National Cyber Drills: Ukraine's NATO-Linked Exercises

Cyber exercises serve as laboratories for testing defensive procedures, identifying organizational weaknesses, and training responders to react effectively under stress. Ukraine's integration into the broader NATO cyber exercise ecosystem—combined with bilateral exercises with key partners and national-level drills across critical infrastructure sectors—has created a training infrastructure that directly enhances real operational response. The unique feature of Ukraine's cyber exercise program is that its participants face live cyber threats daily, making exercise scenarios grounded in current threat intelligence rather than hypothetical.

NATO Cyber Coalition

NATO's annual Cyber Coalition exercise is the alliance's largest cyber defense exercise, involving hundreds of participants across NATO member and partner nations. Ukraine has participated in Cyber Coalition as an enhanced partner nation, contributing its operational experience with Russian cyber tactics to exercise scenario design while developing its own capabilities through interaction with NATO cyber defense organizations. Ukraine's participation predates the 2022 full-scale invasion but has intensified afterward as Ukraine's cyber threat experience became directly relevant to alliance-wide defensive planning.

The Cyber Coalition exercises are conducted primarily in a dedicated cyber range environment that simulates networks representing various critical infrastructure and military communication systems. Participants practice detecting and responding to sophisticated attack scenarios that draw from real attack techniques documented across NATO and partner nations—scenarios that Ukrainian CERT-UA analysts recognize from their daily operational work.

Bilateral US-Ukraine Cyber Drills

The US-Ukraine cybersecurity partnership extends to exercises conducted bilaterally between US Cyber Command and Ukrainian military cyber organizations, and between CISA and Ukraine's State Service of Special Communications. These bilateral drills focus on interoperability between US and Ukrainian incident response procedures, joint threat intelligence sharing protocols, and coordinated response to scenarios affecting systems in both countries. The exercises typically include classified components reflecting the operational sensitivity of the techniques and threat intelligence shared.

US support for Ukrainian cyber exercise programs has included providing access to advanced cyber range environments, seconding experienced exercise planners, and funding tabletop exercises for Ukrainian critical infrastructure operators through CISA's Ukraine engagement programs. Exercise after-action reports feed into US assessments of Ukraine's cyber defense maturity and inform subsequent capacity building investments.

ENISA CyberEurope Exercises

The European Union Agency for Cybersecurity (ENISA) conducts CyberEurope exercises involving EU member states and associated countries. Ukraine's integration into European cyber exercises has advanced through the EU-Ukraine cybersecurity partnership formalized in 2022. These exercises focus on EU network and information security frameworks applicable to critical infrastructure and provide Ukraine's agencies with exposure to European standards for incident reporting and cross-border coordination.

Major Cyber Exercises Involving Ukraine

Locked Shields: The World's Largest Live-Fire Cyber Defense Exercise

NATO CCDCOE's Locked Shields is considered the world's largest and most technically complex live-fire cyber defense exercise, conducted annually in Tallinn. Participating teams defend identical virtualized infrastructure against a red team operating advanced attack techniques. Ukraine has participated as a full team competing against other national teams, with Ukrainian cyber experts bringing real-world experience defending against state-sponsored attackers that is unmatched by teams from countries not facing active hostilities.

Ukraine's Locked Shields participation results have been closely watched as an indicator of operational capability development. The exercise findings feed into capacity building priorities and have demonstrated that Ukrainian teams, while possessing exceptional threat recognition skills from operational experience, identified consistent needs for process standardization, documentation discipline, and formal incident management procedures—areas where training program investments have subsequently been directed.

Exercise Outcomes and Real Operations Integration

Ukraine's unique position in participating in cyber exercises while simultaneously conducting live cyber defense operations creates a feedback loop that most national cyber teams lack: exercise techniques are immediately testable in real conditions, and real operational lessons are immediately available for exercise scenario enrichment. CERT-UA analysts have noted that certain attack patterns first encountered in exercise scenarios were subsequently observed in real attacks within months—suggesting that exercise threat intelligence has genuine predictive value.

FAQ

What is the Locked Shields exercise format?

Locked Shields deploys teams to defend complex networks including enterprise IT systems, industrial control systems, and military communication simulations. Each blue team defends against a centralized red team that conducts escalating attacks over two days. Teams are scored on detecting attacks, maintaining system availability, and completing strategic decision-making tasks. The exercise involves hundreds of virtual machines per team.

Has Ukraine won or placed highly in NATO cyber exercises?

Ukrainian teams have performed competitively in Locked Shields and Cyber Coalition exercises. While official rankings are not always publicly disclosed, Ukraine's teams have been noted for exceptional threat detection performance attributed to their operational experience recognizing real-world Russian tactics. Areas for improvement typically involve formal incident management procedures and documentation.

How does Ukraine use exercise after-action reports?

After-action reports from exercises are used to identify specific capability gaps, update standard operating procedures, inform training curriculum for new cyber personnel, and prioritize technology investments. The Ukrainian SSSCIP uses exercise findings to brief the National Security and Defense Council on cyber defense maturity and justify budget requests.

Do exercise partners share threat intelligence during drills?

Yes. Bilateral and multilateral cyber exercises routinely include controlled sharing of threat intelligence on current attack techniques—often including classified information under appropriate handling procedures. This intelligence sharing during exercises is one of the primary mechanisms through which Ukraine's partners have transferred knowledge about adversary techniques, tools, and procedures.

What exercises focus specifically on critical infrastructure protection?

Locked Shields specifically includes industrial control system defense scenarios. Bilateral CISA-Ukraine exercises have included energy sector critical infrastructure tabletops. Ukrainian national exercises conducted by SSSCIP have focused specifically on energy, water, and financial sector incident response—directly relevant to the sectors that have been targeted in actual Russian operations.

Sources

1. NATO CCDCOE — "Locked Shields Exercise Overview," ccdcoe.org 2023-2024
2. ENISA — "CyberEurope 2024 Exercise Report," enisa.europa.eu
3. NATO — "Cyber Coalition Exercise Fact Sheet," nato.int
4. CISA — "Ukraine Cybersecurity Cooperation Programs," cisa.gov 2023
5. Ukrainian SSSCIP — "Annual Report on National Cyber Defense Exercises," 2023