Cyber Summit Korea (CSK) 2026. (Source: CSK 2026 Cyber Summit Korea website)

CSK 2026 Session C-2: The New Direction for Cyber Training That the 'K-Cyber Training Institute' Proposed

Held at COEX Seoul from September 16 to 18, 2026, Cyber Summit Korea 2026 (CSK 2026) ran a wide range of programs covering international cybersecurity cooperation and the future of cyber training. CSK 2026 was jointly hosted by the National Intelligence Service and the National Security Research Institute, under the theme 'Connected World, Security Together.'

Among the programs that drew particular interest was Session C-2, 'Cyber Training Is About to Change... the K-Cyber Training Institute!'

This session was set up as a venue to go beyond simply practicing cyberattack techniques, and instead to share each country's cyber-training experience and discuss a direction for building an international cooperation framework. According to the official program, it was chaired by Tony Sarre, director of the NATO CCDCOE, centered on 'Presentation: The K-Cyber Training Institute Vision,' with a discussion among international experts.

What kind of session was CSK 2026 Session C-2?

The CSK 2026 conference was broadly organized around three tracks: △emerging technology security & trust, △international strategy & cooperation, and △cybersecurity policy & trends.

Session C-2 was held under the cybersecurity policy & trends track. The official program describes the session's core content as "examining the current state of each country's cyber-training institutions and discussing ways to cooperate with one another."

What's especially worth noting about this session is that it looked at the vision of 'K-Cyber Training Institute,' a domestic cyber-training system, from an international perspective.

A cyber threat isn't a problem confined to a single country's network. The attack infrastructure, the affected system, and the responding agency can all exist in different countries, and a single attack can spread to the digital infrastructure of multiple countries and companies.

So cyber training, too, is moving beyond simply raising the technical capability of a specific organization, and developing in a direction that also verifies cooperation between countries, civil-government-military coordination, information sharing, and joint response capability.

A panel discussion with international experts

This session brought together, as panelists, experts active in the field of international cybersecurity.

[Panelist 1] Hannes Abäste, CTO, CR14

The first panelist was Hannes Abäste, CTO of CR14.

From the perspective of an international cybersecurity organization like CR14, cyber training serves as an important means of experiencing complex problems that can occur in real situations within a safe environment, and checking response capability.

In particular, modern cyberattacks don't end with technical detection and blocking alone. Analyzing the attack situation, making decisions within the organization, sharing necessary information, and cooperating with other institutions all need to happen at the same time.

For this reason, future cyber training may need to involve not just technical experts, but also policy officials, organizational managers, and decision-makers.

That said, because the official CSK website doesn't publish the full text of each panelist's individual remarks, it's difficult to say for certain, based on public materials alone, exactly what detailed views CTO Hannes Abäste presented on site. This article is organized around the facts of participation confirmed in the official program and the publicly available trends in international cyber training.

[Panelist 2] Thomas Mogodia, Lithuanian Armed Forces Cyber Defense Command

The second panelist was Thomas Mogodia, staff officer for cyberspace operations, of the Lithuanian Armed Forces Cyber Defense Command.

Lithuania has recently been strengthening its military cyber defense capability as a separate organization.

Lithuania's Ministry of National Defence announced plans to establish a Cyber Defense Command in 2024, an organization set up to handle cyber defense and cyber operations for the communications and information systems and networks of the defense sector, and to strengthen interoperability with NATO and other domestic institutions. The Cyber Defense Command began operating officially in January 2025.

This background serves as an important reference point when thinking about the direction of the K-Cyber Training Institute.

The international cyber training Lithuania takes part in goes beyond simply attacking and defending a single computer — it also practices national-level response systems and cooperation between multiple institutions together.

For example, in the 2026 'Locked Shields' exercise, Lithuania and Japan formed a joint team, and participants from about 40 countries took part in training to respond to complex cyberattacks. The exercise included a variety of incident scenarios that could affect critical national infrastructure, as well as elements that tested rapid response and international interoperability.

Cyber training is shifting from 'attack and defense' to 'collaboration'

What stands out in Lithuania's case is cooperation among the civilian sector, government, military, and international partners.

Lithuania's Ministry of National Defence stated that its 2026 cyber training operates in a form that brings together the national cybersecurity center, the military, the public and private sectors, and academia. It also emphasizes that cyber training raises both practical response capability for complex attacks and interoperability between countries.

This case serves as an important reference for thinking about what form of international cooperation the K-Cyber Training Institute might pursue going forward.

If training participants aren't each operating in separate, isolated organizations, but instead need to share information and divide roles with one another just as they would in an actual cyber crisis, the purpose of the training naturally changes as well.

"Can the attack be blocked?"isn't where it ends —

"After an attack is discovered, who decides what, what information is shared, and how do we jointly respond with other institutions?"

— the training comes to address this kind of question too.

[Panelist 3] Christopher Fligère, Swedish National Cyber Security Centre

The third panelist was Christopher Fligère, acting deputy head of department at the Swedish National Cyber Security Centre (NCSC-SE).

Sweden, too, has treated cybersecurity not merely as a technical issue, but as something important to address through a system where the country's various institutions and organizations can respond together.

Sweden's cybersecurity policy materials have also raised the need for a Cyber Range for practice and training that assumes real-world conditions. A Cyber Range is a virtual training environment that can simulate cyberattack and defense scenarios without directly attacking real systems.

This kind of training environment connects to an important shift in cybersecurity education.

Learning theory in a classroom alone isn't enough to sufficiently verify the response capability needed in an actual cyber crisis. That's because it's necessary to build situations resembling reality and have participants carry out detection, analysis, response, reporting, and decision-making within a limited time.

Why the K-Cyber Training Institute is drawing attention

This session's title includes the phrase 'Cyber Training Is About to Change'.

The meaning behind this becomes clear when you consider the direction cyber training is shifting in.

In the past, cyber training often focused mainly on technical training where security staff detect attacks and defend systems.

But today's cyber threats don't end as a problem for just one company or one institution.

For example, if an attack targets critical infrastructure, the following issues can arise at the same time as the technical response.

• Assessing the scope of the attack and the extent of the damage

• Deciding whether critical systems can keep operating

• Sharing information with relevant agencies

• Cooperation between private companies and government agencies

• Coordinating roles between the military and civilian sectors

• Sharing international threat intelligence

• Communicating with the press and the public

• National-level response decision-making

So cyber training going forward is likely to develop into a form that combines technical training + organizational training + decision-making training + international cooperation training.

'Interoperability,' an important concept in international cyber training

One core concept that comes up often in international cyber training is interoperability.

Interoperability refers to the ability of systems and personnel from different organizations or countries to work together.

For example, if a cyberattack is detected in Korea but information related to the attack exists overseas, a response by domestic institutions alone may not be sufficient.

It's necessary to share threat intelligence with foreign institutions, analyze attack patterns, and, where needed, carry out a joint response.

In Lithuania's case of participating in Locked Shields as well, international interoperability and experience-sharing are presented as important elements. Lithuania's Ministry of National Defence, describing its 2026 exercise, emphasized not just the ability to respond to complex cyberattacks, but also interoperability between countries and the exchange of expertise.

This international trend is part of the background suggesting that the K-Cyber Training Institute could develop beyond a domestic training institution into a platform for international cyber-training cooperation.

From 'cyber training institute' to 'international cyber-training platform'

What matters in the vision of the K-Cyber Training Institute is how the concept of 'training institute,' included in its name, is expanded.

If it were simply an educational institution, it could end with participants receiving education and carrying out training.

But the story changes if it aims to become an international cyber-training platform.

It becomes possible for domestic and international institutions to build training scenarios together, test each other's response systems, analyze the results of training, and feed those results back into the next round of training — a cyclical structure.

Conceptually, this can be summarized as follows.

Education → simulated training → joint response → evaluation → improvement → retraining

Once this kind of repeating process is established, the training itself can develop into a system for strengthening cybersecurity capability.

What matters most in actual cyber training is 'realism'

For cyber training to be effective, it needs to resemble an actual crisis situation.

Lithuania's Cyber Range simulates a variety of cyberattack scenarios in a closed virtual environment, and is built so participants can practice detecting and defending against actual attacks. It's also designed to allow real-time team training in the form of Red Team versus Blue Team exercises.

This approach focuses not on having training participants simply memorize the correct answer, but on building the ability to find a response in an unexpected situation.

In particular, as AI and automation technology begin to be used in both cyberattack and defense, the realism of cyber training is becoming even more important.

CSK 2026 also ran the international cyber exercise APEX, along with an AI defense team and a cyberattack-defense competition. 24 countries took part in CSK 2026's APEX, and an AI defense team made up of civilian, government, and military participants also tested its real-time cyberattack response capability.

In the AI era, cyber training needs to change too

Part of why the shift in cyber training was covered as an important topic at CSK 2026 has to do with the emergence of AI as well.

AI can speed up a defender's analysis, but it can also be used for an attacker's automation.

If an attacker uses AI to gather information and automate the attack process, the defender too needs fast detection, analysis, and an automated response system.

In this kind of environment, training where people handle every process manually alone can't sufficiently reproduce actual conditions.

So the following elements are likely to become even more important in future cyber training.

AI-based threat detection

The ability to quickly analyze signs of attack and detect anomalous behavior

Automated response

A method of automating repetitive response procedures, letting people focus on important decisions

AI attack scenarios

A method of using AI to reflect changing attack situations in training

Human-AI collaboration

The ability for people to verify and make the final call on analysis results provided by AI

International joint training

The ability for multiple countries to jointly respond to new, AI-driven attacks

The international significance of the K-Cyber Training Institute

One important trend confirmed through this CSK 2026 session is that cyber training is no longer the domain of just one country or one institution.

For Korea to build an international cyber-training cooperation framework through the K-Cyber Training Institute, it's important to connect the training experience, technology, and scenarios of various countries.

In particular, just looking at the affiliations of the experts who took part in this session reveals a direction of international cybersecurity cooperation.

There's significance in the fact that experience from different organizations — CR14, the Lithuanian Armed Forces Cyber Defense Command, and the Swedish National Cyber Security Centre — was discussed together in one place.

That said, the currently published official CSK website does not disclose the full transcript of the session or each panelist's detailed remarks. So rather than asserting that a particular panelist made a particular claim, it's more appropriate to understand the session by connecting the purpose confirmed in the official program with the cyber-training policies and cases each country has made public.

How will cyber training change going forward?

The question CSK 2026 Session C-2 poses is a simple one.

"How do we create more people who can stop cyberattacks?"

And going one step further from there,

"How do we train nations, institutions, companies, the military, and international partners to move together in an actual cyber crisis?"

— the question expands to this as well.

International training with joint participation from government, military, the private sector, and academia, as in Lithuania's case, illustrates this direction. In 2026 as well, Lithuania is having experts from various fields take part in training for protecting critical infrastructure and in international cyber-defense exercises, while strengthening both national-level cyber incident response capability and a culture of information sharing.

In the end, the vision of the K-Cyber Training Institute, too, is likely to face the important task of developing beyond a simple cybersecurity education facility into a space that experiments together with repeated training based on real crisis scenarios, international cooperation, civil-government-military coordination, and AI-based cyber-threat response.

Conclusion

CSK 2026's Session C-2, 'Cyber Training Is About to Change... the K-Cyber Training Institute!' was a program that showed how the paradigm of cyber training is shifting.

In particular, with Hannes Abäste (CTO, CR14), Thomas Mogodia (staff officer for cyberspace operations, Lithuanian Armed Forces Cyber Defense Command), and Christopher Fligère (acting deputy head of department, Swedish National Cyber Security Centre) taking part as panelists, the session created a venue to discuss the future of cyber training from an international perspective.

While it's difficult to reconstruct each of the three panelists' individual remarks from the materials currently available, looking at the publicly disclosed cyber-training cases from each country makes it possible to see that future cyber training is likely to develop centered on realism, international cooperation, civil-government-military cooperation, virtual training environments, interoperability, and AI response capability.

What role the K-Cyber Training Institute will come to play within this international trend, and whether it can develop into a new cybersecurity platform where domestic and international cyber experts train together and share experience, is an important thing to watch going forward.

Please refer to the Cyber ​​Summit Korea (CSK) 2026 website (https://cybersummit.kr)