Latvia and Canada Hold Fifth Joint Threat Hunting Workshop

From October 19 to 23, 2026, CERT.LV, the Latvian Ministry of Defence and the Canadian Armed Forces (CAF) held the fifth joint Threat Hunting Workshop. This year's program also included a Cyber Threat Intelligence Workshop delivered by U.S. European Command (EUCOM).

The workshop was opened by CERT.LV Deputy Manager and Technical Director Varis Teivāns, Director of the Cybersecurity Policy Department at the Latvian Ministry of Defence Ieva Kalēja, and Canadian Armed Forces Cyber Command CyTF-2 Commander Jonathan Timmins.

Highlighting the value of sharing practical knowledge, during his opening remarks Varis Teivāns said: “During the workshop, participants will work with more than just simulated scenarios. They will also learn from real operations, including both successful cases and those that offered valuable lessons. This will help all participants to understand better how to plan and conduct effective threat hunting operations.”

The training combined theoretical knowledge with hands-on exercises, focusing on how to identify cyber threats that may go undetected by conventional security measures. Participants explored threat hunting methodologies, detection tools and practical examples drawn from joint Latvian-Canadian operations.

Ieva Kalēja emphasized the importance of international cooperation in addressing today's cyber threats: “We are meeting at a time when major cyber incidents continue to make headlines in Latvia and around the world. These developments have reinforced the importance of cybersecurity across all sectors and the Ministry of Defence’s commitment to ensuring compliance with cybersecurity requirements. Given our strategic position, we face persistent threats that demand strong detection capabilities and close international cooperation. I encourage you to make the most of this opportunity to share knowledge and learn from one another.”

The workshop builds on the long-standing cooperation between CERT.LV and the Canadian Armed Forces, which have conducted joint threat hunting operations since 2022. This partnership has helped develop practical approaches and techniques that now form an important part of the training program.

Reflecting on the origins of the course, Jonathan Timmins noted: “This course grew out of our willingness to share the knowledge and techniques we have developed through joint operations. We face common adversaries, and sharing intelligence is essential to countering these threats. There is no single solution to every cyber threat, but combining different approaches helps us detect activity that traditional defenses may miss.”

Since the first workshop, the training has reached 149 participants from 28 countries, including cybersecurity specialists from NATO member states and partner countries. The workshops are led jointly by Latvian and Canadian experts.

The Threat Hunting Workshop program and accompanying Threat Hunt Playbook will continue to be updated based on participant feedback and lessons learned from joint operations. With growing international interest in the course, CERT.LV and the Canadian Armed Forces plan to continue offering the training regularly, sharing Latvian-Canadian expertise with cybersecurity specialists from other countries.

The Threat Hunt Workshop is co-funded by European Union under the CERT.LV-SOC-LV Project (Project ID. 101249230), more on the project: https://cert.lv/en/about-us/international-projects

Threat hunting is a proactive approach to cybersecurity that involves searching for signs of malicious activity within networks and systems, including threats that have not been detected by existing security tools. It can help identify advanced persistent threats (APTs), malware, spyware and other forms of unauthorized activity before they cause further damage.

Since 2022, CERT.LV and its international partners have carried out regular threat hunting operations, analyzing more than 170,000 endpoints across 40+ organizations. These operations have helped strengthen Latvia's cybersecurity capabilities and contributed to the exchange of practical expertise with international partners.