NATO Cooperative Cyber Defence

What NATO Cooperative Cyber Defence does

NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) is a NATO-accredited, multinational and interdisciplinary hub of cyber defence expertise, established on 14 May 2008 at the initiative of Estonia and six other founding nations (Germany, Italy, Latvia, Lithuania, Slovak Republic, and Spain) and headquartered in Tallinn, Estonia. It is not a commercial entity: it is staffed and funded by its member nations (39 as of 2025, 42 as of mid-2026 including new members Albania, Finland, and Sweden), operates under the governance of a Steering Committee chaired by the host nation, and is part of the NATO network of accredited Centres of Excellence working under NATO Allied Command Transformation.

Its core products fall into four pillars: (1) Flagship exercises — Locked Shields (the world's largest live-fire cyber defence exercise, running annually since 2010 and reaching 4,000+ participants from 41 nations in 2026) and Crossed Swords (a tactical offensive/defensive cyber operations exercise); (2) Conferences — CyCon, the annual International Conference on Cyber Conflict (18th edition in 2026, ~800 participants from 50 countries); (3) Research publications and tools — the Tallinn Manual series (1.0 in 2013, 2.0 in 2017, 3.0 project launched 2021), the INCYDER cyber security database, the International Cyber Law Interactive Toolkit, the National Cybersecurity Strategy Guide (3rd edition 2025/2026), and the Cyber Commanders Handbook; and (4) Training courses across technical (malware analysis, digital forensics, ICS security, reverse engineering), operational (cyber intelligence, operational planning, CIIP), legal (international law of cyber operations), and strategic (Executive Cyber Seminar) tracks, delivered residentially and via e-learning through national Education & Training Points of Contact in each member nation.

The business model is a subscription-style, government-funded membership structure: Sponsoring Nations (NATO Allies) and Contributing Participants (like-minded non-NATO nations such as Japan, South Korea, Australia, Ukraine, Austria, Ireland, Finland) provide annual contributions and personnel, in exchange for access to research, training, exercises, and conferences. Since January 2018, CCDCOE additionally holds the institutional mandate of Department Head for Cyber Defence Operations Education and Training Discipline within NATO, coordinating cyber defence education and training across all NATO bodies. Customer-facing revenue does not exist in the commercial sense; industry sponsorships (Mattermost, Stamus Networks, NEC, CrowdStrike, Palo Alto Networks, Microsoft, etc.) and academic partnerships (University of Krakow, NUS/NCL, WVU) supplement but do not replace member-nation funding.

Name

NATO Cooperative Cyber Defence

Legal name

NATO Cooperative Cyber Defence Centre of Excellence

Website

https://ccdcoe.org

Company type

Private

Founded year

2008

Operating status

Operating

Headcount range

11–50 employees

Short description

CCDCOE is a NATO-accredited, multinational Centre of Excellence in Tallinn, Estonia, providing cyber defence research, training, exercises, and authoritative publications (notably the Tallinn Manual) to 42 member and partner nations across NATO and beyond.

Ownership category

akta.pro rank

Product category

Cyber Defence Research and Training

NAICS

National Security (928110), International Affairs (92812)

SIC

Services-Educational Services (8200)

akta.pro primary industry

Cyber Defense & Information Security (National Security) (BPAIAHAE)

akta.pro secondary industries

Defense & Security (EDABALAH), Cybersecurity Technical Skills (Security Engineering, SOC, Pen Testing) (EDABAFAF)

Keywords

• Cyber defence training
• Cyber conflict exercises
• International cyber law
• Cyber security research
• Cyber operations exercises

Headquarters

HQ city

Tallinn

HQ country

Estonia

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales

Revenue model

1. Member Nation Funding: CCDCOE is staffed and funded by its member nations. As of 2025, the Centre has grown to bring together 39 member nations, both NATO Allies and like-minded partners beyond the Alliance. Albania, Finland and Sweden joined in May 2026. Funding comes from sponsoring nations (NATO Allies) and contributing participants (like-minded non-NATO nations).

Go-to-market motion2 records

Distribution channels5 records

Marketing channels7 records

Core offering

CCDCOE delivers interdisciplinary cyber defence research, training, and exercises to NATO member nations across four focus areas: technology, strategy, operations, and law. Its core offerings include the world's largest live-fire cyber defence exercise (Locked Shields), the Crossed Swords offensive/defensive operations exercise, the annual CyCon conference, the authoritative Tallinn Manual on international law applicable to cyber operations, technical/operational/legal/strategic training courses, and supporting research tools such as the INCYDER database and International Cyber Law Interactive Toolkit.

Product overview

CCDCOE is a multinational and interdisciplinary hub of cyber defence expertise that operates as a NATO-accredited Centre of Excellence. The organization offers a portfolio of flagship products including Locked Shields (world's largest live-fire cyber defence exercise), Crossed Swords (offensive and defensive cyber operations exercise), and CyCon (annual international conference on cyber conflict). Its research outputs include the Tallinn Manual (authoritative guide on international law and cyber operations), the International Cyber Law Interactive Toolkit, the INCYDER database, and various publications on national cybersecurity strategies and cyber commanders guidance. Training offerings span technical courses (malware analysis, digital forensics, industrial control systems security), operational training (cyber intelligence, operational planning), legal training (international law of cyber operations), and strategic seminars for senior leadership. The organization functions as a research, training, and exercises hub covering technology, strategy, operations, and law disciplines.

Differentiator

Problem solved

Functional benefit

Products and services

• Locked Shields The world's largest and most complex international live-fire cyber defence exercise, hosted annually by CCDCOE since 2010. It simulates realistic large-scale live-fire cyber conflicts, testing participants' technical, operational, and strategic capabilities alongside decision-making under pressure, incorporating legal and communication considerations. Locked Shields 2026 brought together 4,000+ participants from 41 nations.
• Crossed Swords A comprehensive cyber defence exercise that enhances skills of military command elements in managing offensive and defensive cyberspace capabilities, and tactical-level cyber specialists in executing defensive and full-spectrum offensive cyber operations within simulated crisis and conflict environments. Crossed Swords 2024 brought together around 200 participants from 40 countries.
• CyCon - International Conference on Cyber Conflict An annual multidisciplinary conference addressing technical, legal, policy, strategy and military perspectives of cyber defence and security, bringing together decision-makers, opinion-leaders, law and technology experts from governments, military, academia and industry. CyCon 2026 brought together nearly 800 participants from 50 countries with over 100 speakers.
• The Tallinn Manual The most comprehensive guide for policy advisors and legal experts on how existing International Law applies to cyber operations. Tallinn Manual 2.0 is the most comprehensive analysis on how existing international law applies to cyberspace. Distributed by Cambridge University Press in paper and electronic formats.
• Technical Training Courses Residential and e-learning technical training including Malware and Exploit Essentials, IT Systems Attacks and Defence, Introductory Digital Forensics, Industrial Control Systems Security, Reverse Engineering Malware, Exploit Advanced, and Cyber Defence Monitoring courses. Delivered through national E&T POC contacts in each member country.
• Operational Training Courses Operational level training including Integrating Cyberspace Considerations into Operational Planning Course, Critical Information Infrastructure Protection Course, and Cyber Intelligence Course, for military cyber operators and specialists.
• Legal Training Courses International Law of Cyber Operations Course covering the legal framework of NATO cyberspace operations, designed for legal professionals and policy advisors.
• Strategic Level Training (Executive Cyber Seminar) Executive Cyber Seminar designed for senior level staff primarily in NATO and defence who are new to cyber topics.
• INCYDER (International Cyber Security Database) Interactive database featuring the most relevant cyber security documents from major international organisations and articles by CCDCOE researchers on recent trends and developments.
• International Cyber Law Interactive Toolkit A dynamic interactive web-based resource for legal professionals who work with matters at the intersection of international law and cyber operations.
• National Cybersecurity Strategy Guide A practical blueprint supporting national efforts in developing cyber security strategies, co-published with 37 organizations and now in its third edition (2025).
• Cyber Commanders Handbook A practical guide designed to support commanders and decision-makers in understanding, integrating, and employing cyber capabilities within multi-domain operations.

Quantifiable outcome

• Locked Shields is the world's largest live-fire cyber defence exercise, bringing together 4,000 participants from 41 nations in 2026
• +3 more outcomes

Named customers7 records

Segments5 records

Ideal customer profiles5 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

13 partnerships are on record, tiered core.

• NEC CorporationcoreStrategic or Co-development Partner · 23 June 2026NEC Corporation participated in NATO CCDCOE's Locked Shields 2026, cooperating with partner organizations to design and develop the exercise environment for Japan's team, including network and analysis systems, and provided pre-exercise training sessions to ensure effective public-private collaboration.
• University of KrakowcoreStrategic or Co-development Partner · 4 June 2026University of Krakow delivered the mobile forensics challenge for the Digital Forensics and Incident Response (DFIR) track of Locked Shields 2026, bringing strong academic expertise to one of the most demanding evidence domains of the track.
• CyberDefenderscoreStrategic or Co-development Partner · 4 June 2026CyberDefenders delivered a series of DFIR challenges aligned with the Locked Shields 2026 storyline, covering host- and network-based investigation scenarios.
• Hack The BoxcoreStrategic or Co-development Partner · 4 June 2026Hack The Box contributed a series of scenario-driven DFIR challenges, supported by platform-side expertise in exercise content delivery for Locked Shields 2026.
• Hex-RayscoreStrategic or Co-development Partner · 4 June 2026Hex-Rays delivered two storylines focused on malware analysis and reverse engineering for Locked Shields 2026, providing a critical technical uplift for the reverse engineering component.
• ICS RangecoreStrategic or Co-development Partner · 4 June 2026ICS Range delivered two storylines centred on Industrial Control Systems and Operational Technology forensics for Locked Shields 2026, expanding the OT dimension of the exercise.
• National University of Singapore (NUS) and National Cybersecurity R&D Laboratories (NCL)coreStrategic or Co-development Partner · 4 June 2026Longstanding partners of CCDCOE, contributed a storyline based on an airport runway lighting system for Locked Shields 2026, introducing a new critical-infrastructure domain to the forensic track.
• retoolingcoreStrategic or Co-development Partner · 4 June 2026retooling developed the Live Forensics challenge for Locked Shields 2026, bringing a real-life acquisition scenario to the DFIR track, and additionally delivered a dedicated workshop component.
• Security Blue Team LabscoreStrategic or Co-development Partner · 4 June 2026Security Blue Team Labs delivered a series of DFIR challenges aligned with the Locked Shields 2026 storyline, contributing significantly to the depth and breadth of the track.
• Stamus NetworkscoreStrategic or Co-development Partner · 2 June 2026Stamus Networks marked its 10th consecutive year supporting NATO CCDCOE cyber defence exercises including Locked Shields and Crossed Swords. The company has contributed expert personnel, technical training, and advanced network detection capabilities to help participating nations strengthen cyber resilience.
• CyCon 2026 Industry Partners (TrendAI, Palo Alto Networks, Siemens, CrowdStrike, Microsoft, Cloudflare, CybExer, Antisyphon Training, Silent Push, Silobreaker, HWG Sababa, GreyNoise Intelligence, VMRay, Nortal, IEEE)coreStrategic or Co-development Partner · 26 May 2026Industry partners supporting CyCon 2026 conference, contributing to the multidisciplinary forum addressing technical, legal, policy and strategic aspects of cyber defence.
• MattermostcoreStrategic or Co-development Partner · 14 April 2026Mattermost provided sponsorship and active contribution to Locked Shields 2026, developing Digital Forensics and Incident Response challenges for Blue Teams and designing new Strategic Exercise scenarios for national decision-makers.
• NATO Network of Centres of ExcellencecoreStrategic or Co-development PartnerCCDCOE belongs to a network of NATO-accredited Centres of Excellence, collaborating on shared objectives related to NATO transformation and capability development.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• SANS Institute: SANS is the leading private-sector provider of cybersecurity technical training, certifications and exercises (including NetWars). It is the most relevant commercial analogue to CCDCOE's training catalogue and exercise-driven learning model, even though SANS is for-profit and globally distributed.
• CERT Coordination Center (CERT/CC), Carnegie Mellon University: CERT/CC is a federally funded R&D centre focused on cybersecurity research, vulnerability analysis, and incident-handling training. It is comparable to CCDCOE as a research-and-training hub serving governments and critical infrastructure operators.
• European Union Agency for Cybersecurity (ENISA): ENISA is the EU's dedicated cybersecurity agency, providing research, capacity-building, training and exercises for member states. It is the most direct institutional parallel to CCDCOE at the EU level, operating with a similar government-funded, multinational mandate and overlapping scope in cyber exercises and training.

Broad incumbents

• Cybersecurity and Infrastructure Security Agency (CISA): CISA is the US federal lead for civilian cybersecurity, running national exercises (e.g., Cyber Storm), training programmes and guidance. It is a comparable national-level cyber defence and resilience hub serving a wide membership of agencies and operators.
• NATO Communications and Information Agency (NCI Agency): The NCI Agency delivers NATO's operational CIS and cyber capability, including the NATO Cyber Security Centre. It is the operational counterpart inside the NATO Command Structure to CCDCOE's research and training role.
• UK National Cyber Security Centre (NCSC): The UK's NCSC provides authoritative cyber security guidance, training and incident response to government and critical infrastructure. It is comparable as a national-level cyber authority that produces doctrinal guidance and exercises akin to CCDCOE's outputs.

Emerging players

• MITRE Corporation: MITRE operates federally funded R&D centres (FFRDCs) producing widely-adopted cyber frameworks, including ATT&CK. It is comparable to CCDCOE as a research-driven, government-funded organisation whose outputs shape doctrine and tooling across the public and private sectors.
• Global Cyber Alliance (GCA): GCA is a multinational nonprofit building practical cyber risk-reduction toolkits for organisations and governments. It overlaps with CCDCOE in mission (reducing cyber risk at scale) but focuses on deployment of practical tools rather than exercises and doctrinal research.
• Atlantic Council Cyber Statecraft Initiative: The Atlantic Council's Cyber Statecraft Initiative produces policy research, exercises and convenings on cyber defence and international cooperation. It is comparable to CCDCOE's strategy-and-law track as a think-tank-style complement to government cyber institutions.

Others

• CREST International: CREST is an international accreditation body for the cyber security industry, providing standards and assessment for penetration testing, incident response and threat intelligence providers. It is comparable to CCDCOE in shaping the quality bar for cyber defenders globally, though through accreditation rather than direct training.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/ccdcoe
• YouTubeyoutube.com/user/natoccdcoe
• Facebookfacebook.com/ccdcoe
• LinkedInlinkedin.com/company/natoccdcoe

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments1 record

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about NATO Cooperative Cyber Defence