The war that redefined cyber war: Russia, Ukraine and the gap between theory and practice

Abstract

This article examines the Russia-Ukraine war as an empirical stress test for dominant theoretical assumptions about cyber warfare. Drawing on a quantitative analysis of cyber incidents reported by Ukraine’s Computer Emergency Response Team and structured qualitative assessment of the conflict’s most significant operations, it identifies a paradox: Russian offensive cyber activity has been quantitatively prolific yet strategically marginal when compared to conventional kinetic means. Even the most destructive attacks produced effects that were temporary, reversible and localised, whereas kinetic strikes against the same categories of targets caused permanent, systemic damage. The article identifies four mutually reinforcing explanations: the structural constraints inherent to offensive cyber operations, the effectiveness of Ukraine’s whole-of-society defensive ecosystem built through prior preparation and international cooperation, the functioning of cross-domain deterrence in conditions where attribution ambiguity dissolves and Russian organisational dysfunction in cyber-kinetic integration. The findings challenge the assumption that offensive cyber operations alone can generate effects comparable to those in the traditional domains of warfare. However, the analysis also reveals that defensive cyber operations have contributed materially to Ukraine’s wartime survival, suggesting that the strategic value of the cyber domain lies primarily in enabling resilience and intelligence collection rather than in independent infrastructure destruction.