Cyber Coalition

Cyber Coalition: NATO’s Flagship Cyber Exercise

PLAN professionally,
ENGAGE collectively,
TRANSFORM strategically.


Cyber Coalition is NATO’s flagship annual collective cyber defence exercise and one of the largest in the world. It is planned and conducted by Allied Command Transformation under the governance of the Military Committee.

Cyber Coalition, which has been held annually since 2008, brings together a cyber coalition of NATO Bodies, NATO Allies, and Partners to strengthen the Alliance ability to deter, defend against, and counter threats in and through cyberspace in support of NATO’s core tasks by exercising collaboration and cyberspace operations, and providing input to NATO transformation.

The Cyber Coalition exercise is executed through the Estonian Cyber Security Exercises and Training Centre, or 'CR14', Tallinn's latest cyber range supporting NATO Allies and Partners. Training audience and local trainers participate from their respective Nations and entities through virtual networks, and a small exercise control group assembles in Estonia to execute the exercise.

Cyber Coalition Objectives

Cyber Coalition is a collective exercise, rather than competitive, meaning participants work together towards a particular goal, instead of competing to solve problems or achieve specified tasks. Cyber Coalition pursues three key objectives:

  1. Exercise the existing mechanisms for interaction between NATO, Allies and Partners to improve collaboration within the cyberspace domain.
  2. Enhance the Alliance ability to conduct cyberspace operations for military and civilian entities by exercising the development of situational awareness, sharing of cyberspace intelligence, and the conduct of cyber incident management.
  3. Provide input to NATO Cyberspace Transformation by providing a platform to identify capability gaps, training requirements, and validate procedures under development in order to support cyber warfare development and to improve cyber education and training.

Fostering NATO’s Cyber Community

cyber-coalition-01.jpgCyber Coalition includes approximately 1,000 participants from 30 NATO Allies distributed across the globe, several Partners, and the European Union. Cyber Coalition provides a great opportunity for NATO to strengthen its bond in cyberspace at the strategic command level between Allied Command Transformation and Allied Command Operations.

This exercise allows NATO’s Cyberspace Operations Centre the opportunity to develop reporting requirement within cyberspace and examine new tactics, techniques, and procedures. The NATO Communications and Information Agency, the Cooperative Cyber Defence Centre of Excellence, Joint Warfare Centre, Allied Joint Force Command Brunssum, and multiple entities from NATO Headquarters, industry and academia are also involved in the exercise.

Constantly Adapting to the Cyberspace Challenges

NATO Allies bear the primary responsibility for their national cyber defenses, and they have pledged to strengthen their cyber defenses as a matter of priority. NATO is supporting this effort. In 2016 at the Warsaw Summit, NATO recognized cyberspace as a Domain of Operation. Since then, NATO has emphasized improving its operational responses and warfare development through exercises like Cyber Coalition.

The advent of cyber warfare necessitates that we transform policies, strategies, concepts, doctrine, procedures as well as capabilities and human capital to meet current and future challenges. Cyber Coalition provides a platform for warfare and capability development, notably through experimentation. Through these and future efforts, ACT continues to build the bridge to tomorrow in the cyberspace domain of operation.

Executing Cyber Coalition during COVID-19 Pandemic

cyber-coalition-02.jpgFor the first time in 13 years, due to COVID-19 precautionary measures, Cyber Coalition was executed in November 2020 in a virtual environment. Despite the challenges of executing a multinational exercise during the COVID-19 pandemic, participants took part from 25 NATO Allied Nations, 4 Partner Nations and the European Union (The European Union Military Staff and Computer Emergency Response Team for the EU). This included approximately 1000 participants.

Through scenario and storylines (which include critical infrastructure attacks, network intrusion, espionage, insider threat, exfiltration, data manipulation, and more), Cyber Coalition enhanced coordination, collaboration, and information sharing across the NATO Cyberspace Domain. It also provided a framework for Warfare Development, with a particular focus in 2020 on validating the use of an under-development cyberspace situational awareness concept to support decision-making.