From threat hunting to cyber risk assessment: eGA shares practical lessons at NATO HQ
How do partner countries strengthen cyber defence in practice? Sometimes it needs to start with a cyber risk assessment. Sometimes it means training experts to recognise malware signatures, use open-source intelligence, or share information during an incident. Sometimes it means a realistic “Red vs Blue” exercise, where teams practise threat hunting, incident reporting and coordination under pressure.
These were some examples eGA shared at the 2026 NATO Defence and Related Security Capacity Building (DCB) Conference and its first-ever Marketplace, held at NATO Headquarters in Brussels on 2–3 June.
As one of the Allied-nominated implementing agencies, eGA participated in the Marketplace alongside 30 selected agencies supporting NATO’s capacity-building work with partner countries. The event offered an opportunity to demonstrate how cyber capacity building works on the ground — from strategic advice and institutional readiness to technical training, exercises, and donor coordination.
Merle Maigre, Head of Cybersecurity Competence Centre at eGA, joined the plenary discussion with representatives of two other implementing agencies. She shared eGA’s experience from NATO-related cyber capacity-building activities in Moldova and Bosnia and Herzegovina, focusing on impact, deliverables and lessons learned.
For example, in Moldova, eGA’s work has strengthened cyber resilience by improving situational awareness, technical capacity, and the skills of cybersecurity professionals. Activities have focused on practical training, threat-informed analysis and exercises that strengthen coordination, information sharing and incident response.
In Bosnia and Herzegovina, eGA is implementing a NATO DCB Trust Fund project to support the Ministry of Defence and Armed Forces’ cyber defence capabilities. The project combines assessment, advisory support, technical training and knowledge exchange to strengthen institutional readiness and support long-term cyber resilience.
A key lesson from the projects is the importance of coordination between different international partners. For example, the cyber risk assessment delivered by eGA to BiH MoD came at a critical planning stage of a US-supported cybersecurity modernisation project, helping create strong complementarity between NATO-supported and US-supported initiatives.
The examples also show that cyber defence capacity building is also about people, procedures, and cooperation. In both Moldova and Bosnia and Herzegovina, the focus has been on helping institutions better understand cyber threats, improve coordination and build skills that can be used in real incidents.
At the Marketplace, eGA also introduced its broader digital governance and cybersecurity portfolio, including data management, governance and institutional building, digital identity, cybersecurity capacity building, and more.
eGA’s participation in the Marketplace reflects its growing role as a trusted implementing partner in international cyber capacity building. It also highlights the value of cooperation between NATO, the EU, national institutions and expert organisations in strengthening cyber resilience where it matters most.
