Cyber Warfare Resilience.

The association’s role

The National Cybersecurity Association of Ukraine is an association of experts and market participants and a collaboration platform. In this area it brings expertise together for the resilience of civilian digital systems: the ones that people, businesses and community organisations rely on every day.

The foundation is public-private collaboration: an exchange of experience among public bodies, the private sector and practitioners on how civilian systems keep working during cyber incidents. There is no formal public-private partnership contract.

The association does not respond to incidents or provide technical defence. Incidents are handled by the competent authorities, whose contacts are listed below. An expert council or working group for this area is only proposed.

Cyber operations in wartime: the official framing

At a discussion in June 2026, the secretary of the National Coordination Center for Cybersecurity (NKCK) said that cyberspace has become a full theatre of military operations ¹. These are his words, not a finding of the association. A deputy minister of digital transformation likewise stressed that in wartime cyber and online safety are part of national resilience ².

ENISA offers the European view. Its Threat Landscape 2025 covers 1 July 2024 to 30 June 2025, analyses 4,875 incidents and was revised to version 1.3 on 22 September 2026. It distinguishes state-aligned espionage, ransomware and other crime, and hacktivism ³.

Hybrid threats: hacks, leaks, fake content and pressure together

Hybrid threats combine several tools at once: cyberattacks, data leaks, forged material and information pressure. For the information side, the EEAS frame is useful: foreign information manipulation and interference (FIMI) is manipulative, intentional and coordinated behaviour that is mostly not illegal, and it is carried out by state or non-state actors ⁴.

ENISA also describes hacktivist campaigns that follow political triggers, including declarations of support for Ukraine. About 80% of the incidents in its report are hacktivism, and most are low-level DDoS attacks with very low impact ³. This is used only to explain the pattern, and no groups are named. For the information side in more depth, see the Information Integrity page.

What cyber resilience means for civilians

The draft Cybersecurity Strategy 3.0, discussed on 13 June 2026, shifts the emphasis from waiting for incidents to proactive cyber defence, with a focus on resilience, AI-related threats and implementing European law such as NIS2 ¹. It was a draft at the time of that discussion. Check the official sources for its current status.

The EU4CyberUA project, launched in June 2026, aims to strengthen Ukraine’s cyber resilience. The State Service of Special Communications (Derzhspetszviazok) is its key Ukrainian partner ⁵.

For this text the association’s working definition is used: cyber resilience is the ability to keep doing the essential things during and after a cyber disruption, and to recover quickly. In practice that means backups you can restore, accounts you can recover, a way to reach people when systems fail, and a plan that has been tested at least once ⁶⁸.

The preparedness minimum

The UK NCSC’s small business guide (reviewed 21 July 2026) centres on backups, protecting devices and accounts, and spotting scams. Many steps take about five minutes, and cyber security is everyone’s business ⁶⁷.

CISA’s #StopRansomware guide (updated September 2023) advises restoring from offline, encrypted backups, isolating affected systems, preserving logs and images, reporting, and documenting lessons learned ⁸.

• Backups you have actually tried to restore ⁸.
• Protected accounts: multi-factor authentication and a sensible recovery plan (see our guide on protecting accounts and identity).
• A written rule for AI tools (see the page on AI security).
• A short list of people and ways to reach them when the main systems are down.

If you are attacked

Organisations should contact CERT-UA early. It is not a punitive body; isolate the network first and have logs and suspicious files ready. If you can make contact in advance, before an incident, the process may go faster: without prior contact it may take longer ⁹.

Individuals and small businesses can use the Cyber Police form on its website or its declaration page ¹⁰. Keep evidence: logs, images of systems, suspicious files ⁸.

Reading threat reports without panic

A report is a summary as of a date, not a forecast for your office. Check the period the document covers and its version: ENISA, for instance, reissued its 2025 report in September 2026 ³. The association does not publish indicators of compromise.

Policy watch

As of 22 October 2026: the draft Cybersecurity Strategy 3.0, discussed in June 2026 ¹, and the EU4CyberUA project, launched the same month ⁵. Each item is re-checked at every review of this page.