What the cybersecurity sector can learn from the digital battlefield in Ukraine

Modern warfare is hybrid. It no longer consists solely of tanks and troops, but also of cyberattacks, electronic warfare, and autonomous drones. “Command & control is central: the real-time integration, fusion, and analysis of data from diverse sources,” says Henri van Soest of research organization RAND Europe.

Henri van Soest is a research leader at RAND Europe and Professor of Policy Analysis at the RAND School of Public Policy. There he leads research into emerging and disruptive technologies in the fields of defense and security. His recent research focuses on the deployment of AI in critical national infrastructure.

According to Van Soest, Ukraine functions as a “living laboratory” in which new digital defense concepts are tested and adapted at an accelerated pace under extreme pressure.

The direction is bottom-up
At Cybersec Europe 2026, Van Soest will take visitors to the digital frontline in Ukraine on May 20 with his keynote, “The future of warfare: lessons from the digital frontline in Ukraine.”

Van Soest emphasizes that Ukraine’s approach is based on a bottom-up model in which decentralized producers develop low-cost, modular, and resilient systems. This tactic stands in stark contrast to traditional hierarchical military structures, yet it has proven itself in practice.

Ukraine’s defense is also a matter of resilience and robustness. The fact that the EU recently consulted Ukraine for its expertise in cybersecurity—particularly its approach to drones—is telling in this regard. For the cybersecurity sector, this underscores the importance of speed, scalability, and adaptability.

Drawn into the conflict
A striking lesson from the digital battlefield in Ukraine is the shift within the defense industry. Systems that were once exclusively military now depend on a complex network of public and private actors. Many tech companies are also involved in this conflict. This interdependence introduces new vulnerabilities, but also opportunities for innovation.

Ukraine has been drawn into the digital struggle, although vigilance remains essential—for every country, at all times. “Building a vigilant and adaptive cyber culture begins in peacetime,” he states. Here too lies a parallel with the business world, where cyber resilience is still too often approached in a reactive and incident-driven manner.

Three trends
Van Soest highlights three urgent trends: the impact of AI systems on cybersecurity, the necessity of “secure by design” software, and the importance of structured knowledge sharing.

Looking ahead, the researcher foresees increasing dependence on space-based infrastructure and more autonomous unmanned vehicles. At the same time, he advocates reintroducing “reversionary modes”: manual alternatives for critical systems when digital networks fail. That, too, is a lesson Ukraine has taught us.

Henri van Soest will deliver his keynote on day one of Cybersec Europe, at 12:40 p.m. on the main stage.