Each May, Tallinn, Estonia becomes the center of gravity for the global cyber conflict research community. That is by design: The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)—headquartered in the Estonian capital—is NATO's leading dedicated hub for raising collective cyber defense capabilities among allies and like-minded nations. Drawing on military, governmental, academic, and industrial experts from 39 member and partner nations, the CCDCOE produces research, delivers training and exercises, and develops the doctrines and standards that underpin NATO's cyber posture. It is also the institutional home of the Tallinn Manual—the landmark expert-led study on how international law applies to cyber operations—which has shaped legal thinking on cyber conflict across governments and militaries worldwide.
Among the CCDCOE’s flagship activities—alongside the Locked Shields and Crossed Swords cyber exercises—is the annual International Conference on Cyber Conflict, known as CyCon.
What Is CyCon?
Running since 2009, CyCon has grown into one of the most important multidisciplinary forums on cyber defense and security in the world. The 18th edition, themed “Securing Tomorrow”, took place May 26–29, 2026, in Tallinn. The annual conference brings together more than 600 senior decision-makers and over 100 speakers drawn from governments, international organizations, industry, and academia across the globe. Its scope is deliberately broad: legal, technical, policy, strategic, and military dimensions of cyber conflict are all on the table, making it distinct from more narrowly focused cyber security conferences.
That cross-sectoral character is one of CyCon's defining strengths. Military operators, legal scholars, private sector threat intelligence analysts, and government policymakers engage with the same set of problems across dedicated tracks. CyCon's structure reflects the reality that effective responses to cyber conflict require legal clarity, technical understanding, and strategic coherence in equal measure.
Key Themes from CyCon 2026
The CCDCOE has now published the proceedings of the 18th conference, (themed “Securing Tomorrow”), comprising 21 peer-reviewed papers organized across three tracks: legal, strategy and policy, and technical. Rather than converging on a single technological challenge, the proceedings reveal three broader trends shaping the future of cyber conflict: the growing role of artificial intelligence in military decision-making, persistent challenges surrounding cyber deterrence and attribution, and the increasing importance of alliance coordination and resilience.
AI featured prominently across both the legal and technical tracks. Several papers examined how international humanitarian law considerations can be incorporated into military AI procurement and whether the use of autonomous systems in armed conflict risks violating established legal principles. Technical contributions explored the potential of AI-assisted cyber defense, reflecting growing interest in leveraging machine learning to improve threat detection, analysis, and response while raising important questions about human oversight and accountability.
A second major theme was cyber deterrence in an environment where attribution remains difficult and accountability uncertain. Contributions addressed state responsibility, the legal implications of autonomous systems, and opportunities presented by the new UN Convention against Cybercrime. Strategic case studies examined cyber operations as tools of signaling and influence—including in the Iran-Israel rivalry and efforts to counter Russian electoral interference—highlighting the continuing challenge of translating technical attribution into effective political and strategic responses.
Finally, many papers highlighted the importance of collective resilience and multinational cooperation. Topics such as NATO supply-chain security governance, cyber threat intelligence sharing, and the preparedness of small and medium-sized enterprises reflected a growing recognition that cyber security is a collective-action problem. In that context, the announcement of CyCon 2027's theme—"Unified Response”—is particularly noteworthy. It suggests a shift away from a primary focus on capability development toward a broader emphasis on how allies, governments, and private-sector actors can coordinate action in response to shared cyber threats.
Together, these themes indicate that the future of cyber conflict will be shaped by both technological innovation as well as the institutions, legal frameworks, and partnerships needed to govern and employ those capabilities effectively.
The full proceedings are available here: https://ccdcoe.org/library/publications/18th-international-conference-on-cyber-conflict-securing-tomorrow/
Looking Ahead
A call for papers for CyCon 2027 is expected in fall 2026. For the legal track in particular, “Unified Response” perhaps points to some of the field's less settled questions—including how international law applies when allies act together in cyberspace. For anyone tracking how law, policy, and technology intersect in the cyber domain, CyCon and the CCDCOE's further work are worth following.
The Belfer Center's International Security Program Fellow Dr. Julia Vassileva has been connected to the CCDCOE as an external legal expert and served as a member of the Academic Review Committee for CyCon's international law track annually since 2024.
