Learning from Ukraine’s unrivaled experience of Russian cyber warfare

No country in the world today knows more about Russian cyber warfare than Ukraine. The impact of Russia’s invasion offers important lessons for the future of cybersecurity, but further steps are required in order to help Kyiv’s partners make the most of Ukraine’s unrivaled experience.

In the first weeks of Russia’s full-scale invasion, Ukrainian Security Operations Center analyst Oleksandr often slept at the office. “I’d get two or three hours of sleep while the others worked, then we’d swap. That’s how we kept going,” he recalls.

This was the reality of Ukraine’s cyber defenses in February 2022, amid the largest European invasion since World War II. There were no playbooks available back then. The unprecedented scale of the cyber war unleashed by Russia is best illustrated by a conversation Oleksandr recalls with a French colleague, who asked how many cases the Ukrainian team was handling. When he received the answer of fourteen to twenty, he assumed this was the weekly figure. In fact, it was daily.

Over four years later, Ukraine now registers more cyber attacks than ever but suffers far less damage. These trends have been consistent throughout the invasion. Between 2022 and 2024, the number of registered Russian cyber attacks nearly doubled, rising from 2,194 to 4,315. Over the same period, incidents classified as critical or high severity declined from 1,048 to 59.

This record is worth studying in detail. But the most useful thing Ukraine can hand its partners may be a clearer understanding of how Western institutions and businesses can make better use of Ukrainian knowledge to counter the Russian threat.

As the world watches the Russian invasion of Ukraine unfold, UkraineAlert delivers the best Atlantic Council expert insight and analysis on Ukraine twice a week directly to your inbox.

Experts including Eduard Chornyi at Kyiv’s SET University have found that Russian cyber operations against Ukraine often reappear elsewhere, run in parallel, or produce effects across the wider Euro-Atlantic environment. This pattern has been identified again and again in recent years, particularly in nearby EU member states.

With this in mind, it is crucial to treat Ukrainian data as a detection resource and not a news story. Regular access to Ukrainian insights is important as this feeds directly into systems that help identify the next attack in ways that annual government and industry briefings cannot.

Ukraine’s experience also highlights how closer international cooperation is a key aspect of cyber security. A joint advisory issued by Western agencies in April 2026 describes Russian military intelligence targeting Western logistics and technology companies supporting Ukraine. The same campaign, the agencies assess, likely involved efforts to compromise internet-connected cameras near border crossings, military installations, and railway stations in Ukraine and in neighboring NATO states.

In order to address international threats of this nature, individual countries need to be able to compare notes with counterparts in a matter of hours rather than weeks. Most Western institutions are organised to receive briefings instead of coordinating responses in real time, which makes this a structural gap rather than a knowledge issue. Cyber coordination on critical infrastructure protection is also sometimes subject to underfunding and staffing shortages.

Public institutions and private companies should be aware that they can suffer serious damage from cyber attacks, even if they are not the original targets. Organizations therefore need to map out everything they depend on digitally, not only what they own. The technological dependencies of organizations could expose them to unexpected risk.

Eurasia Center events

Ukraine’s partners already recognize the value of the country’s cyber warfare experience. Ukrainian specialists are often invited to attend international events and share their knowledge, but there is still some reluctance to implement key lessons. This makes it more difficult to learn from Ukraine.

One solution could be staging multilateral cybersecurity exercises led by Ukraine. Many similar events already take place each year, bringing together Western partners and often featuring Ukrainian participation. But Ukraine has not yet been invited to set the scenario. This has to change. Ukraine’s unique experience makes the country the natural choice to design and lead realistic cybersecurity exercises.

The capability is already there. Ukraine can draw on an unprecedented quantity of documented cyber warfare incidents. Ukrainian cyber security companies have spent years converting their experience of dealing with Russian attacks into training material. Taking the lead in international training exercises is the obvious next step.

Ukraine is already building its own training infrastructure. The country’s State Service of Special Communications and the Ministry of Digital Transformation have launched the CISO Campus initiative, a national platform for training cyber defense leaders. A number of Ukrainian universities are also offering specialized training based on the latest developments in cyber warfare.

Russia’s full-scale invasion of Ukraine represents a watershed moment for cybersecurity. Ukraine’s partners should be looking to make much better use of Kyiv’s unprecedented practical experience. In order to maximize benefits, the emphasis should be on joint training programs, shared incident analysis, and exchange of applied research between Ukrainian and Western institutions. At present, none of this is taking place at a scale that reflects the significance of the threat.

Iryna Volnytska is President of SET University in Kyiv and founder and CEO of IronCyber.

Further reading

The views expressed in UkraineAlert are solely those of the authors and do not necessarily reflect the views of the Atlantic Council, its staff, or its supporters.

The Eurasia Center’s mission is to enhance transatlantic cooperation in promoting stability, democratic values, and prosperity in Eurasia, from Eastern Europe and Turkey in the West to the Caucasus, Russia, and Central Asia in the East.

Image: IMAGO/Alexander Limbach via Reuters Connect