Lessons from Ukraine on protecting critical infrastructure
Written by Taimar Peterkop, Senior Expert
After more than ten years of sustained, multi-vector Russian attacks, Ukraine offers hard-earned lessons on critical infrastructure protection. For Europe and its partners, learning from Ukraine is no longer optional. It should be seen as essential.
Since the start of Russia’s war of aggression in 2022, Ukraine has endured sustained attacks on its power grid, telecommunications networks, water systems, transport infrastructure and digital services. These attacks have combined missiles, drones, cyber operations and information warfare in an attempt to break the functioning of the state and the resilience of society. Yet despite unprecedented pressure, Ukraine has continued to operate as a state, provide essential services and adapt its systems in real time.
And not only that, Ukraine has continued to develop its digital society, which has only become more effective during the war, proving that digital society can effectively function during full-scale conventional military conflict. This is not accidental. Ukraine’s resilience is the result of deliberate governance choices, institutional reforms, international cooperation and the mobilisation of society.
Critical infrastructure is a primary target
One of the most important lessons that the conflict in Ukraine has reminded us of is that, in conflict, critical infrastructure is not solely a secondary or incidental target. It is a strategic objective. The Russian warfighting doctrine is not just about how to fight the state militarily. These attacks not only aim to degrade military capability but also undermine economic activity and erode civilian morale.
The Ukrainian energy sector illustrates this clearly. Large-scale missile and drone strikes against power plants and substations have caused widespread blackouts, particularly during the winter months. Unlike traditional warfare, where infrastructure damage is often localised or temporary, Ukraine has faced repeated, coordinated waves of attacks designed to overwhelm repair capacity and exhaust resources. As a result, authorities and operators have had to rethink how infrastructure is designed, protected and restored.
Ukraine as a testing ground for cyberattacks
Cyber operations have played a complementary role. Ukraine has been a testing ground for cyberattacks on industrial control systems, government networks and telecommunications providers. The 2015 and 2016 cyberattacks on the Ukrainian power grid were early warnings of what cyber-physical attacks could look like. Since 2022, cyber operations have been integrated into broader military campaigns, targeting situational awareness, coordination and trust.
Importantly, Ukraine’s experience demonstrates that cyber and physical domains cannot be treated separately. Physical damage to infrastructure increases reliance on digital systems for coordination and recovery, while cyber disruptions can amplify the impact of physical attacks. This interconnectedness of cyber and physical domains is a defining feature of modern critical infrastructure risk.
Another key aspect of the threat landscape is uncertainty. Attacks do not follow predictable patterns. Targets change, tactics evolve and defenders must adapt continuously. This has profound implications for how critical infrastructure protection should be organised: static compliance-based models are insufficient; adaptive, learning-oriented systems are required.
Key elements of Ukraine’s response
Governance is central to effective critical infrastructure protection. Ukraine’s experience shows that institutional clarity, coordination and leadership matter as much as technical capability. In wartime, fragmented responsibilities and unclear mandates can be fatal.
Ukraine has progressively strengthened its governance framework by clarifying roles and responsibilities, improving coordination between civilian and security institutions, and integrating cyber and physical protection under a coherent policy, legal and institutional framework. Central authorities set priorities, maintain situational awareness and coordinate response across sectors. A key lesson is the value of a central coordinating body with real authority.
Legal and regulatory frameworks have also evolved. Ukraine has aligned its cybersecurity and critical infrastructure legislation with European standards, even while under attack. This demonstrates that crises can accelerate reform rather than halt it. Clear legal obligations for operators, incident reporting requirements, and defined standards for protection and resilience provide a foundation for coordinated action.
A fundamental shift in thinking
Ukraine’s experience underscores a fundamental shift in thinking: the goal of critical infrastructure protection is not to prevent all disruption, but to ensure continuity and rapid recovery. Perfect protection is impossible under sustained attack. Resilience is the ability to absorb shocks, adapt to changing conditions and continue functioning at an acceptable level.
Redundancy and decentralisation have proven vital. Ukraine has increasingly relied on distributed energy solutions, backup generators, and modular systems that can be repaired or replaced quickly. Centralised, monolithic systems are more vulnerable to targeted attacks. Decentralised systems may be less efficient in normal conditions, but they are far more resilient under stress. The ability to restore functionality quickly can be more important than preventing damage in the first place.
Digital infrastructure under attack
A distinctive feature of Ukraine’s resilience is the role of digital government and information infrastructure. Digital services have enabled continuity of governance, service delivery and communication even when physical infrastructure is damaged. Platforms for public services, identity and communication have reduced dependence on physical presence and enabled rapid adaptation.
However, digital infrastructure is itself critical infrastructure and a prime target. Ukraine’s experience shows that protecting digital government systems requires the same level of attention as energy or transport. Cybersecurity, redundancy and trust are essential. The failure of digital services during a crisis can undermine confidence and coordination.
A vital role for strategic communication
Information integrity is another crucial dimension. Disinformation campaigns aimed at undermining trust in infrastructure providers or government response can magnify the impact of physical disruptions. Ukraine has had to invest in strategic communication and public information as part of its infrastructure protection strategy. Keeping citizens informed reduces panic and enables adaptive behaviour.
Perhaps the most powerful lesson from Ukraine is that critical infrastructure protection is not solely a state challenge; it is a societal one. Infrastructure ultimately exists to serve people, and people play an active role in its resilience.
Public awareness and preparedness have been essential. Ukrainian citizens have learned how to cope with blackouts, conserve energy and adapt daily routines. This adaptive capacity reduces the impact of disruptions and buys time for repair. In contrast, societies unprepared for infrastructure failure may experience disproportionate social and economic damage even from short-term outages.
Trust between citizens, operators and the state is a critical asset. Transparent communication about risks, outages and recovery efforts builds credibility. Ukraine’s experience shows that honesty about limitations can strengthen, rather than weaken, public confidence.
Lessons beyond Ukraine
These lessons extend far beyond Ukraine. Climate-driven disasters, cyberattacks and geopolitical tensions are increasing threats to critical infrastructure everywhere. Ukraine shows what resilience looks like under the most extreme conditions.
Its experience proves that resilience is practical, not abstract, built through governance, technology and society. Countries should learn these lessons now, not after crisis strikes. Investing in resilience before disaster strikes is far less costly than rebuilding after failure.
Ukraine’s experience reminds us that critical infrastructure is not just about systems and assets, but about people, trust and the capacity to adapt under pressure.
As threats continue to evolve, the central question is how societies will respond. Ukraine offers a powerful answer: through coordination, resilience and collective resolve, even the most severe challenges can be endured.