critical infrastructure protection is built into their plans. Over 20 organizations from industry, academia and the NGO sector support the event with know-how, systems to target and specialized tooling. Among them are Bitdefender, ESET, Elastic, Mandiant, OpenAI, Stamus Networks, TryHackMe, and the International Committee of the Red Cross (ICRC).

Crossed Swords traces its roots to a 2014 red teaming workshop and has since expanded to include command-level training and combined cyber and kinetic operations. Participation has roughly doubled since 2022, when around 120 people from 24 countries took part, and last year’s edition had 240 participants from about 40 nations.

The CCDCOE’s larger Locked Shields exercise involved more than 4,000 participants from 41 nations in 2026.

Related: Sevii Targets AI-Speed Attacks With Preemptive Autonomous Defense

Related: Security Awareness Training Isn’t Dead, but It Needs a Rethink

Related: Over 370 Organizations Take Part in GridEx VIII Grid Security Exercise

Written ByEduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Eduard Kovacs

  • FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
  • Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
  • Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
  • Drupal Commerce Core Vulnerability Exploited Against Online Stores
  • $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
  • $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  • Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
  • BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts

Latest News

  • Over 100 European Stores Hit as Supermarket Fridge Attacks Return
  • Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
  • Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
  • Revolve Data Breach Impacts at Least 200,000 People
  • Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
  • Malicious Claude Code Extension Served in Cursor Supply Chain Attack
  • Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
  • Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

Trending

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations

FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Cybersecurity M&A Roundup: 37 Deals Announced in October 2026

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Passkeys Are Better Than Passwords. But They Are Not Enough.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)