Key Takeaways
- Cyber Fortress 26, hosted by the Virginia Army National Guard’s 91st Cyber Brigade, was a joint, interagency, intergovernmental and multinational exercise held July 25 – Aug 8 2026 at the State Military Reservation in Virginia Beach.
- The exercise combined two lines of effort: (1) recertification/validation of cyber protection teams and a battalion headquarters, and (2) a domestic operations scenario focused on defending hydroelectric‑generation infrastructure against cyber threats.
- Participants included Active Duty, Reserve, and National Guard components of the U.S. military, NATO allies (Finland, Estonia), federal agencies (FBI, FERC, CISA), state and local entities, the Virginia Defense Force, and private‑industry partners.
- The Persistent Cyber Training Environment (PCTE) served as the reliable cyber range platform, enabling realistic red‑team/blue‑team force‑on‑force engagements and tabletop incident‑response exercises.
- Distinguished Visitors Day highlighted capability briefings, helicopter‑borne cyber‑operator movements, and collaborative training on operational‑technology security, threat intelligence, malware analysis, and electrical systems.
- Cyber Fortress remains the nation’s premier Army National Guard cyberspace‑operations exercise that integrates capability certification with a whole‑of‑government response to critical‑infrastructure cyber incidents.
Exercise Overview and Objectives
Cyber Fortress 26 represented the fifth iteration of the Virginia Army National Guard’s flagship cyber exercise, designed to test and validate the Army National Guard’s deployable cyberspace‑operations capability while fostering a whole‑of‑government approach to defending critical infrastructure. Col. Gerald Mazur, commander of the 91st Cyber Brigade, emphasized that the exercise achieved its highest level of effectiveness to date, citing seamless integration of military, civilian, and international partners. The dual‑track structure—certification of cyber protection teams and a realistic domestic operations scenario—allowed the brigade to simultaneously assess unit readiness and evaluate collaborative incident‑response processes across a broad stakeholder base.
Certification and Validation Efforts
The first line of effort concentrated on the recertification of two cyber protection teams and the validation of a battalion headquarters. Specifically, the South Carolina National Guard’s 125th Cyber Protection Battalion received validation, while the California National Guard’s Cyber Protection Team 171 and the Ohio National Guard’s Cyber Protection Team 172 were formally recertified. This process ensured that these units met the Army’s stringent standards for cyber protection, including proficiency in defensive cyber operations, threat hunting, and incident response. Col. Mazur noted that the 91st Cyber Brigade remains the only deployable cyberspace‑operations capability within the United States Army, with a footprint extending across 31 states and headquarters in Virginia, South Carolina, Massachusetts, and Indiana.
Domestic Operations Scenario Focused on Hydroelectricity
The second line of effort constituted a domestic operations exercise that simulated a cyber incident affecting hydroelectric‑generation facilities. By centering the scenario on hydroelectricity, the exercise addressed a vital segment of the nation’s energy infrastructure that relies heavily on operational technology (OT) and supervisory control and data acquisition (SCADA) systems. Participants were tasked with detecting, analyzing, and mitigating cyber threats that could disrupt power generation, damage equipment, or jeopardize public safety. The hydroelectric focus allowed planners to inject realistic technical challenges, such as compromised programmable logic controllers and manipulated sensor data, thereby testing both IT and OT defense mechanisms in an integrated fashion.
Participant Coalition and Interagency Coordination
Cyber Fortress 26 brought together a diverse coalition of actors, reflecting the whole‑of‑government mandate. U.S. military components included Active Duty, Reserve, and National Guard elements from the Army, Marine Corps, and Air National Guard, as well as the U.S. Army Reserve. International participation featured cyber personnel from Finland and Estonia, underscoring NATO collaboration. Federal agencies represented were the Federal Bureau of Investigation, Federal Energy Regulatory Commission, Cybersecurity and Infrastructure Security Agency, and the Virginia Fusion Center. State and local contributors comprised the Virginia Department of Emergency Management, Virginia State Police, Virginia Defense Force, and various municipal emergency‑management bodies. Private‑industry partners from the energy sector and technology firms also engaged, providing expertise on OT security and real‑world threat intelligence.
Role of the Persistent Cyber Training Environment
Col. David Garner, commander of the 91st Cyber Brigade’s Information Operations Support Center and exercise director, highlighted the pivotal role of the Persistent Cyber Training Environment (PCTE) in delivering a reliable and scalable cyber range. The PCTE platform enabled the creation of a realistic, persistent network that mimicked a critical‑infrastructure enterprise, complete with segmented IT and OT zones, firewalls, intrusion‑detection systems, and simulated SCADA processes. Garner praised the PCTE team’s support from concept design through range execution, noting that their responsiveness and technical expertise were “nothing less than outstanding.” This robust environment facilitated both the tabletop exercise led by CISA and the subsequent force‑on‑force cyber engagements.
First‑Week Activities: Training and Distinguished Visitors Day
During the initial week, participants received focused instruction on cyber defense of operational technology, including hands‑on modules for industrial control systems, SCADA architecture, and associated cyber‑threat landscapes. Complementary training covered cyber threat intelligence gathering, malware reverse‑engineering, and fundamentals of electrical systems relevant to hydroelectric plants. A hallmark of the week was Distinguished Visitors Day, which featured senior‑leader capability briefings, a collaborative tabletop exercise, and an air‑movement demonstration wherein cyber operators were transported aboard UH‑60 Black Hawk helicopters from the Virginia National Guard’s 2nd Battalion, 224th Aviation Regiment. These activities underscored the exercise’s emphasis on integrating cyber operations with traditional maneuver capabilities and fostering relationships between military leaders and civilian partners.
Second‑Week Force‑on‑Force Cyber Engagement
The second week transitioned to a force‑on‑force cyber exercise that pitted dedicated Red teams—emulating multiple threat actors—against integrated Blue teams tasked with incident response, threat analysis, and defensive cyber operations. The scenario unfolded within a realistic critical‑infrastructure enterprise network, requiring Blue teams to detect intrusions, isolate compromised devices, conduct forensic analysis, and implement mitigation strategies while maintaining essential hydroelectric functions. Throughout the engagement, White‑cell controllers injected additional events (e.g., ransomware notices, insider‑threat alerts) to increase complexity and test decision‑making under pressure. Col. Garner expressed satisfaction with the seamless cooperation among staff and partners, which produced a “fantastic training environment” for all participants.
Impact and Significance of Cyber Fortress 26
Cyber Fortress 26 reaffirmed its status as one of the nation’s premier military exercises focused on a whole‑of‑government response to significant cyber threats affecting critical infrastructure and key resources. Notably, it remains the only Army National Guard cyberspace‑operations exercise that incorporates capability certification or recertification alongside a large‑scale, interagency incident‑response drill. By validating cyber protection teams, testing battalion‑level command and control, and exercising coordinated defenses against a hydroelectric‑centric cyberattack, the exercise generated actionable lessons for improving readiness, enhancing interoperability, and strengthening the resilience of the nation’s energy sector. The successful execution of Cyber Fortress 26 demonstrates the Virginia Army National Guard’s 91st Cyber Brigade’s ability to lead complex, multinational cyber training events that directly support national security objectives.