Hackers associated with the FSB secret service or the Russian General Staff are unleashing AI tools to break into Ukrainian IT networks. Once inside, Russian AI agents move on their own from machine to machine and report back to human operators, who then decide whether to steal data, plant malware, or shut down the service.
AI allows for cheap, fast cyber-attacks. While hackers previously used the technology for isolated tasks like writing phishing emails, AI is behind a 2500% increase in low-severity attacks for the first half of 2026, compared to the previous year.
Targets range from law enforcement agencies to private notaries and medical institutions. Some attacks jam military mobile devices. Others generate fake air raid alerts. And still others steal geolocation, photos, contacts, and call logs.
Ukraine’s defenders are rushing to adapt, also leveraging AI. Bug hunters paid to find weaknesses use AI to scan government agency networks. Since they can surface false alerts, AI tools sift through them to identify genuine threats. Ukraine’s defenders rely on small, specialized AI models, allowing small teams of engineers to defend large units of soldiers. AI crunches through huge databases, mapping connections that would have taken days to analyze manually.
When Russia launched its full-scale invasion in February 2022, Ukraine’s cyber defenses had already been hardened by more than a decade of attacks on its electric grids. After the invasion, thousands of Ukrainian IT specialists volunteered. Most came through an informal professional community of private sector practitioners. When threats were spotted, volunteers were matched to tasks by skill, with no formal hierarchy. This early informal mobilization ran on trust: specialists coordinated through chat groups and personal contacts, not through a military chain of command.
Yet wartime goodwill does not represent a viable permanent operating model. Volunteers tire; they move on. Formal coordination bodies now exist, but they have yet to match the speed of the informal networks. Ukraine’s current challenge is to build structure, without slowing down by replacing trust with hierarchy.
In contrast, European and American cyber defenses have been designed for peacetime and treat compliance as a paper-pushing exercise. US cyber is top-down, whereas Ukraine’s is bottom-up. Washington organizes cooperation between government and the private sector around 16 critical infrastructure sectors. Banks share threat information with banks, energy companies with energy companies, and each sector works with a lead agency, such as the Treasury for finance, backed by the Cybersecurity and Infrastructure Security Agency.
The US should take three steps.
First, it must move from sharing information to working side-by-side with allies: establish joint security operations centers where government analysts and private sector specialists watch the same networks in real time, starting with finance, where trust is highest. Governments cannot defend what they cannot see.
Second, require the largest companies in each sector to help their smaller suppliers raise their defenses. Attackers increasingly enter through the weakest supplier.
Third, conduct emergency tests. US law grants the government authority to direct the response to a major cyber crisis, but these powers have never been put into practice. Regular exercises should be organized with industry, so that everyone knows who decides what when a real attack comes.
Europe also needs to boost its preparedness. The Cyber Solidarity Act sets out how the European Union’s 27 members help one another in a major incident, with a network of security operations centers, an emergency mechanism, and a reserve of trusted private providers.
The bloc must now make the regulation operational. EU technical standards take around six years to agree upon, often arriving after the laws that they support take effect. Cybersecurity agencies should not only measure process or compliance but also conduct stress tests. The focus should be on exercises and skills, not additional reporting layers.
AI multiplies the danger of cyberattacks. It also multiplies the potential of defenders to respond — if they prepare properly.
Ieva Ilves advises Ukraine’s Ministry of Digital Transformation, leads the CISO Campus initiative in Ukraine, and is a Board Member of Latvia’s National AI center. She has a master’s from Johns Hopkins University SAIS.
Admiral Michael Rogers rose to the rank of four-star admiral through a 37-year career in the US Navy. He served as Commander, US Cyber Command, and Director, National Security Agency.
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
Steel and Silicon: Allied Innovation for the Next Century
2026 CEPA Tech & Security Conference
