RL Joins NATO Locked Shields Cyber Event: 3 Takeaways
ReversingLabs joined defensive teams with its malware analysis platform. Here are key lessons.
For two punishing days in late April, cyber defenders from 41 nations huddled in front of screens around the globe, repelling waves of simulated attacks against fictional national infrastructure. The occasion: Locked Shields 2026, NATO's annual live-fire cyber exercise — and the largest of its kind in the world. ReversingLabs (RL) was proud to be a part of it.
This year's exercise marked a milestone for the Republic of Croatia and the Republic of North Macedonia, which fielded a joint Blue Team for the first time under the leadership of Croatia's Ministry of Defense (MORH). It also marked a milestone for RL, which deployed four of its top experts and its Spectra Analyze malware analysis platform in support of the joint team— alongside industry partners ExtraHop Networks, Inc. and Forescout Technologies, Inc.
Here’s what you need to know about Locked Shields 2026 — and three key lessons to carry forward.
A Brief History of Locked Shields
Held annually since 2010 by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia, Locked Shields has evolved rapidly in recent years. Just four nations and about 60 participants took part in the inaugural event. By 2026, Locked Shields had grown to bring together more than 4,000 participants from 41 NATO Allied and partner nations. They included cyber defenders, legal experts, strategists, and communicators charged with defending thousands of virtual systems against a relentless stream of attacks.
What sets Locked Shields apart from a typical capture-the-flag is its realism. Blue Teams don't just face technical exploits, they wrestle with strategic decision-making, forensic analysis, legal questions, public communications, and coordinated incident response — all at wartime tempo. Each year, the exercise incorporates new domains: cloud, operational technology, AI-enabled attacks, even quantum computing concepts in this year's Strategic Decision-Making track.
A Tough — and Telling — Debut
The first day was, by every measure, brutal. NATO's Red Team launched hundreds of attacks against the Croatia–North Macedonia Blue Team in just eight hours, with many reaching their targets. Like defenders in real world incidents, the Blue Team was challenged to quickly orient themselves and triage the victims of the red team attacks, while also battling new attacks and fighting to keep critical systems and infrastructure functioning.
"It felt like ‘two steps forward, one step back’ at times, said Hrvoje Samardžić, a threat intelligence researcher at RL who took part in the exercise and served on the Reporting and CTI team. "As one case was solved, three new ones were being opened."
