Cyber Summit Korea (CSK) 2026. (Source: CSK 2026 Cyber Summit Korea website)

APEX 2026: AI Joins the Cyber Defense Team

An international exercise that tested a new kind of cyber defense for the AI era

Recent cyberattacks have evolved well beyond targeting a single computer — they now threaten society's core infrastructure all at once, including government agencies, businesses, finance, telecommunications, and healthcare.

In particular, as generative AI and autonomous AI technology advance rapidly, the potential for more automated and more intelligent cyberattacks is growing as well.

Amid this shift, the international cyber exercise APEX 2026 (Allied Power Exercise) was held in Seoul, South Korea, in September 2026.

APEX is an international cyber defense exercise in which multiple countries jointly respond to cyber crisis scenarios. It began in 2024, and rather than simply ranking participating countries against each other, it focuses on forming a single allied defense structure across nations to jointly respond to cyber threats.

One aspect of this year's APEX 2026 that drew particular attention was the debut of an AI-driven Blue Team.

It's significant in that part of the cyber defense work normally carried out by people was handled directly by AI, verifying AI-based autonomous defense capability in an actual international cyber exercise environment.

1. What kind of exercise is APEX 2026?

APEX stands for Allied Power Exercise, an international cyber exercise designed to strengthen international cybersecurity cooperation and joint response capability.

According to official materials, APEX builds its cyber warfare scenarios around a hypothetical inter-state conflict that could occur in the Indo-Pacific region.

Participants take part as the defending side, the Blue Team, carrying out exercises to protect systems and respond to threats under simulated cyberattack conditions.

Key facts about APEX 2026

The official schedule consisted of orientation and pre-exercise training on September 14–15, the main exercise on September 16–17, and a results debrief on September 18.

2. Multiple countries respond to a cyberattack together

In a typical hacking competition, teams are often ranked by comparing their attack and defense skills.

But APEX's defining feature is that it focuses on joint response rather than competition.

Official descriptions frame APEX as an exercise where participating countries form a joint Blue Team to respond together to state-sponsored hacking groups or cross-border cyber threats, verifying international cyber crisis response procedures and interoperability through information sharing and cooperation.

In other words, it's better understood as an exercise closer to the question

"How well can any one team attack?"

than

"How quickly and effectively can multiple countries respond when they come under attack together?"

.

3. The AI defense team: the biggest highlight of APEX 2026

One of the biggest features of APEX 2026 was the AI-driven Blue Team — a newly formed AI-based defense team.

Official APEX materials explain that the 2026 exercise formed an AI defense team to verify, in a real-world setting, the latest technology for countering AI-driven intelligent threats and its autonomous defense capability.

According to recent reports, this AI defense team was developed centered on the National Intelligence Service's National Cybersecurity Center, with participation from the Ministry of National Defense, the National Security Research Institute, Stealien, the Financial Security Institute, and other public, private, and military organizations, with Naver Cloud providing the underlying infrastructure.

Reports also referred to this project by the name 'Project Phalanx'.

4. What can AI actually do in cyber defense?

In a traditional security monitoring environment, people have to review huge numbers of security events and pick out the ones that represent real attacks in order to respond.

But as attacks get faster, there are limits to how much a human can analyze every single event directly.

This is exactly why AI-based defense systems are drawing attention.

According to reports, APEX 2026's AI defense team was designed to carry out the following cyber defense process.

① Threat detection

Analyzes various events occurring across the network and systems, and identifies anomalies that could indicate an attack.

② Attack analysis

Determines whether a detected anomaly is a real attack, and analyzes the attack's characteristics and impact.

③ Response

Carries out measures to respond to the attack.

④ System recovery

Also designed to use AI in the process of restoring systems affected by an attack back to normal.

⑤ Building a response strategy

Designed to go beyond the current attack alone, comprehensively analyzing the situation to help decide the next steps in the response.

In this way, the AI defense team was designed to go beyond simply being "AI that raises an alert" — a distinctive feature is that it was involved across multiple stages of cyber defense, from detection through analysis, response, and recovery.

5. Is cyber defense without humans possible?

This raises an important question.

Can AI judge and respond to a cyberattack entirely on its own?

One of the reasons APEX 2026 matters is that it tests exactly this in a real exercise environment.

Existing AI security solutions have mostly taken the form of alerting security staff to a possible attack or providing them with analysis results.

For example,

"This event is likely an attack,"

is the kind of information typically provided to a human.

Autonomous AI defense systems, on the other hand, aim to go a step further and automate the entire process of

detection → analysis → judgment → response → recovery

.

So APEX 2026 carries the significance of a testbed for verifying just how independently AI can respond in an actual cyber crisis situation.

6. AI automation isn't all upside

It might seem that if AI handled all security work automatically, cyberattacks could be countered far more quickly.

But automation also comes with things that need careful attention.

The most representative issue is false positives.

If AI mistakenly judges normal system activity as an attack, it could end up blocking a legitimate service.

For example, if AI mistakes a critical server's normal process for an attack and blocks it, the result isn't blocking an attack — it's causing a service outage.

So in AI-based cyber defense, how fast an attack is detected isn't the only thing that matters.

The following factors need to be checked together as well.

• Attack detection accuracy

• False-positive rate

• Response speed

• Whether the attack was successfully blocked

• Whether normal service was maintained

• System recovery time

• Verification and control over AI's judgments

• The possibility of human intervention in an emergency

Recent reporting on APEX 2026 also pointed out that as automated AI response expands, the possibility of a wrong judgment blocking normal service needs to be considered.

7. APEX doesn't just test technology

Another feature of APEX is that it doesn't stop at pure technical training.

When a cyberattack escalates into an actual national crisis, technical staff alone can't solve the problem.

Cooperation is needed across government agencies, the military, businesses, legal experts, policymakers, and more.

Official APEX materials likewise emphasize integrated cyber defense capability that covers not just technical response to attacks, but also international cooperation, crisis management, and policy and decision-making procedures.

That's because a real-world cyber crisis is different from a simple IT outage.

8. A realistic scenario built on a hypothetical national conflict

APEX builds its cyber warfare scenarios around a hypothetical conflict between nations.

This kind of exercise has the advantage of letting participants experience a wide range of situations in a safely controlled environment, rather than attacking any real country or institution.

In particular, because defense teams from multiple countries respond to the same hypothetical scenario, they can share different countries' technologies and response methods with one another.

In 2026, with the AI defense team joining as well, an environment was created where human-centered cyber defense and AI-based cyber defense could be verified side by side.

9. Why international cooperation matters

Cyberattacks know no borders.

An attacker can be located in one country while using servers in another, or route an attack through several countries.

In particular, in today's internet environment where the cloud, data centers, telecom networks, and financial systems are all interconnected, a cyberattack in one country could affect other countries and companies as well.

So in cybersecurity, information sharing and international cooperation matter just as much as technology.

Strengthening exactly this kind of international joint response framework is also a core purpose of APEX.

10. The shift in cybersecurity that APEX 2026 revealed

One shift worth noting in this exercise is that the center of gravity in cyber defense is expanding from purely human skill toward human-AI collaboration or AI-based automation.

In the past, security experts personally analyzed logs and hunted down attacks to respond to them;

today, AI is increasingly used to quickly analyze large volumes of data and support security experts' judgment.

And going forward, it's likely that AI will take on an even larger share of directly carrying out parts of the response process itself.

APEX 2026's AI defense team can be seen as an example of how this shift can be applied in an actual international cyber exercise environment.

11. What we should pay attention to in the AI era

There's no need to view APEX 2026 as just another ordinary cybersecurity exercise.

This exercise is an example demonstrating that we're entering an era where AI is actively used not just in cyberattacks, but in cyber defense as well.

As AI continues to advance, attackers will be able to find vulnerabilities and automate attacks even faster.

Conversely, defenders too can use AI to analyze massive numbers of security events and detect and respond to attacks quickly.

Ultimately, what matters isn't AI technology advancing on just one side —

it's building a framework that can safely control AI while putting it to use in defense.

12. Understanding the future of cyber defense through APEX 2026

Put very simply, APEX 2026 can be summarized as follows.

Traditional approach

Cyberattack occurs
↓
Security system detects an anomaly
↓
A person analyzes the logs and the attack
↓
A security officer decides how to respond
↓
System blocking and recovery

AI-based defense approach

Cyberattack occurs
↓
AI detects the threat
↓
AI analyzes the attack
↓
AI decides how to respond
↓
Automated response
↓
System recovery
↓
A person verifies and controls the outcome where needed

Of course, in reality, not every step is fully automated — how AI's role and the scope of human control are set becomes an important challenge.

13. What APEX 2026 means

APEX 2026 is notable both as a venue for international cooperation to jointly respond to global cyber threats, and for verifying AI-based cyber defense technology in an actual exercise environment.

In particular, the AI defense team's participation shows that cybersecurity may evolve beyond simply being "a field where people use AI" and toward "a field where AI itself takes part in the defense process".

But AI automating defense work doesn't mean the human role disappears.

If anything, a human-centered control system — one that verifies AI's judgments, makes critical decisions, and can respond to AI malfunctions or unexpected situations — may become even more important.

Conclusion

The international cyber defense exercise APEX 2026 went a step beyond an international cooperation exercise where multiple countries jointly respond to a cyber crisis, testing a new possibility: AI taking part in the actual process of cyber defense.

In particular, 2026 marked a milestone where an AI-based defense team took part in the exercise alongside existing defense teams, verifying AI's threat detection, analysis, response, and recovery capabilities in a real cyber exercise environment.

As cyberattacks are also likely to become faster and more sophisticated with the help of AI going forward, how safely and effectively AI can be used in cyber defense is set to become an important challenge as well.

APEX 2026 is significant in that this shift is moving beyond pure technical research and into the realm of real-world international cyber defense exercises.

At a glance

APEX 2026 = international cooperation + real-world cyber defense + AI automation

And going forward, the important question in cybersecurity won't simply be

"Can AI attack?"

but rather,

"How quickly and safely can we defend using AI?"

Please refer to the Cyber ​​Summit Korea (CSK) 2026 website (https://cybersummit.kr)