From the frontline: Ukraine’s cyber learnings for EU founders
In December 2015, Russian hackers managed to cut electricity for about 225,000 customers across three Ukrainian regions. They had been inside those networks for months, and nobody had noticed.
By 2024, Ukraine faced 4,315 registered incidents in a single year, with 59 of them labelled as critical. The previous year saw 2,543 attacks, with 364 considered serious. The number of incidents grew, but the impact was much smaller.
Four years of those incidents are collected in “Four Years on the Digital Frontline“, a report by IronCyber and SET University. Ukraine’s experience led to three core habits: understanding what’s already inside your systems, learning from incidents that have already happened, and keeping operations running when something goes wrong.
Here’s how these lessons apply to European companies.
Someone can hold your systems for months before anything shows
Attackers held access inside Kyivstar, Ukraine’s largest mobile operator, for at least seven months before the takedown. The visible part lasted one day, in December 2023, and cut service to roughly 24 million people.
The attackers didn’t use sophisticated tricks to gain access. By late 2023, about 40% of registered incidents in Ukraine involved extortion or theft of funds. Attackers leaned on whatever got them in first: compromised credentials, exposed edge devices, or brokers selling access someone else had already taken.
Even your own software can be a target. In September 2024, Russian hackers distributed malware via Signal, disguised as a military app called GRISELDA. They also sent files that created secret connections back to their systems, all packaged as routine admin emails. Neither attack exploited a product flaw, they relied on the trust users already had in those tools.
Before your next board meeting, know two things: how many of your systems are accessible from the internet, and how long it would take you to spot an outsider using valid credentials. If you can’t answer the second, make it your top priority – investors and potential buyers will ask the same question.
Every incident, even an unfinished one, became a procedure
Ukrainian cybersecurity progress between 2015 and 2024 wasn’t only about getting better tools. Ukrainian teams treated every incident as material. Each one was taken apart, and what came out went into the procedures, the detection rules and the hardening. The same attack met a prepared system the second time.
A phishing chain that landed in March shaped how the next one was handled in April. Between 2023 and 2024 alone, serious incidents dropped from 364 to 59, which the report puts down to a working cycle of adaptation.
Unfinished attacker work is worth studying too. In 2023, defenders found malware built to send commands to grid substation equipment. It could not run reliably yet, which meant someone was still testing. For anyone who trained against that sample, it was months of warning.
Many national cyber response teams publish the raw material for free. Pick three recent incidents from your sector, write up what happened and walk your team through it
Build the version that still works when the main thing breaks
Ukrainian power engineers avoided total blackouts by going old-school: they isolated sections manually, rerouted power, and used mechanical overrides when control systems failed. With ransomware, having tested backups is still the only sure way to keep things running without giving in to demands.
Drone teams adapted too. When radio and satellite links were jammed, they switched to fibre-optic tethers, then developed optical navigation to keep drones on mission even if GPS was knocked out.
Staying resilient isn’t just about technology. In Ukraine, stolen documents and technical drawings were published deliberately, as pressure. Separately, by 2025 attackers were using AI to work through exfiltrated material and compromised mailboxes at speed, picking out what was worth having. Sorting through a hacked inbox is now cheap and fast for cybercriminals.
So, make sure you have backups you’ve actually restored from, a way for your product to run without its most critical dependency, and have customer communication ready before a crisis hits.
Protect what a competitor would want, not what customers can see
Everything above covers disruption. None of it covers the attack where nothing happens.
In 2024, Russian hackers targeted Ukrainian defence manufacturers for their design data (including sensitive data on weapons and protection technology). There was no ransom demand, no encryption, no visible outage. The damage is deferred. What was taken sits in someone else’s research programme, and you have no way to know it happened.
Many founders lock down their production systems, but leave design files, training data, and test results on shared drives with open access. Do the opposite: lock down sensitive development data and log every access.
Where to start
None of this is theoretical. The substations went dark. The mobile network went down for 24 million people. The malware was found, named and published. And the methods are not confined to Ukraine. Microsoft’s 2025 Digital Defense Report found the 10 countries most affected by Russian cyber activity outside Ukraine were all NATO members, a 25% increase year on year.
Four things are worth doing, and none needs a budget. Write up every incident you handle, including the near misses, and keep those write-ups somewhere engineers actually read them. Benchmark against published reports from other companies in your sector, not against your own last quarter. And when someone makes a call under pressure that turns out wrong, record how the decision was made, not just what the outcome was.
Map what you depend on, not only what you own. Shared suppliers, update channels, satellite links and service providers are how someone else’s incident becomes yours. This is the part almost nobody does thoroughly.
The post From the frontline: Ukraine’s cyber learnings for EU founders appeared first on EU-Startups.