| Spear-phish targeting BDE S6 | Credential harvesting attempt against signal cell. Tests detection workflow and incident reporting. | S6 SIG | LOW |
| ICS network probe | Anomalous SNMP scans against tactical edge router from masked source. | S6 SIG | MED |
| Ransomware on log-cell server | Encryption beacon deployed against LOGSTAT host. Recovery point objective at risk. | S4 / S6 | HIGH |
| GPS jamming | Adversary jamming reduces position fix accuracy to ±60m for mounted maneuver. | S3 OPS | MED |
| SATCOM mimicry | Spoofed beacon attempts to hijack TACSAT downlink. Authentication challenge required. | S6 / S3 | HIGH |
| ISR satellite gap | Adversary maneuver coincides with predicted overhead ISR gap. Tests reliance on alt-PNT and HUMINT. | S2 INTEL | LOW |
| UAS swarm crossing FLOT | Twelve Group-2 UAS detected on low-altitude vector toward FSCL. | FIRES | HIGH |
| Loitering munition on C2 node | Group-3 LM tracking toward TAC CP. ETI 7 minutes. | S3 / FIRES | HIGH |
| Adversary CAS request | Allied air request denied due to airspace deconfliction failure with cyber-spoofed ATO. | FIRES | MED |
| Sustainment convoy ambush | FSC element reports indirect fire vicinity convoy axis. | S4 / S3 | MED |
| Civilian protest blocking MSR | 300+ civilians blocking main supply route. ROE constraints in effect. | S3 / S5 | LOW |
| Bridge denial vicinity NAI-04 | Critical crossing demolished by adversary SOF. Maneuver scheme requires reroute. | S3 OPS | HIGH |
| Port denial via mine threat | Reported sea mines vicinity APOD. Sustainment flow disrupted. | S4 / S3 | HIGH |
| Anti-ship missile threat warning | Maritime ISR detects ASM launcher within range of SPOD. Force protection posture change required. | S2 / S3 | MED |