Surviving Locked Shields 2026: Notes from the ThreatHunters Team

Sat, 25 Apr 2026 12:00:00 +0300

Recently, I had the chance to participate in Locked Shields 2026 — organized annually by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) and known as the world’s largest live-fire cyber defense exercise.

During the exercise, allied nations defend realistic simulated critical infrastructure against continuous attacks from a live Red Team.

My Role: Blue Team 04 (Lithuania – Japan)

I was embedded with the ThreatHunters sub-team within Blue Team 04, a joint team of Lithuanian and Japanese specialists.

Coming primarily from an offensive security and penetration testing background, joining a threat hunting unit was a great experience:

Looking at contested networks through an attacker’s lens helps anticipate how adversary footholds are established and moved.
The pace was fast, the pressure was real, and coordinating in real time with our counterparts from Japan was a highlight of the exercise.

Surviving the chaos, learning from top-tier practitioners, and proving that an offensive mindset is just as critical for defense made it an incredible week.

Looking forward to the next one! ✌️

Threat-Hunting on Giedrius Bagaliūnas

Surviving Locked Shields 2026: Notes from the ThreatHunters Team

My Role: Blue Team 04 (Lithuania – Japan)