Key Takeaways
- Cyber Fortress 26 was a joint, interagency, intergovernmental, multinational exercise hosted by the Virginia Army National Guard’s 91st Cyber Brigade from July 25 to August 8, 2026, at the State Military Reservation in Virginia Beach.
- The exercise had two lines of effort: (1) recertifying two cyber protection teams and validating one battalion headquarters, and (2) conducting a domestic‑operations cyber incident response focused on hydroelectricity.
- South Carolina’s 125th Cyber Protection Battalion was validated, while California’s Cyber Protection Team 171 and Ohio’s Cyber Protection Team 172 were recertified; the brigade’s footprint spans 31 states with headquarters in Virginia, South Carolina, Massachusetts, and Indiana.
- Participants included Active, Reserve, and National Guard components, NATO allies (Finland and Estonia), federal agencies (FBI, FERC, CISA), state and local entities, and private‑industry partners.
- CISA played a pivotal role by designing and facilitating a cyber incident response tabletop exercise, supplying red‑team and white‑cell personnel, and collaborating with the brigade’s intelligence section and the Virginia Fusion Center to create realistic injects.
- Week 1 emphasized training in operational‑technology defense (ICS/SCADA), cyber threat intelligence, malware analysis, and electrical systems, highlighted by a Distinguished Visitors Day featuring capability briefs and helicopter‑borne air movement of cyber operators.
- Week 2 featured a force‑on‑force cyber engagement where integrated Blue teams performed incident response, threat analysis, and defensive cyber operations against a dedicated Red team emulating multiple threat actors in a realistic critical‑infrastructure network.
- Exercise leaders praised the seamless coordination among staff and partners, noting the Persistent Cyber Training Environment’s reliability and the overall effectiveness of the training.
- Cyber Fortress 26 stands as one of the nation’s premier whole‑of‑government cyber exercises and remains the only Army National Guard cyberspace‑operations event that includes formal capability certification or re‑certification.
Overview of Cyber Fortress 26
The Virginia Army National Guard’s 91st Cyber Brigade hosted Cyber Fortress 26, a joint, interagency, intergovernmental, multinational exercise, from July 25 through August 8, 2026, at the State Military Reservation in Virginia Beach. This iteration marked the fifth consecutive year of the exercise, which has grown to become a cornerstone of the Army National Guard’s cyberspace readiness portfolio. Col. Gerald Mazur, commander of the Fort Belvoir‑based 91st Cyber Brigade, highlighted the event’s success, noting that it represented the best execution of Cyber Fortress to date. The exercise’s design combined certification activities with a large‑scale domestic‑operations scenario, allowing participants to sharpen both individual team proficiencies and collective incident‑response capabilities. By bringing together a diverse array of military, governmental, and private‑sector partners, Cyber Fortress 26 aimed to replicate the complex, multi‑domain challenges posed by significant cyber threats to critical infrastructure and key resources.
Commander Mazur’s Two Lines of Effort
Col. Mazur explained that Cyber Fortress 26 was structured around two distinct lines of effort. The first line focused on the recertification of two cyber protection teams and the validation of one battalion headquarters, ensuring that the units met Army standards for cyber space operations readiness. The second line centered on a domestic‑operations exercise designed to test a whole‑of‑government response to a simulated cyber incident targeting critical infrastructure. This dual‑approach allowed the brigade to simultaneously validate individual team competencies while exercising coordinated defensive cyber operations across multiple echelons and sectors. Mazur emphasized that the 91st Cyber Brigade remains the only deployable cyber space operations capability within the United States Army, giving it a unique responsibility to maintain readiness for both federal and state missions.
Certification and Validation Outcomes
During the exercise, the South Carolina National Guard’s 125th Cyber Protection Battalion successfully achieved validation status, demonstrating its ability to conduct full‑spectrum cyber protection missions. Meanwhile, the California National Guard’s Cyber Protection Team 171 and the Ohio National Guard’s Cyber Protection Team 172 were recertified, confirming their continued proficiency in defensive and offensive cyber tasks. The 91st Cyber Brigade’s footprint extends across 31 states, with battalion headquarters located in Virginia, South Carolina, Massachusetts, and Indiana, providing a broad geographic reach for cyber support. These certification outcomes not only affirm the tactical readiness of the participating units but also reinforce the brigade’s role as a national‑level cyber readiness hub capable of deploying teams wherever needed.
Domestic‑Operations Exercise Focus
The second line of effort involved a domestic‑operations exercise that simulated a cyber attack on hydroelectric infrastructure, a sector chosen for its strategic importance to national energy resilience. Participants from Active, Reserve, and National Guard components, alongside NATO partners, federal agencies, state and local authorities, and private‑industry representatives, collaborated to respond to the scenario. The exercise leveraged the Persistent Cyber Training Environment (PCTE), a reliable platform that facilitated realistic network emulation and allowed for seamless integration of live, virtual, and constructive elements. Col. David Garner, commander of the Fairfax‑based Information Operations Support Center and exercise director, praised the PCTE team’s support from concept design through range execution, describing it as “nothing less outstanding.” This technological foundation enabled participants to practice incident‑response procedures, threat‑hunting, and defensive cyber operations in a controlled yet realistic setting.
Participant Roster and International Involvement
Cyber Fortress 26 attracted a wide array of stakeholders, underscoring its whole‑of‑government nature. Domestic participants included the Virginia Department of Emergency Management, Virginia State Police, Virginia Defense Force, Virginia Fusion Center, the Federal Bureau of Investigation, the Federal Energy Regulatory Commission, and the Cybersecurity and Infrastructure Security Agency (CISA). Military contributors spanned the Air National Guard, the U.S. Army Reserve, and the U.S. Marine Corps. International cyber personnel from Finland and Estonia also took part, providing allied perspectives on cyber defense and fostering interoperability. The inclusion of such a diverse group ensured that the exercise addressed not only technical aspects of cyber defense but also the policy, legal, and coordination challenges inherent in responding to a large‑scale cyber incident affecting critical infrastructure.
Collaboration with CISA
A notable aspect of Cyber Fortress 26 was the close partnership with the Cybersecurity and Infrastructure Security Agency. CISA developed and facilitated a cyber incident response tabletop exercise that engaged multiple state and federal partners, supplied members to serve on the red team and white cell, and worked closely with the 91st Cyber Brigade’s intelligence section and the Virginia Fusion Center to create realistic injects. These injects—scripted events designed to challenge participants’ decision‑making processes—added depth and authenticity to the exercise, forcing teams to adapt to evolving threats and unforeseen complications. Garner highlighted that this collaboration enhanced the exercise’s realism and allowed participants to practice the full spectrum of cyber incident response, from detection and analysis to containment and recovery, within a coordinated interagency framework.
Week‑One Training Activities
The first week of Cyber Fortress 26 concentrated on foundational training across several cyber‑defense disciplines. Soldiers and civilian partners received instruction in the cyber defense of operational technology, with a particular focus on Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems that underpin hydroelectric facilities. Additional modules covered cyber threat intelligence gathering and analysis, malware reverse‑engineering, and the fundamentals of electrical systems relevant to critical infrastructure. A highlight of the week was Distinguished Visitors Day, which featured capability briefings from senior leaders, a tabletop exercise that walked participants through a simulated cyber incident, and an air movement of cyber operators via helicopters from the Virginia National Guard’s 2nd Battalion, 224th Aviation Regiment. This day provided senior officials with a firsthand view of the brigade’s capabilities and underscored the integration of aviation support into cyber operations.
Week‑Two Force‑On‑Force Engagement
Week 2 transitioned to a force‑on‑force cyber engagement designed to test incident‑response capabilities under contested conditions. Participants were organized into integrated Blue teams responsible for detecting, analyzing, and mitigating cyber threats, while a dedicated Red team emulated multiple threat actors operating within a realistic critical‑infrastructure enterprise network. The Blue teams performed incident response, conducted threat analysis, and executed defensive cyber operations, all while maintaining communication and coordination with their civilian and interagency partners. The Red team’s tactics, techniques, and procedures were calibrated to reflect advanced persistent threats, thereby providing a stringent test of the Blue teams’ resilience and adaptability. Garner expressed satisfaction with the seamless cooperation among staff and partners, noting that the exercise successfully produced a “fantastic training environment” that prepared participants for real‑world cyber contingencies.
Closing Assessment and Unique Role
In his closing remarks, Col. Garner affirmed that Cyber Fortress 26 achieved its objectives of validating unit capabilities, enhancing interoperability, and delivering a high‑fidelity training experience for a whole‑of‑government audience. He emphasized that the exercise remains one of the nation’s premier military‑focused cyber events, specifically designed to address significant cyber threats impacting critical infrastructure and key resources. Importantly, Cyber Fortress is the only Army National Guard cyberspace‑operations exercise that incorporates formal capability certification or re‑certification, ensuring that participating teams meet rigorous Army standards while simultaneously engaging in large‑scale, joint incident‑response training. This unique blend of certification and operational exercise positions the 91st Cyber Brigade as a critical asset for both state and federal cyber defense missions, ready to deploy cyber protection teams wherever they are needed to safeguard the nation’s essential systems.