NATO Crossed Swords 2025: AI Agents Enter Cyber Operations Training — What Defenders Must Do Now

The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) has integrated AI agents — including capabilities built on OpenAI's Daybreak — into its Crossed Swords exercise in Estonia, pairing offensive and defensive cyber operations with kinetic military training for the first time at this level of automation. For those of us who have tracked Crossed Swords over the years, this is a meaningful inflection point: NATO is no longer treating AI-augmented cyber operations as a research topic. It is treating them as an operational reality that alliance defenders must train against today.

Crossed Swords has historically been the CCDCOE's technical, hands-on cyber exercise — distinct from the larger, strategy-focused Locked Shields — designed to train red teamers and cyber specialists in realistic operational environments. The introduction of autonomous and semi-autonomous AI agents into the exercise's scenario means alliance nations are now actively rehearsing for adversaries who use machine-speed tooling for reconnaissance, exploitation support, phishing content generation, and defensive decision augmentation. If your SOC's threat model still assumes a human-paced adversary on the other end of the wire, that assumption needs to be retired.

Technical Analysis

What Crossed Swords Actually Is

Crossed Swords, hosted annually by the NATO CCDCOE in Tallinn, Estonia, is a technical cyber operations exercise focused on training cyber specialists and red team members in executing and defending against offensive cyber operations in a combined environment. Unlike tabletop or command-post exercises, Crossed Swords participants operate real tooling against realistic target infrastructure — simulated enterprise networks, operational technology environments, and, increasingly, scenarios that blend cyber effects with kinetic military operations.

What Changed: AI Agents and OpenAI Daybreak

The 2025 iteration introduces two significant elements:

1. AI agents embedded in exercise play. These are software agents capable of autonomously or semi-autonomously executing portions of a cyber operation — task decomposition, tool invocation, target analysis, and iterative decision-making — rather than merely assisting a human operator with one-off queries. In training terms, this compresses the time between reconnaissance and action dramatically.
2. OpenAI Daybreak integration. Daybreak is being used to provide the underlying large language model capability supporting these agents, giving exercise participants a structured way to experiment with LLM-driven workflows inside a controlled, alliance-sanctioned training environment.

Why This Matters to Defenders — Not Just Militaries

There are no CVEs attached to this story, and no specific vulnerability is at play. The risk here is doctrinal, and it cuts both ways:

• Adversary capability parity. Anything NATO trains with in a defensive context, nation-state adversaries are already operationalizing offensively. Russian, Chinese, Iranian, and North Korean operators have all been observed experimenting with or deploying LLM-assisted tooling for phishing, malware development support, reconnaissance summarization, and social engineering at scale. Microsoft and OpenAI's joint reporting on state actors abusing LLMs (including groups tracked as Forest Blizzard, Emerald Sleet, Crimson Sandstorm, and Charcoal Typhoon) confirmed this is not hypothetical.
• Machine-speed attack chains. AI agents collapse dwell time. The classic attack lifecycle — weeks of recon, deliberate lateral movement, patient staging — compresses toward hours or minutes when agents can enumerate, prioritize, and act continuously. Detection windows shrink proportionally.
• Defense must automate or lose. The same agentic approaches being trained at Crossed Swords are directly applicable to SOC triage, alert enrichment, threat hunting, and containment orchestration. The exercise validates that defenders who do not adopt AI-augmented workflows will be outpaced.

Exploitation Status

This is a training and capability-development story, not a vulnerability disclosure. There is no in-the-wild exploit, no PoC, and no CISA KEV entry associated with this news. The present-day relevance is strategic: the alliance is institutionalizing AI-in-the-loop cyber operations, which means your threat model, detection engineering, and response playbooks must account for AI-accelerated adversary behavior starting now.

Executive Takeaways

Because this is a capability and doctrine development rather than a discrete technical threat with observable indicators, the correct response is organizational rather than rule-based. Fabricating detection rules against unnamed adversary AI tooling would produce noise, not signal. Instead, focus on these defensive priorities:

1. Update your threat model to assume AI-accelerated adversaries. Review your detection coverage against the assumption that reconnaissance-to-impact timelines are compressing. Prioritize detections that fire early in the kill chain — initial access, credential access, and discovery — because late-stage detection may arrive too late against machine-speed operators.

2. Adopt AI-assisted SOC workflows deliberately, with guardrails. Use AI for alert summarization, triage prioritization, query generation, and report drafting — but keep humans authoritative for containment actions, blocking decisions, and legal/compliance-sensitive determinations. Establish written policy on which decisions AI may recommend versus execute.

3. Harden against LLM-enhanced social engineering. AI-generated phishing is grammatically flawless, personalized at scale, and multilingual. Shift user awareness training away from 'spot the typos' toward verification of out-of-band channels for financial requests, credential entry, and unusual instructions. Enforce phishing-resistant MFA (FIDO2/passkeys) for privileged and remote access.

4. Instrument your own environment for behavioral detection, not IOC-chasing. Machine-speed adversaries will burn indicators faster than threat intel feeds can publish them. Invest in detections anchored to durable behaviors — anomalous authentication patterns, unusual parent-child process relationships, abnormal data staging volumes — which remain effective regardless of how quickly an agent iterates its tooling.

5. Run AI-augmented adversary emulation in your own exercises. Follow NATO's lead at organizational scale: incorporate LLM-assisted red team tooling into purple team exercises to measure how your SOC performs against faster, higher-volume attack sequences. Measure time-to-detect and time-to-contain under compressed scenarios, and set explicit improvement targets.

6. Establish AI usage governance before an incident forces it. Define acceptable use policies for AI tools within security operations, data-handling rules for what may be submitted to external models, and procurement review for AI-enabled security products. The organizations absorbing these lessons from NATO's training environment now will avoid improvising policy mid-incident later.

Remediation

There is no patch, workaround, or vendor advisory associated with this news — remediation here is programmatic:

• Near term (30 days): Review SOC alert triage workflows for AI-assist opportunities; validate MFA coverage on all remote and privileged access; refresh phishing training content to address AI-generated lures.
• Medium term (90 days): Draft and ratify AI usage governance for the security organization; benchmark time-to-detect metrics; evaluate one AI-assisted triage or enrichment capability in a bounded pilot with human-in-the-loop approval.
• Long term (ongoing): Integrate AI-accelerated adversary scenarios into annual purple team exercises; track CCDCOE and allied exercise outputs (Crossed Swords, Locked Shields) as leading indicators of where adversary doctrine is heading.

Monitor the NATO CCDCOE's published research and exercise after-action reporting at ccdcoe.org, and track OpenAI and Microsoft threat intelligence publications on state actor abuse of AI platforms for concrete, current TTPs as they are disclosed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub