{"id":1087467,"date":"2025-11-20T11:53:54","date_gmt":"2025-11-20T10:53:54","guid":{"rendered":"https:\/\/pulse.microsoft.com\/?p=1087467"},"modified":"2025-11-21T15:12:09","modified_gmt":"2025-11-21T14:12:09","slug":"fa2-old-assumptions-wont-protect-us-lessons-from-ukraines-digital-frontline","status":"publish","type":"post","link":"https:\/\/pulse.microsoft.com\/da-dk\/transform-da-dk\/government-da-dk\/fa2-old-assumptions-wont-protect-us-lessons-from-ukraines-digital-frontline\/","title":{"rendered":"Old Assumptions Won\u2019t Protect Us: Lessons from Ukraine\u2019s Digital Frontline"},"content":{"rendered":"

Microsoft\u00a0<\/span>Ukraine\u2019s\u00a0<\/span>GM on\u00a0<\/span>c<\/span>ybersecurity,\u00a0<\/span>i<\/span>nterdependence<\/span>,<\/span>\u00a0and Europe\u2019s\u00a0<\/span>n<\/span>ew\u00a0<\/span>r<\/span>eality<\/span><\/strong><\/p>\n

When a missile hits a dam,\u00a0<\/span>it\u2019s<\/span>\u00a0called an act of war. But what if the same dam is disabled by a cyberattack<\/span>\u00a0<\/span>with the same catastrophic consequences?\u00a0<\/span><\/span><\/span><\/p>\n

Leonid\u00a0<\/span>Polupan<\/span>, General Manager for Microsoft Ukraine,\u00a0<\/span>doesn\u2019t<\/span>\u00a0ask the question to provoke. He asks because\u00a0<\/span>it\u2019s<\/span>\u00a0already happening.<\/span><\/span>\u00a0<\/span><\/p>\n

A striking example occurred in Norway in April 2025, when hackers remotely triggered a floodgate at the Lake Risevatnet Dam, releasing massive volumes of water before the breach was stopped. Norwegian authorities later attributed the attack to pro-Russian actors. No lives were lost, but the incident underscored how digital attacks can have very real, physical consequences.\u00a0<\/span>\u201cWe\u2019re living in a hybrid world”, Leonid begins.\u00a0<\/span><\/p>\n

\"\"<\/p>\n

 <\/p>\n

\u201cIn the weeks leading up to the full-scale invasion of Ukraine, we saw a dramatic spike in cyberattacks. At one point, Ukraine was the second most attacked country in the world. Cyber was the first wave. Softening the infrastructure, creating confusion, and weakening systems before anything happened on the ground.\u201d<\/span>\u00a0<\/span><\/p>\n

As Europe continues to face increasing geopolitical and digital uncertainty, Leonid\u00a0Polupan\u00a0offers a rare perspective shaped by war, technology, and a deep belief in resilience. His main message to Europe: Stop looking at the world through a traditional lens. The assumptions of the past no longer apply.<\/span>
\n<\/span><\/p>\n

We\u2019re<\/span>\u00a0<\/span>a<\/span>ll\u00a0<\/span>c<\/span>onnected<\/span><\/span><\/span><\/span><\/h2>\n

 <\/p>\n

Leonid\u00a0Polupan\u00a0is\u00a0clear in his position:<\/span><\/p>\n

\n

\u201cNo country or organization can\u00a0operate\u00a0in isolation anymore.\u00a0We\u2019re\u00a0all connected\u00a0and dependent on each other.\u201d
\n<\/span><\/p>\n<\/blockquote>\n

– Leonid Polupan<\/p>\n

The implication is profound. Sovereignty\u00a0can\u2019t\u00a0be achieved in digital\u00a0isolation, because\u00a0no profession, no sector, and no country is immune to hybrid threats. Denmark, he says, is a prime example of this paradox.<\/span>\u00a0<\/span><\/p>\n

\u201cDenmark is perfectly calibrated and integrated into the global economy. That comes with risks. But the answer\u00a0can\u2019t\u00a0be\u00a0isolation. The better answer is smart interdependence,\u201d Leonid\u00a0Polupan\u00a0argues.<\/span>\u00a0<\/span><\/p>\n

He warns against the illusion of complete self-sufficiency in cybersecurity. The digital infrastructure that underpins societies and economies is deeply interconnected. That means if one organization, system, or supplier is compromised, the effects can ripple across interconnected infrastructure. But Leonid\u00a0Polupan\u00a0argues that this is precisely where the strength of cloud technology lies. By\u00a0operating\u00a0in the public cloud, organizations can tap into a global, constantly evolving security model,\u00a0one that\u00a0benefits\u00a0from the scale, responsiveness, and collaborative intelligence of a worldwide network. Rather than\u00a0vulnerability, shared infrastructure becomes a force multiplier for resilience.<\/span><\/p>\n

 <\/p>\n

Searching for\u00a0<\/span>l<\/span>ogic in\u00a0<\/span>c<\/span>haos\u00a0<\/span>i<\/span>s\u00a0<\/span>h<\/span>olding Europe\u00a0<\/span>b<\/span>ack<\/span><\/span><\/span><\/span><\/span><\/h2>\n

 <\/p>\n

Much of Leonid\u00a0Polupan\u2019s\u00a0concern centers around how slowly\u00a0European\u00a0institutions are adapting to the reality of modern digital conflict.<\/span>\u00a0<\/span><\/p>\n

\u201cWe still think\u00a0in\u00a0the logic of the 1990s. We look for rational explanations behind irrational acts. But there is no logic behind\u00a0the\u00a0bombings.\u00a0They are\u00a0about power, not purpose,\u201d he says.<\/span>\u00a0<\/span><\/p>\n

He contrasts Europe\u2019s cautious, rules-based approach with hostile actors who weaponize new tools instantly. While European legislation is debated and refined over\u00a0years, other actors act without delay. In Leonid\u2019s words, \u201cOn the other side of the world, they take the tools and use them. Immediately.\u201d<\/span>\u00a0<\/span><\/p>\n

He also points to legislation that\u00a0hasn\u2019t\u00a0caught up with technological realities. “Cloud doesn\u2019t work like traditional procurement.\u00a0It\u2019s\u00a0a toolbox. But if the rules make you pick specific tech in advance, you\u2019re already behind.”<\/span>\u00a0<\/span><\/p>\n

This is especially visible when it comes to cloud security. Ukraine\u2019s government made the decisive move to\u00a0evacuate\u00a0data\u00a0to public cloud platforms early in the war. The result: enhanced resilience, flexibility, and access to global support\u00a0when it was needed the most.\u00a0<\/span>\u00a0<\/span><\/p>\n

In one case, a Ukrainian state-owned energy grid operator was driving around the country with satellite dishes on their cars, balancing the national grid after their datacenter was bombed.\u00a0They had\u00a0luckily\u00a0already migrated to\u00a0Microsoft\u00a0Azure.<\/span>\u00a0<\/span><\/p>\n

\u201cEverything starts from cyber. If your cyber is down, everything is down.\u00a0That\u2019s\u00a0where the attack starts,\u00a0and\u00a0that\u2019s\u00a0where the\u00a0defense\u00a0must\u00a0start too,\u201d he insists.<\/span>
\n<\/span><\/p>\n

The<\/span>\u00a0<\/span>d<\/span>efinition of \u2018Critical Infrastructure\u2019\u00a0<\/span>h<\/span>as\u00a0<\/span>c<\/span>hanged<\/span><\/span>\u00a0<\/span><\/p>\n

 <\/p>\n

One of the starkest lessons from Ukraine is that critical infrastructure\u00a0isn\u2019t\u00a0just about energy\u00a0or defense anymore.<\/span><\/p>\n

 <\/p>\n

\n

\u201cIn Ukraine, the first target wasn\u2019t military, it was logistics. Parcel companies, our local Amazons, even seed distributors. Suddenly, private delivery firms became essential infrastructure”<\/span><\/p>\n

 <\/p><\/blockquote>\n

– Leonid Polupan<\/span><\/p>\n

 <\/p>\n

Agriculture, retail, and even cloud engineers became part of the frontline of national resilience. The danger, Leonid\u00a0Polupan\u00a0warns,\u00a0is in\u00a0assuming that ‘non-critical’ means ‘non-targeted.’ \u201cHackers often\u00a0don\u2019t\u00a0care who you are. They care about what you connect to,\u201d he explains. \u201cIf you think\u00a0you’re\u00a0not\u00a0critical, you may not invest in protection. But that makes you the perfect entry point.\u00a0You\u2019re\u00a0not necessarily attacked because\u00a0you\u2019re\u00a0important, but because\u00a0you\u2019re\u00a0a door to someone\u00a0or something that\u00a0is.\u201d This mindset has left countless organizations exposed in the past, and\u00a0it\u2019s\u00a0one of the key blind spots Europe must urgently address.<\/span>\u00a0<\/span><\/p>\n

\u201cCybersecurity is\u00a0sometimes\u00a0called overrated. But\u00a0it\u2019s\u00a0not.\u00a0It\u2019s\u00a0just under-practiced. The biggest problem? The gap between what we say and what we\u00a0actually do,\u201d Leonid\u00a0Polupan\u00a0says bluntly.<\/span><\/p>\n

 <\/p>\n

A\u00a0<\/span>s<\/span>toic\u00a0<\/span>m<\/span>indset<\/span><\/span>\u00a0<\/span><\/span><\/h2>\n

 <\/p>\n

Throughout the conversation, Leonid projects a calm rooted in stoic philosophy.\u00a0\u201cYou\u00a0must\u00a0accept\u00a0the reality. Not\u00a0necessarily\u00a0agree with it,\u00a0but accept it,\u201d he says. \u201cYou\u00a0can\u2019t\u00a0control everything. But you can control your mindset, your education, and how prepared you are to help others.\u201d<\/span>\u00a0<\/span><\/p>\n

He is optimistic, not because the threats are small, but because collaboration and learning are\u00a0possible. But his\u00a0key message to Europe is clear: cybersecurity is not a department. It is a mindset. One that must be embraced now, not later.\u00a0\u201cThe world has changed dramatically. If we keep behaving like it\u00a0hasn\u2019t,\u00a0we\u2019re\u00a0building vulnerability into the system by design,\u201d he\u00a0concludes.<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft\u00a0Ukraine\u2019s\u00a0GM on\u00a0cybersecurity,\u00a0interdependence,\u00a0and Europe\u2019s\u00a0new\u00a0reality When a missile hits a dam,\u00a0it\u2019s\u00a0called an act of war. But what if the same dam is disabled by a cyberattack\u00a0with the same catastrophic consequences?\u00a0 Leonid\u00a0Polupan, General Manager for Microsoft Ukraine,\u00a0doesn\u2019t\u00a0ask the question to provoke. He asks because\u00a0it\u2019s\u00a0already happening.\u00a0 A striking example occurred in Norway in April 2025, when hackers remotely triggered […]<\/p>\n","protected":false},"author":871,"featured_media":1087863,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1902],"class_list":["post-1087467","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-transformation-da-dk","specials-transform-da-dk","verticalIndustries-government-da-dk","stories-data-insights-intelligence-da-dk","stories-hvordan-far-jeg-indsigt-fra-mine-data","stories-how-can-i-use-ai-da-dk-data-insights-intelligence-da-dk","businessPriorities-data-ai-da-dk"],"_links":{"self":[{"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/posts\/1087467"}],"collection":[{"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/users\/871"}],"replies":[{"embeddable":true,"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/comments?post=1087467"}],"version-history":[{"count":12,"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/posts\/1087467\/revisions"}],"predecessor-version":[{"id":1087895,"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/posts\/1087467\/revisions\/1087895"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/media\/1087863"}],"wp:attachment":[{"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/media?parent=1087467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pulse.microsoft.com\/da-dk\/wp-json\/wp\/v2\/categories?post=1087467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}