20 August 2026

Evolution of the cyber within NATO

Defence24  |  Aleksander Olech

NATO formally elevated cyberspace to an operational domain alongside land, sea, air, and space following decades of escalating hybrid threats culminating in active Russian and Chinese cyber campaigns. Early milestones like Operation Allied Force in Kosovo and the 2007 Estonian cyberattacks prompted foundational structures including the NATO Cyber Security Centre and Tallinn’s Cooperative Cyber Defence Centre of Excellence.

The 2014 Wales Summit explicitly linked severe cyber attacks to Article 5 collective defence, establishing the doctrinal framework for integrating cyber operations into Allied deterrence. Subsequent initiatives established the Cyberspace Operations Centre in 2018 and planned the NATO Integrated Cyber Defence Centre at SHAPE by 2028, alongside quantum technology initiatives and submarine cable protection projects. Addressing hostile campaigns like China’s APT31 group, the Alliance aims to achieve comprehensive digital transformation by 2030 while utilizing expanded military spending to bolster national cyber resilience across member states.

Comment

NATO's decision to establish the NATO Integrated Cyber Defence Centre (NICC) at Supreme Headquarters Allied Powers Europe (SHAPE) underscores a structural effort to centralise operational domain awareness within the military command chain. By embedding cyber threat data directly into military planning in Mons, the Alliance seeks to compress the sensor-to-shooter loop for hybrid contingencies. However, delaying full operational capability until 2028 exposes a critical timeline mismatch between accelerating adversary operational tempos and NATO command modernisation.

This operational gap forces reliance on the Cyberspace Operations Centre (CyOC) and voluntary national cyber asset contributions, maintaining fragmentation in active response authorities. Because sovereign member states retain exclusive operational control over offensive counter-cyber assets, SHAPE lacks the sovereign mandate required to execute synchronized theater-wide counter-cyber operations during high-intensity conflict.

Strategic Question for Discussion
If operational full capability for the NATO Integrated Cyber Defence Centre (NICC) at SHAPE remains delayed until 2028, how can the Cyberspace Operations Centre maintain effective multi-domain deterrence against rapid threat campaigns like APT31 while sovereign states retain exclusive control over offensive cyber capabilities?
Share your assessment in the comments below.

No comments: