NATO’s Allied Maritime Command (MARCOM) is harnessing technology and enhancing its role as a central information-sharing node for NATO’s maritime forces. MARCOM has demonstrated the operational effect of using new information technologies during its ‘Baltic Sentry’ activity, established to deter critical undersea infrastructure threats.
When a short series of critical undersea infrastructure (CUI) incidents occurred in the Baltic Sea between October 2023 and December 2024, regional stakeholders, national navies and supporting NATO naval commands and forces were able to generate a response time of around 17 hours to bring naval presence to bear at incident sites.
A year later a further short series of incidents occurred, in December 2025 and January 2026. By this time the stakeholders’ collective response had accelerated to one hour.
Several developments occurred in the year in between, each contributing significantly to accelerating the response – and to closing the window for denial of responsibility.
Across the individual incidents within the two series, formal, legal attribution has not yet been made. However, at a military and political level, NATO and some member states involved have alleged publicly that the incidents were due to a Russian campaign of subversive action using rogue commercial shipping vessels to target CUI.
Responding to these activities – and representing the first development – in January 2025 NATO launched its ‘Baltic Sentry’ maritime presence, surveillance, reassurance and deterrence activity to build capacity to monitor and respond to the threat.
The second development – built subsequently, in and around ‘Baltic Sentry’ – was the integration of a wider range of information sources to accelerate incident analysis, decision-making and response. Integrating such information (including collation, processing and distribution) and implementing its operational use has been enhanced by harnessing new technology.
Such technology has included new platforms, namely maritime uncrewed systems (MUS). More significantly, it has included data analysis and integration tools. These tools are designed to help NATO accelerate the analysis and decision-making processes to help in turn more rapidly build maritime situational awareness (MSA), including understanding how shipping activities on the surface relate to potential CUI incidents on the seabed.
What NATO’s broad approach enables is “incredibly fast integration of information, sharing of information, and action by the relevant authorities”, Commodore Sean Williams, a Royal Canadian Navy (RCN) officer posted as Deputy Chief of Staff for Plans at NATO’s Allied Maritime Command (MARCOM), told Warsight.
“There are two elements to ‘Baltic Sentry’. One is being able to deter something from happening in the first place, by being present and eliminating the space to conduct ‘hybrid’ activities,” Cdre Williams explained. “The other – and it’s a deterrent itself – is our ability to respond quickly. We do that by having assets in the right place, but most importantly by gathering the information, analysing it and sharing it very, very rapidly.”
The deterrent impact is arguably evident in the absence of confirmed CUI incidents for over a year once ‘Baltic Sentry’ was operational. “The results speak for themselves,” Cdre Williams said. “From January 2025, when we stood up ‘Baltic Sentry’, until January 2026, there were no clear incidents of CUI damage as a result of malign activity.”
The CUI threat in the Baltic and elsewhere across NATO’s Euro-Atlantic area of operations has reiterated MARCOM’s core role in allied maritime operations, especially its traditional position as an information-sharing ‘hub’. It also illustrates how NATO’s ability to share such data has accelerated.
MARCOM is the command ‘node’ for all NATO maritime forces operating in an alliance context. Its role has been increasingly visible across NATO at a political and public level, particularly – but not only – since 2022 and Russia’s invasion of Ukraine as the alliance has sought to deter a stronger Russian naval challenge in the North Atlantic. MARCOM’s role here has become more visible largely due to NATO’s need to respond to the invisible underwater threat.
This renewed subsurface threat is a traditional one, seeing a significant increase in Russian submarine activity. Yet it has also been non-traditional, with more asymmetric underwater activities occurring across the Euro-Atlantic’s sub-conflict threshold ‘grey zone’. Such activities are difficult to attribute because of their asymmetric nature and their occurrence in the still-opaque underwater world; yet they have often been publicly linked to Russia by NATO and its navies, including because of Russia’s widely recognised use of ‘hybrid warfare’ strategies.
The Baltic region CUI threat is a classic example of such asymmetric, ‘hybrid’ activity in the ‘grey zone’.
‘Baltic Sentry’ is the alliance’s response. Under the auspices of Allied Command Operations (ACO), MARCOM leads the at-sea operational output, with the newly established Commander Task Force (CTF) Baltic providing tactical command and control (C2) for assembled forces. At a co-ordination level these and other NATO commands work extremely closely with each other and with national maritime organisations, the CUI industry and other stakeholders to deter the threat.
Very visible at the centre of ‘Baltic Sentry’ have been MARCOM’s two North Atlantic-focused standing naval forces (SNFs): Standing NATO Maritime Group 1 (SNMG1) and Standing NATO Mine Counter Measures Group 1 (SNMCMG1).
Less visible but equally crucial in generating tangible deterrence has been MARCOM’s use of technology to improve risk understanding and accelerate threat response.
Technology is supporting ‘Baltic Sentry’ in two primary ways, Cdre Williams explained. First is at-sea presence that harnesses technology. NATO states committing crewed platforms into the SNFs, or to operate alongside them in national support, is the cornerstone of ‘Baltic Sentry’. However, Cdre Williams added, “To really understand what’s happening in the environment, we need to have solid MSA across the Baltic in a persistent way.” Here, technology provided on board air, surface or underwater MUS and harnessed through crewed/uncrewed ‘teaming’ can help expand what can be achieved with manned platforms. Fixed sensors, including shore-based radars, seabed acoustic nodes and satellites, help build this persistent MSA.
“Here, it’s a matter of integrating that data into a fused network,” said Cdre Williams.
Second is delivering new capabilities and capacities that enhance what ‘Baltic Sentry’ can achieve. Cdre Williams pointed to operational experimentation conducted across the Baltic in mid-2025 using multiple uncrewed surface vessels (USVs), led by NATO’s Allied Command Transformation (ACT) with its Task Force X Baltic programme. Noting both the utility of this work in building the MSA picture and plans to continue such work including under national leadership, Cdre Williams added, “All that contributes to building the picture, to achieving that persistent intelligence, surveillance and reconnaissance.”
More broadly, Cdre Williams said, “Those experiments … are part of a journey towards having uncrewed systems fully integrated into our forces and contributing to ‘Baltic Sentry’.
“Our goal is to go from demonstration to full integration of those forces,” he explained. “We want to continue to integrate their use, to share the data and integrate them into our operations. That is a major area of focus for us.”
MARCOM’s aspirations include having MUS deployed into an SNMG or working at a national level alongside it, as is routine with NATO’s crewed platforms. According to NATO officials, the alliance has longer-term aspirations to stand up an SNMG consisting fully of USVs.
Regarding the process for harnessing information, MARCOM has the capacity to draw on information sources from across NATO and its member states, plus accessing commercially available sources like ship automatic identification system (AIS) data and commercial data from stakeholder partners like CUI owners and operators.
MARCOM then can compare data to where an incident may have occurred to try and identify any suspicious vessels involved.
Building relationship networks with other stakeholders, including arrangements for information sharing, is key to MARCOM’s approach. “In every situation the information may come from a different place, so it’s about building the networks and the information sharing agreements to be able to pass that information quickly,” said Cdre Williams. “That’s an area where ‘Baltic Sentry’ has advanced things quite significantly, particularly amongst the Baltic countries.”
Alongside the hardware that generates the physical at-sea presence, another crucial component in helping make sense of the data is using software tools designed to collect, collate and analyse it. To achieve this MARCOM has worked with NATO’s Allied Command Transformation (ACT) and Centre for Maritime Research and Experimentation (CMRE) – the alliance’s in-house maritime research laboratory – to develop an artificial intelligence/machine learning (AI/ML)-enabled data integration and analysis tool called ‘Mainsail’.
‘Mainsail’ was introduced in January 2025, as ‘Baltic Sentry’ was launched, as a major development in enhancing NATO’s operational response to the CUI threat. It is designed as an iterative product, adaptable to the need. It harnesses, processes and analyses information from the various inputs, aiming to accelerate the building of the MSA picture, the understanding of anomalies therein, and the decision-making and operational response to any incident.
“‘Mainsail’ allows us to ingest those data sources, to look at the data against where we know areas of interest regarding CUI etc to be, and to make sense of it,” said Cdre Williams. “[It] looks at the patterns and attempts to detect anomalies and suspicious behaviours before they happen, to feed us good, decision-quality information we can then use to position assets in the right place and to conduct forensic analysis when something happens to identify potentially suspicious vessels.”
Going forward, MARCOM is looking to enhance ‘Mainsail’ by adding to the data sets that feed it. “That’s where a tool like ‘Mainsail’ is very powerful: its ability to be flexible and use data from a number of different sources,” said Cdre Williams. “We have the data we generate ourselves, but we’re also looking at commercial data sets and from different sensor packages etcetera to be able to really enhance our understanding.”
‘Mainsail’ is one of several examples of how MARCOM recognises the need for ‘Baltic Sentry’ to integrate technology that is agile and responsive to the evolving threat.
Cdre Williams highlighted areas of continuing technology focus.
“One is ensuring our understanding is persistent – so, how do we gain a persistent understanding of the operational environment?” he said. New technology is crucial here, offering systems and sensors that can provide more persistent coverage and can enable response over a larger area at any time. Such capacity in turn generates larger amounts of data to collect, analyse, understand and distribute. “So we need those smart, AI-enabled systems like ‘Mainsail’ to help us make sense of that data,” he explained.
In developing information from the data and then sharing it across NATO allies and other stakeholders to support decision-making for CUI and other MSA tasks, ‘Mainsail’ underlines MARCOM’s role as a maritime information-sharing ‘hub’, bringing allies together through sharing a common operational picture (COP), Cdre Williams added.
“When we talk about being a ‘hub’, … we’re very much talking about being the info-sharing hub,” the commodore said. “However, we’ve always been what I would call a ‘convening authority’ for things like technology, so talking about the best way to do things, about concepts, about best practices is a role we have always played and continue to play.”
“We can create the space to have those conversations and conduct that co-ordination,” he added.
MARCOM’s impact is also reflected in the fact that ‘Baltic Sentry’, for example, is now used as a template for developing other presence and understanding activities. Task Force X Baltic is expanding its ‘footprint’ into other regions, including the Adriatic and Arctic. Moreover, responding to NATO needs early in 2026 to strengthen presence around the Greenland-Iceland-UK (GIUK) gap and into the High North, NATO established its ‘Arctic Sentry’ activity, which will again see regional states, MARCOM SNFs and new technologies all integrating to build presence, surveillance and deterrence.
