Cybersecurity in the defence domain

The war in Ukraine, rising tensions in the Baltic region and instability along NATO and EU eastern borders mark a period of structural unrest. Where attention once focused on physical threats, the digital battlefield is now a full operational domain within defence. Cyber warfare is no longer an addition to traditional warfare but an integral part of it. Digital events therefore have direct consequences for physical security and national operational capability.

Explanation

State actors, particularly Russia and China, are intensifying digital operations targeting Europe. These operations are broader, more persistent and more advanced than traditional espionage. Russian activity combines military GRU operations with semi-state hacktivists capable of destructive attacks, while China takes a long-term approach to intellectual-property theft and strategic access to critical infrastructure. The distinction between state actors and criminal groups is fading as governments increasingly use proxies and contracted capability.

Risk

Common methods include supply-chain compromise, Living off the Land to evade detection, zero-day exploits for access and persistence, destructive wiper malware such as NotPetya and HermeticWiper, and information operations intended to destabilise public opinion, decision-making and command structures. Because these techniques target systems, people and decision-making simultaneously, defence in only one domain is insufficient.

Points to check

• Smaller or less secure suppliers that may provide access to core defence systems.
• Dependence on non-European technology and standards.
• Continuity of expertise through training and retention of specialist personnel.
• The convergence of hybrid IT and OT environments typical of defence networks.

Approach

Defence organisations strengthen their position by combining tactical resilience with strategic autonomy. This requires investment in European cryptographic standards, sovereign SOC and threat-intelligence capability, cross-border cooperation and specialists with defence and OT knowledge. Resilience must be continuous rather than a one-off assessment. Suppliers should meet demanding standards, supported by segmentation, Zero Trust and mandatory penetration testing.

Conclusion

Cyber warfare is a daily reality. The offensive capability of state actors is real and recurring, and supplier resilience is integral to the overall security posture. Europe must invest in its own expertise, tooling and operational structures. DeepBlue is ready to act as an independent, technically advanced partner within the defence domain.

Contact

Want to understand the impact in your own environment? Contact DeepBlue Security & Intelligence at info@deepbluesecurity.nl or +31 (0) 70 290 6 290.