Canada and Latvia Lead NATO Threat Hunting Workshop in Riga
November 17, 2025 – Defence Stories
Estimated read time – 2:15
By Major Christopher Daniel, CAFCYBERCOM Senior Public Affairs Officer
Caption
In the centre, His Excellency Brian Szwarc, Ambassador of Canada to Latvia, and Ms. Ieva Krekovska, Director of the Cybersecurity Policy Department at the Latvian Ministry of Defence, open the Threat Hunting Workshop alongside members of CyTF 2 and CERT.LV.
When cyber threats strike, the ability to hunt them down can make all the difference.
From November 4 to 7, Canadian and Latvian cyber experts brought that capability to NATO allies in Riga, leading a four-day Threat Hunting Workshop designed to turn analysts into proactive defenders, capable of spotting threats before they strike.
The Threat Hunting Workshop was formally opened by His Excellency Brian Szwarc, Ambassador of Canada to Latvia, and Ms. Ieva Krekovska, Director of the Cybersecurity Policy Department at the Ministry of Defence of Latvia.
Organized jointly by the Latvian Ministry of Defence, the Cyber Incident Response Institution of the Republic of Latvia (CERT.LV), and the Canadian Armed Forces (CAF) Cyber Command, the workshop welcomed junior- to senior-level analysts from ten NATO and European countries, alongside representatives from CERT.EU. Participants came from both military and civilian organizations, reflecting the growing need for cross-sector collaboration in cybersecurity.
Caption
The Threat Hunt Playbook, developed jointly by CERT.LV and CAFCYBERCOM, was used as the primary training resource during the workshop.
“This workshop is the result of close collaboration between CyTF-2 and CERT.LV, continually evolving with insights from our joint operations,” said Lieutenant-Commander Jonathan Timmins, Commander of Cyber Task Force 2 (CyTF-2). “We’re bringing the full weight of Canadian and Latvian expertise to the classroom, combining lessons from real-world operations to give participants the most current and actionable threat-hunting practices.”
The workshop blended daily lectures with immersive lab exercises using live data and open-source tools such as Velociraptor. Analysts focused on proactive threat hunting, identifying suspicious activity, validating threats, and sharing intelligence before adversaries can act.
Major Stephen McKeon, Team Lead of the CAF Aviation Cybersecurity Test Team, explained why this approach is critical: “Proactive threat hunting allows us to find and neutralize adversaries before they achieve their objectives. It’s about maintaining initiative in the cyber domain and continuously improving our security posture to stay ahead of evolving threats.”
Caption
His Excellency Brian Szwarc, Ambassador of Canada to Latvia, and Ms. Ieva Krekovska, Director of the Cybersecurity Policy Department at the Latvian Ministry of Defence, address participants at the opening of the Threat Hunting Workshop in Riga, alongside members of CyTF 2 and CERT.LV.
This year’s workshop expanded content on Linux-based environments and added more hands-on exercises. Updates to the Threat Hunt Playbook, a living repository of tactics, techniques, and tools, incorporated new artifacts, detection workflows, and automation to reflect the latest threat landscape.
For Latvia, hosting and teaching the workshop strengthens national cyber capabilities at NATO’s eastern frontier. “Collaboration is essential in cyber defense,” said Mr. Rudolfs Kelle, CERT.LV Threat Hunting Lead. “By sharing timely and relevant information, NATO partners can detect, understand, and counter emerging threats more effectively than any nation could on its own.”
Through joint instruction, Canada and Latvia are helping NATO allies sharpen practical skills, build trust, and enhance collective readiness. As cyber threats continue to evolve, this partnership proves that shared expertise is more than a defensive tool, it’s a force multiplier, transforming knowledge into action and reinforcing NATO’s cyber resilience for years to come.