CAMP AGUINALDO, Philippines – In a 21st-century conflict, sophisticated missile systems aren’t the only capability that can cripple a nation’s infrastructure, a keyboard can be just as effective. Recognizing the existential threat that cyber-attacks pose to both military readiness and civilian stability, Balikatan 2026 placed a multinational emphasis on cybersecurity with a cyber defense exercise, April 23 to May 8.
At the center of this modernized defense strategy, the U.S. Indo-Pacific Command J7 Pacific Multi-Domain Training and Experimentation Capability provided a Deployable Cyber Range to simulate a highly realistic environment to train cyber defenders from the Philippines, Australia, Canada, France, Japan, New Zealand and the U.S.
For the first time during Balikatan, a live opposing force of cyber operators used the DCR to launch simulated attacks against the combined force’s networks, allowing cyber defenders from seven nations to practice identifying, mitigating and responding to sophisticated threats in a secure environment without risking operational networks.
“It gives the players an environment where they can experience a cyber-attack,” said U.S. Air Force Senior Master Sgt. Mark Savares, 293rd Combat Communications Squadron, Guam Air National Guard. “They're able to go in, do an assessment, establish a baseline of what has happened and then come up with possible courses of action for mitigation.”
This year’s Cyber Defense Exercise, or CYDEX, is the culmination of a multi-year effort to deepen cyber integration. According to U.S. Army Maj. Plamin Rabino, J6 chief information officer of the Guam National Guard, the exercise has evolved dramatically.
“In 2023, our focus was on individual cyber training, which was largely isolated from the Command Post Exercise,” said Rabino. “By 2025, we achieved full integration of the Cyber Defense Operations Center with the Joint Task Force, and now in 2026, we have robust multinational partner participation. This progression reflects the acceptance of a whole-of-government approach in defending cyberspace in the first island chain.”
During the exercise, multinational teams were assigned to defend various simulated critical infrastructure networks—from power stations and water plants to telecommunications companies and military air operations centers. Using the DCR, a live “opposition force team” launched a variety of attacks, including ransomware and active reconnaissance where they planted viruses for later use.
U.S. Army Capt. Elijah Clark, 1st Multi-Domain Task Force, led Blue Team 6. One of their missions was to protect the Air Operations Center at Camp Aguinaldo. “We use the open-source, industry-standard ‘MITRE ATT&CK’ framework that outlines typical cyber actor TTPs [tactics, techniques and procedures] during the CYDEX. This methodology is helpful for a common language when working through a problem-set in a multi-national environment,” said Clark.
Blue Team 6 tracked attackers as they moved through the network, geo-locating IP addresses from around the world. Their mission was clear, “Making sure the network is secure from any potential malicious cyber actors,” said Clark.
The DCR provided a realistic cyber environment in which to hunt those malicious actors. That realism provided a high level of training value, according to Sean McDermott, USINDOPACOM, J7 Joint Training and Exercises, cyber ops planner.
Unlike clean, sterile network environments, the DCR generates a massive amount of simulated user traffic, creating digital “noise” that defenders must learn to navigate.
“That is representative of a real network,” said McDermott. “It's a cyber city running, so you get tens of thousands of users’ traffic flowing across that. You have noise that the adversary could hide in.”
This realistic, multinational, hands-on training provided invaluable learning opportunities.
“I’ve been able to expand my skill set, being exposed to different ways of looking at things,” said New Zealand Army Lance Cpl. Liam Van Der Mespel of the 1st Command Support Regiment. “Learning from other people on the team, how they interpret information and how they apply that information ... I’ve been able to expand my tool set as well.”
According to Rabino, the J7 PMTEC-supplied DCR was the critical enabler that allowed the exercise to scale to this level of complexity. He noted that the DCR has significant advantages over other training platforms.
“The DCR allowed us to scale up our exercise while minimizing technical and logistical requirements,” said Rabino. “We have experienced cyber range engineers provided, so our cyber warfighters can focus on responding to cyber injects rather than operating and maintaining the range.”
He contrasted this with other systems that require participants to engineer the range themselves, taking time away from training, or have lengthy vetting processes for multinational partners. “The DCR can provide access on the spot,” Rabino said.
This ease of access and focus on training has had a direct strategic impact and fostered multinational cooperation.
“We’ve strengthened relationships with government and critical infrastructure partners, uniting efforts on defending mission-critical capabilities of multinational partners,” said Rabino. This collaborative approach has contributed to force structure changes, including the activation of the Armed Forces of the Philippines Cyber Command and the AFP Reserve Cyber Battalion.
As a cornerstone of the Pacific Deterrence Initiative, PMTEC is helping to build credible, combat-ready forces capable of ensuring a free and open Indo-Pacific. By providing a realistic adversary and harnessing cutting-edge technology to link coalition networks, PMTEC enables cohesive, all-domain exercises. The Balikatan 26 CYDEX stands as a model for the future of multinational cyber training, demonstrating the power of realistic, collaborative defense in the face of ever-evolving threats.
Balikatan is a longstanding annual exercise between the Armed Forces of the Philippines and U.S. military that represents the strength of our alliance, improves our capable combined force, and demonstrates our commitment to regional peace and prosperity.