Standoff Cyber Exercise at the Digital Solutions Forum Puts AI to the Test in Attack and Defense

Russia's Digital Solutions IT forum hosted the Standoff cyber exercise, in which information security teams from leading Russian companies practiced attack and defense. The main theme of the results, which CNews published on 9 October 2026, was artificial intelligence. The available excerpt does not give the number of teams, the duration or a ranking, so what follows covers what is confirmed and what is worth looking into separately.

What we know about the exercise

Standoff has long been established as the main Russian cyber battle format. Some teams play the attackers (red teams) and look for ways into the infrastructure. Others play the defenders (blue teams), detect the intrusion and repel it. Everything usually happens on a purpose-built range rather than on real systems, which makes it safe to play out scenarios close to actual incidents.

The format has another particular strength: it tests not a single product but the combination of people, processes and tools. For a CISO, this is closer to reality than a lab test of a scanner.

Key known parameters of the event:

• Venue: the Digital Solutions IT forum.
• Format: the Standoff cyber exercise, pitting attackers against defenders.
• Participants: information security teams from leading Russian organizations.
• Theme of the results: the use of AI in attack and in defense.
• Source: CNews, article dated 9 October 2026.
• Quantitative results in the public excerpt: not disclosed.

Where AI works for both sides

The article's headline points to a duality: AI serves both those who break in and those who defend. In exercises like this, that usually shows up in a few typical scenarios. We cannot claim these are the ones discussed at the forum, but they provide a frame for assessing the results.

For attackers, language models speed up reconnaissance, help assemble plausible phishing texts, generate script variations and make sense of unfamiliar technologies. The gain is mostly in time: what once took hours of manual work now takes minutes.

For defenders, AI is most often built into the monitoring center. It groups alerts, gives the analyst context on an incident, drafts detection rules and merges scattered events into a single timeline. This reduces the load on the first line, but it does not remove the need to verify the model's conclusions.

There is also an asymmetry. An attacker needs only one successful attempt, and a wrong suggestion from a model costs them almost nothing. For a defender, a false positive is expensive: it wastes time, the team's attention and sometimes the availability of services.

What is missing from the public data

The main question for any report on AI in cyber exercises is what exactly was measured. Without an answer, the conclusion that "AI helped" remains a slogan. The available excerpt does not show how the teams used models (in-house, commercial or open), whether there were restrictions on their use, or whether results were compared with work done without AI. It is also unclear whether anyone measured detection speed, the number of missed attacks or the share of false positives.

Until these data are published, it is better to read the results as a signal of direction, not as proof of effectiveness.

How to use this in practice

Those responsible for security at a company should not wait for the full report. It makes sense to prepare their own assessment:

1. Establish a baseline. Measure detection and response times in your monitoring center before rolling out AI tools, or you will have nothing to compare against. 2. Include AI in your exercises. If you run internal cyber exercises, add scenarios in which attackers use generative models for phishing and reconnaissance. 3. Demand metrics from vendors. The false positive rate and incident handling time matter more than talk of "intelligent analytics". 4. Keep a human in the loop. Automatic actions by a model in a production environment should be limited until they have been tested on a range. 5. Watch for the detailed Standoff results and compare them with your own data.

Once the organizers disclose the numbers, you can check them against this list and see how much AI has changed the balance of power.