What Russia's war in Ukraine still teaches us about cyber resilience

More than four years after Russia’s full-scale invasion of Ukraine, the conflict continues to shape how governments think about cyber warfare. Increasingly, it is also influencing how organisations should approach cyber resilience.

 

A recent analysis by the Jamestown Foundation found that Chinese military researchers have closely studied Russia’s cyber campaign, not because it was overwhelmingly successful, but because of where it fell short. Their conclusion is that future cyber conflicts will demand stronger coordination, greater resilience and faster response than many countries currently possess. Those lessons extend well beyond the battlefield.

 

One of the biggest findings is that cyber operations alone rarely decide the outcome of a conflict. Russia launched destructive malware, targeted communications infrastructure and attempted to disrupt critical services before and during its invasion. Yet Ukraine maintained government operations, kept essential services online and restored systems quickly with support from allies and the private sector.

 

For businesses, resilience matters as much as prevention.

 

The ability to recover quickly from an attack is becoming just as important as stopping one in the first place. Organisations should assume that some attacks will succeed and build plans that minimise disruption when they do.

 

The report also highlights the importance of unified command. Chinese analysts criticised Russia’s fragmented approach to cyber operations and argued that future campaigns require tighter coordination between military, intelligence and civilian organisations.

 

The same principle applies inside enterprises. Security, IT, legal, communications and executive teams cannot operate in isolation during a cyber incident. Delays caused by poor coordination can have a greater impact than the attack itself.

 

Critical infrastructure remains another key lesson.

 

The conflict has demonstrated how power grids, telecommunications, transport and satellite communications can all become cyber targets during geopolitical crises. While few organisations operate national infrastructure, many form part of wider supply chains that support essential services. That makes resilience across suppliers and third parties increasingly important.

 

The analysis also points to the growing importance of technological independence. Chinese researchers argue that reducing reliance on foreign technology and strengthening domestic capabilities will be essential in future conflicts. Although most private organisations cannot completely avoid global technology suppliers, the principle reinforces the need to understand dependencies, diversify critical systems and prepare contingency plans for supplier disruption.

 

Perhaps the most important lesson is that cyber warfare is no longer separate from conventional conflict. Digital attacks are now integrated with military operations, intelligence gathering and information campaigns. They are designed to create confusion, delay decision-making and undermine confidence before physical attacks even begin.

 

Security leaders are already seeing similar tactics outside wartime. State-backed groups continue to target governments, critical infrastructure and private organisations through espionage, supply chain attacks and credential theft. The techniques differ, but the objective remains the same: exploit weaknesses before defenders can respond.

 

Russia’s invasion of Ukraine has become one of the most closely studied cyber conflicts in history. The lesson for enterprises is not that they should prepare for war. It is that resilience, coordination and rapid response have become strategic advantages.

 

As geopolitical tensions continue to influence the cyber threat landscape, organisations that invest in those capabilities will be better placed to withstand whatever comes next.