NATO's Crossed Swords 2026 Exercise Integrates AI Agents into Cyber Operations Training

Exercise Overview

The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) commenced its Crossed Swords 2026 exercise in Tallinn, Estonia. The execution phase of the exercise is scheduled to run for five days. This event brings together more than 250 individuals from over 40 countries, including both NATO members and non-members.

Training Objectives

Participants, comprising national cyber forces, military cyber operators, threat hunters, and digital forensics experts, are practicing the planning and timing of cyber operations in conjunction with kinetic military actions. The drill aims to refine command-level direction of offensive and defensive cyber assets and enhance tactical skills for hands-on specialists. The cyber exercise is also linked to a training event for special operations forces.

Jozef Kostelansky, Crossed Swords 2026 Exercise Director, stated that the core challenge is synchronization, ensuring cyber effects occur at the precise moment to support kinetic or special operations, with timing measured in minutes.

Integration of AI Agents

A new element in this year's exercise is a dedicated track focused on AI agents. Participants will build, deploy, assess, and operate alongside these agents. The exercise environment utilizes locally hosted AI and, for the first time in Crossed Swords, incorporates OpenAI’s Daybreak cyber defense offering.

Kostelansky noted that introducing AI agents directly addresses a significant shift in the modern cyber threat landscape, training participants to use AI while maintaining human oversight for complex, multi-domain missions.

Collaboration with Civilian Partners

The drill also involves pairing national cyber forces with civilian partners to integrate critical infrastructure protection into their plans. Over 20 organizations from industry, academia, and the NGO sector are supporting the event with expertise, target systems, and specialized tools. Participating organizations include Bitdefender, ESET, Elastic, Mandiant, OpenAI, Stamus Networks, TryHackMe, and the International Committee of the Red Cross (ICRC).

Exercise Growth

Crossed Swords originated from a red teaming workshop in 2014 and has since expanded to include command-level training and combined cyber and kinetic operations. Participation has approximately doubled since 2022, when 120 people from 24 countries took part, with 240 participants in last year's edition.