The Optimal Organisational Structure for Cyber Operations Based on Exercise Lessons.




Cyber Command organisational structure, Blue Team organisational structure, Red Team organisational Structure


The NATO Cooperative Cyber Defence Centre (CCDCOE) of Excellence hosts annual Locked Shields (LS) and Crossed Swords (CS) cyber exercises to help NATO nations develop, train, and test their cyber capabilities. These exercises have successfully experimented with cyber capabilities and human organisational structures. However, there are still opportunities to optimise cyber exercise structures. This article employs a use case study based on these exercises to compare structures used by NATO nations in cyber exercises and cyber operations. This identified an optimal structure for operational-level cyber defence and offence exercises and proposed methods for their planning, development, and execution.

Author Biographies

Marko Arik, Tallinn University of Technology

is a PhD student at Taltech Tallinn University of Technology, researching cyberspace operations. He has over 20 years of exemplary service in the Estonian Defence Forces. In positions such as Head of IT Management, Head of CIRC, Head of Cyber-security, and Head of Cyberspace Operations. Mr Arik is also a reserve Military Officer & Cybersecurity Lead continuously involved in participating, planning and executing international Cybersecurity exercises e.g., CX Crossed Swords, Locked Shields etc. Currently in Talgen Cybersecurity Ltd. as a cybersecurity research and development project manager.

Adrian Nicholas Venables, Tallinn University of Technology

served in the UK Royal Navy for over 24 years as a Communications, Warfare, and Intelligence officer. Since leaving the service, he has published a series of journal articles and research papers on the cyber threat landscape and its use by state and non-state actors for espionage, sabotage, and subversion. Dr Venables joined the Tallinn University of Technology in Estonia as a senior researcher in 2018, specializing in cyber strategy and its role in information and influence operations.

Rain Ottis, Tallinn University of Technology

Dr Rain Ottis is the Professor of Cyber Operations at Tallinn University of Technology, Estonia. From 2008 to 2012 he served as a researcher at the NATO Cooperative Cyber Defence Centre of Excellence, where he worked on cyber security in the context of national and international security. Prior to that assignment, he served as a communications officer in the Estonian Defence Forces, focusing primarily on cyber defence training and awareness. His research interests include cyber conflict, national cyber security, cyber defence exercises and the role of serious games in cyber security.