TALLINN, Estonia – More than 40 Maryland National Guard members participated in Immediate Response 2026, a comprehensive cyber exercise, with their Estonian counterparts at Foundation Cyber Range 14 (CR14), May 16-23, 2026.
The exercise is part of Sword 26, U.S. Army Europe and Africa's (USAREUR-AF) premier annual exercise series, which takes place from late April through May 2026 across eight countries in the High North and Baltic region. Along with the Estonian Defense Forces, Immediate Response 2026 hosted participants from the Maryland Army National Guard’s Cyber Protection Team 169, the Maryland Air National Guard’s 175th Cyberspace Operations Group, and members of the U.S. Army's Information Dominance Company, Multi-Domain Command-Europe.
The intent of the exercise is to strengthen bilateral training between U.S. and Estonian cyber forces, share tactics, techniques, and procedures, and give participants the chance to plan, analyze, and carry out operations in a realistic, simulated environment. The Maryland National Guard has been a partner with Estonia since 1993, through the National Guard Bureau’s State Partnership Program.
To make the pressure realistic, opposing teams faced off in a highly dynamic environment with controlled objectives and outcomes. The exercise pitted an Adversary Emulation Force against a Network Defense Force. In the cyber world, these units are traditionally known as the "red team," the aggressors actively attempting to breach and degrade the network, and the "blue team," the sentinels continuously hunting threats and protecting the system.
Adding to the authenticity, the physical layout of the exercise mirrored actual operations. While the Network Defense Force operated out of a centralized primary location, the Adversary Emulation Force was intentionally dispersed across multiple off-site locations.
"In the real world, you're not just sitting at your desk next to the adversaries while they tell you what their plan is," said Maryland Air National Guard Maj. Wesley Smith, a cyber operations officer with the 175th Cyberspace Operations Group. "You don't know where they are or when they'll carry out an effort to compromise critical infrastructures that need to remain protected, and we wanted that to be a key understanding in this exercise."
Because of this physical separation and the dynamic environment, defenders had to try to protect the digital house without revealing how or where they were defending it.
“Both the red team and the blue team, we don’t want the others to see what we’re doing,” said Maryland Army National Guard Master Sgt. Luke Thompson, Non-Commissioned Officer in Charge of the Cyber Protection Team 169.
The exercise is not focused purely on computers in isolation. CR14 hosted a simulated environment that included power grids, transportation networks, railroad control systems, and the operational networks that support military and civilian movement.
Thompson emphasized why protecting these specific systems matters beyond digital space.
“Most networks are tied to money or some sort of capability that’s very important... healthcare, transportation...where if this breaks, real problems can happen,” Thompson said.
In a real conflict, compromising these dual-use systems goes far beyond degrading a military force's ability to mobilize. Because modern military logistics and national defense rely heavily on public utilities, any successful cyberattack directly impacts the civilian population. A blackout or a disabled transit grid doesn't just stop troop transport; it shuts down local hospitals, halts civilian commerce, and paralyzes critical municipal services.
"Technology integrates into warfighting at a fundamental level," added Maryland Air National Guard Col. David Sturgeon, a cyber warfare operator with the 276th Cyber Operations Squadron. "There are computers that run the power grid, and if you control those computers, you can control the power grid."
To defend against these threats, the Network Defense Force must adopt a methodical, investigative approach. Thompson compared defensive cyber operations to hiring an exterminator to mitigate a pest problem in a house.
“If I’m a homeowner and I suspect I have a pest problem… I’m going to invite the exterminators in to help me identify if I have a problem, find the problem, mitigate the problem, find the source of that problem, [and] fix it so it doesn’t happen again,” he explained.
In the cyber realm, this translates to threat hunting, clearing out malicious activity, and enabling system hardening. Sometimes, that hardening is as simple as identifying obvious vulnerabilities.
“You’ve got four windows on the back side of your house open, and you need to shut them to keep the problem out,” Thompson said. “Or maybe you need to close three of them and leave one open with a [window] screen for various reasons…that’s the knowledge gained during the investigative process.”
Finding the threat, however, requires careful analysis. Operators look for indicators of compromise, tracing timelines, and reconstructing how an intrusion happened so they can stop it.
“It’s kind of like being a detective,” Thompson added. “You’re trying to solve the case and paint the story.”
While the exercise focused heavily on network defense, it also implemented a broader military priority: foundational readiness. Modern service members must be prepared to operate in austere environments, proving they are Soldiers and Airmen first, and cyber specialists second.
Operators deploying for missions like Immediate Response 2026 must consider their physical and logistical needs, ensuring they possess the basic survival and soldiering skills required to remain efficient. This means knowing how to pack the right gear to sustain themselves for a multi-day mission with limited food and resources, and possessing the flexibility to accomplish tasks outside their primary occupational specialty.
Just as an aviation mechanic might need to know how to refuel an aircraft in addition to fixing it, cyber operators must maintain the fundamental readiness required to deploy, survive, and adapt when external support is limited.
Successfully conducting an exercise of this scale requires seamless integration, which is made possible by the universal nature of the cyber domain. Because operators across different branches and allied nations utilize the same digital environments and tools, combining forces becomes a matter of unified strategy rather than technical translation.
"At its baseline, there are absolutes when you enter this space… Windows is Windows, Linux is Linux," said Maryland Air National Guard Senior Airman Ryan Thomas, a cyber warfare operator with the 276th Cyber Operations Squadron. That common ground, he explained, is why U.S. Soldiers, Airmen, and Estonian partner forces can tackle the same complex mission sets with very little friction.
Technical interoperability is crucial, but the foundation of Immediate Response 2026 is built on a strategic partnership. Estonia maintains one of the most cyber-experienced defense forces in NATO, making Foundation CR14 the ideal environment to simulate a shared threat landscape.
"When you are operating in a physical environment and have to deal with various obstacles that may hinder the completion of the mission, then it is important to find a balance between your sustainable operations and the successful completion of the mission," said Estonian Cyber Force Command Chief Col. René Innos.
Ultimately, the value of Immediate Response 2026 and the broader Sword 26 exercise series lies not in which side "wins" the simulation, but in the collective readiness it builds. By stress-testing these critical networks now, the U.S. and its NATO allies are actively hardening the real-world infrastructure that military forces and civilian populations rely on every day.
"We all play on the same team," said Thomas, reflecting on the unified front between the U.S. and Estonia. "Because in a world where those threats become reality, we've anticipated and prepared ahead of time and we’re ready for whatever comes."