Ukraine's Cybersecurity Secrets for European Founders

Jan de Vries · 2026-09-02

Let's be honest, you probably think a major cyberattack would be loud. You'd know right away. But that's not how it works. In 2015, Russian hackers cut power for over 225,000 Ukrainians. They'd been lurking inside those networks for months before anyone noticed a thing. Think about that for a second. By 2024, Ukraine was handling thousands of incidents a year. The number of attacks went up, but the damage went down. How? That's the real story. A report called "Four Years on the Digital Frontline" from IronCyber and SET University dug into it. They found three core habits that made the difference. And these habits are pure gold for any European founder trying to protect their company. ### The Invisible Threat In Your Systems Attackers can be in your house for months before they turn off the lights. Take Kyivstar, Ukraine's biggest mobile operator. Hackers had access for at least seven months. The actual takedown, the part everyone saw, lasted just one day in December 2023 and cut off about 24 million people. They didn't use some crazy, high-tech trick to get in. By late 2023, nearly 40% of incidents involved extortion or theft. Attackers just used whatever worked first: - Compromised employee logins - Exposed edge devices - Buying access from brokers who'd already stolen it Even trusted tools can be a backdoor. In one case, malware was spread through Signal, disguised as a military app. Another attack came through routine-looking admin emails. They didn't hack the software; they hacked the trust. Here's a simple question for your next board meeting: How long would it take you to spot an outsider using a valid login? If you don't know, make finding out your top priority. Because investors and potential buyers will definitely ask. ### Turn Every Attack Into a Lesson Plan Ukraine's progress wasn't just about buying better firewalls. It was about mindset. They treated every single incident, even failed ones, as training material. They'd take it apart, learn from it, and bake those lessons into their procedures. A phishing attack in March changed how they handled the one in April. The result? Serious incidents plummeted from 364 in 2023 to just 59 in 2024. That's the power of a real learning cycle. Unfinished attacker work is incredibly valuable, too. In 2023, they found malware designed to control power grid equipment. It wasn't reliable yet—meaning the attackers were still testing it. For defenders who studied it, that was months of early warning. Your move? Pick three recent cyber incidents from your industry. Write up what happened and walk your team through it. Many national cyber teams publish this stuff for free. Use it. ### Build to Survive the Break Resilience is about planning for the moment your main systems fail. Ukrainian engineers avoided total blackouts by going old-school: manually isolating grid sections and rerouting power. With ransomware, having tested, offline backups is still the only sure way to keep running without paying up. Adaptation was key everywhere. When drone teams lost radio and satellite links to jamming, they switched to fiber-optic cables. Then they developed optical navigation so drones could operate without GPS. It's not just tech, either. Attackers published stolen documents to apply pressure. And they're now using AI to sift through stolen data at terrifying speed. The lesson is clear: build your operations assuming something *will* break. Have a plan B, and a plan C. Your survival might depend on the version of your business that still works when the shiny new tech goes dark.