On December 19, 2024, Russia launched the largest cyberattack on Ukraine’s National Information Systems (NAIS) websites and the Ministry of Justice. The attack resulted in the loss of access to approximately 60 state registries and the temporary suspension of services related to data identification or verification. It took over a month to restore full functionality, with the Ministry of Justice reporting that all registries were back to normal on January 20, 2025.
Such attack on these websites was just one episode in the ongoing, large-scale Russian-Ukrainian cyberwar, which began in 2014. That year, alongside attempts to implement the “Russian Spring” scenario, the Russians carried out a series of DDoS attacks and attempted to influence the results of Ukraine’s presidential elections.
Russian hackers, operating under the supervision of the FSB, represent a serious global threat, with the U.S. among the prime targets. In 2021, the Russian hacker group DarkSide attacked the Colonial Pipeline, which delivers fuel to the U.S. East Coast. The attack forced American authorities to shut down the entire pipeline, causing millions in losses.
Since the onset of full-scale war, Ukraine has faced a continuous barrage of Russian cyberattacks. In 2022 and 2023 alone, Russia launched 2,194 and 2,544 attacks, respectively, most aimed at government bodies and local authorities. Before the assault on state registries, the largest cyberattack came in December 2023, when hackers breached the mobile operator Kyivstar, disrupting service for over 20 million subscribers.
The most active group behind these attacks is UAC-0010 (Armageddon), responsible for more than a hundred cyberstrikes each year. According to the State Scientific Research Institute of Cybersecurity Technologies and Information Protection, many members of this group are former officers of the SBU’s Main Directorate in Crimea who defected in 2014 to serve the FSB.
Battlefield experience
In these challenging times, not just state institutions but virtually any Ukrainian business is vulnerable to attacks from enemy hackers. This has led to a surge in demand for cybersecurity services, which in turn has driven rapid growth in the industry. Between 2016 and 2024, the value of services in Ukraine’s cybersecurity market rose from $22 million to $138 million. Yet, despite this fast-paced expansion, we still trail behind markets like Poland ($800 million), Germany ($8 billion), and the global leader, the United States ($81 billion).
A report from the DataDriven research centre highlights the significant disruptions the Ukrainian cybersecurity market faced between 2020 and 2022. In 2020, growth slowed sharply as businesses affected by COVID-19 had to cut back on non-essential spending. However, by 2021, growth picked up again due to a rise in cybercrime. The biggest spike came in cloud security services, driven by the shift to remote work. In 2022, the market slowed once more due to office relocations and closures, though these losses were partly offset by rising government demand.
The state of full-scale cyberwar has been the key catalyst behind the rapid growth of Ukraine’s cybersecurity market.
Ukrainian cybersecurity experts, working under the daily pressure of an ongoing war, are now among the most experienced in the world. The country’s cyber defence methods have even become a focus for specialists globally. Another key factor driving this growth is the continued digitisation of government operations and private sector services.
Cybersecurity startups can benefit from state support through the Brave1 accelerator, which offers grants ranging from $12,000 to $194,000. The Ukrainian Startup Fund also provides up to $35,000 in funding. Additionally, USAID, now closed, was once a major provider of grants. However, with foreign cybersecurity firms currently dominating the market, Ukrainian startups face considerable challenges in scaling quickly. These include a shortage of specialised teams, limited competitive advantages, and the complexity of the industry.
Despite these hurdles, there are notable success stories. Startups such as Osavul, which analyses text, video, and audio data on websites and social media to identify online threats, Mantis Analytics, which leverages artificial intelligence to help organisations scale and protect assets, and SOC Prime, which offers a marketplace for threat detection solutions, have all secured capital from investment funds.
What’s next?
DataDriven acknowledges the pressing need to stimulate Ukraine’s cybersecurity sector, highlighting that international aid programs, which currently provide the lion’s share of funding for cybersecurity services, tend to favour companies from their own countries, sidelining Ukrainian initiatives. If this trend persists, it risks undermining the growth of the local market. Experts argue that the Ukrainian government must take proactive steps to enhance the competitiveness of its national industry, including localising R&D activities in cybersecurity. This would enable Ukraine to capitalise on its unique expertise and insights in the face of ongoing cyber aggression.
The industry should focus on fostering collaboration through conferences, committees, and networking groups to effectively advocate for its interests. There’s also a strong push for the government to make public-private partnerships a key part of its cybersecurity strategy. The future of Ukraine’s cybersecurity market largely depends on how long the war lasts. As long as hostilities continue, the government will remain the main consumer of cybersecurity services, focused on protecting the information infrastructure of state institutions. However, if the conflict ends, the focus will likely shift to providing cybersecurity solutions for the private sector. Regardless of the outcome, experts stress the need for government support for Ukrainian companies through public procurement while warning against over-regulation that could stifle innovation.
