The Fifth Cyber Dialogue between the European Union (EU) and Ukraine, held in Brussels on 9 October 2026, highlighted the growing strategic importance of cyber cooperation within Europe’s evolving security architecture. During the talks, an administrative arrangement was signed between CERT-EU, which is responsible for the cybersecurity of EU institutions, and Ukraine’s State Service of Special Communications and Information Protection (SSSCIP). The arrangement aims to enhance information sharing between CERT-EU and CERT-UA, Ukraine’s computer emergency response team.[i] The dialogue also addressed cyber defence, crisis management, private-sector partnerships, and alignment with European cybersecurity standards. These developments indicate that Ukraine’s ties with the European security architecture are deepening at both the institutional and operational levels.
The Russia-Ukraine War has made cybersecurity a key component of Europe’s shared threat perception. Attacks targeting energy infrastructure, public services, and communication systems have demonstrated that cyber operations can serve as a complement to military operations while directly affecting the continuity of civilian life. Under these circumstances, cyber resilience involves not only preventing attacks but also maintaining essential services and restoring systems to operational capacity. The threats facing Ukraine are also significant in terms of European countries’ preparedness for similar attacks. Therefore, cyber support provided to Kyiv is linked not only to meeting Ukraine’s defence needs but also to strengthening Europe’s collective security capacity.
The foundations of institutional rapprochement between the EU and Ukraine were laid during the early years of the war. In November 2023, the European Union Agency for Cybersecurity (ENISA) signed a working arrangement with Ukraine’s National Cybersecurity Coordination Center and the State Service of Special Communications and Information Protection (SSSCIP) aimed at capacity-building, sharing best practices, and enhancing joint threat awareness.[ii]
The new arrangement in October 2026 focuses specifically on information exchange between CERT-EU and CERT-UA, the teams directly responsible for responding to cyber incidents. This broadens cooperation from general capacity-building objectives towards direct operational coordination. However, the mechanism does not imply that the two parties’ cybersecurity systems are being integrated into a single institutional structure.
One of the notable milestones in this rapprochement was the Council of the EU’s approval, on 15 June 2026, of Ukraine’s access to support from the EU Cybersecurity Reserve. Decision 2026/1354 established the legal basis for Ukraine to benefit from the incident response services provided under the reserve when addressing large-scale cyber incidents.[iii] The reserve, operated by ENISA, incorporates the expertise of trusted private-sector providers into cyber crisis response and recovery processes. This extends Europe’s cybersecurity capacity beyond the existing capabilities of public institutions. Ukraine’s access to this mechanism is a concrete example of functional integration, enabling the country to benefit from certain European security instruments before EU membership is achieved.
The relationships that European technology companies have developed with Ukraine highlight the private-sector dimension of this transformation. In October 2025, Finland-based WithSecure signed a memorandum of understanding with Ukraine’s Ministry of Economy aimed at strengthening cyber resilience. The agreement covers the testing of security solutions, pilot projects, knowledge sharing, and technical support.[iv] Slovakia-based ESET, meanwhile, worked with CERT-UA to investigate the Industroyer2 attack targeting Ukraine’s energy infrastructure in April 2022.[v] These examples illustrate different forms of cooperation: the former represents an institutional partnership focused on technology development and capacity sharing, while the latter demonstrates operational coordination in response to an actual cyberattack.
The role of the private sector is also evident in international support efforts carried out through the Tallinn Mechanism. Established in 2023 to strengthen Ukraine’s civilian cybersecurity capacity, the mechanism had secured commitments totalling €302.6 million as of March 2026.[vi]
In the same year, new participation opportunities were developed to facilitate cooperation between private companies and donor countries. In March 2026, the Estonian Centre for International Development (ESTDEV) also signed framework agreements with twelve companies from seven countries for cybersecurity projects.[vii] Although these agreements do not indicate that specific projects have been completed, they demonstrate that the private sector is assuming an increasingly systematic role in the implementation of international cyber assistance.
These developments are strengthening the multi-actor governance of cybersecurity. Whereas traditional security approaches assess defence capacity largely in terms of state institutions and military structures, expertise, infrastructure, and response capabilities in cyberspace are distributed among a wider range of actors. While EU institutions establish the regulatory and financial framework, private companies provide technical expertise and services. Ukraine, meanwhile, occupies a central position in identifying operational needs and developing defence practices. Security capacity is shaped by the coordination among these actors. However, growing reliance on private service providers may also create new challenges in terms of data security and accountability.
Ukraine’s position within this ecosystem makes it difficult to view the relationship as a one-way assistance mechanism. Having faced Russian cyber operations for many years, Ukrainian institutions have gained considerable experience in threat detection, critical infrastructure protection, and service restoration following attacks. The joint work of ESET and CERT-UA on the Industroyer2 attack demonstrates how the expertise of different actors can be brought together in operational processes. Ukraine’s experience can serve as a source of knowledge for European institutions and technology companies in developing response methods to address shared threats. Cooperation should therefore not be understood as a one-way process in which the EU transfers technical capacity to Ukraine. However, institutionalising mutual learning depends on the sharing of operational information, the development of trust between the parties, and the continuity of joint practices.
This process is also linked to Ukraine’s EU membership perspective. The Fifth Cyber Dialogue addressed regulatory frameworks such as the Network and Information Systems Security Directive (NIS2), the Cyber Resilience Act, and the 5G Cybersecurity Toolbox. Ukraine’s alignment with European standards could contribute to the development of common rules for protecting digital infrastructure. However, the strategic significance of the current cooperation lies in the fact that regulatory convergence is being supported by operational mechanisms. In this respect, Ukraine’s integration into the European security architecture can deepen in specific areas independently of progress in its accession negotiations. Cybersecurity is therefore one of the key areas in which Ukraine’s functional integration with the EU is advancing ahead of membership.
The limits of this rapprochement should also not be overlooked. Access to the EU Cybersecurity Reserve does not mean that Ukraine has unconditional access to all European cybersecurity mechanisms. Similarly, the scope of agreements signed with private companies should be assessed in terms of their practical implementation and the results achieved. Differences in responsibilities between civilian cyber resilience and military cyber defence may also complicate institutional coordination. Therefore, the effectiveness of Europe’s multi-actor cybersecurity framework depends less on the number of mechanisms established than on their ability to operate together during crises.
In conclusion, the Fifth EU-Ukraine Cyber Dialogue is a recent indicator of the broader transformation underway in Europe’s security architecture. The developing relationships among EU institutions, Ukraine’s cybersecurity structures, and European technology companies demonstrate that security capacity is being built within a multi-actor framework. The experience Ukraine has gained under wartime conditions holds significant potential for the future development of this framework. However, lasting security integration requires technical cooperation to be underpinned by institutional trust, common standards, and sustainable response capabilities. The future of Europe’s cyber resilience will depend on the extent to which these different actors can bring together their knowledge and resources in pursuit of shared security objectives.
[i] “EU-Ukraine: Deepening Cooperation on Cyber Security at 5th Cyber Dialogue”, European External Action Service (EEAS), https://www.eeas.europa.eu/eeas/eu-ukraine-deepening-cooperation-cyber-security-5th-cyber-dialogue_en, (Date of Access: 15.10.2026).
[ii] “Enhanced EU-Ukraine Cooperation in Cybersecurity”, European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/news/enhanced-eu-ukraine-cooperation-in-cybersecurity, (Date of Access: 17.10.2026).
[iii] “Council Implementing Decision (EU) 2026/1354 of 15 June 2026 Authorising the Provision of Support from the EU Cybersecurity Reserve to Ukraine”, Council of the European Union, https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1787786098665&uri=CELEX%3A32026D1354, (Date of Access: 17.10.2026).
[iv] “WithSecure and Ukraine’s Ministry of Economy, Environment and Agriculture Sign Memorandum of Understanding to Strengthen Cyber Resilience”, WithSecure, https://www.withsecure.com/fr/ressources/espace-presse/withsecure-ukraine-mou/, (Date of Access: 17.10.2026).
[v] “Industroyer2: Industroyer Reloaded”, ESET, https://blog.eset.ie/2022/04/12/industroyer2-industroyer-reloaded/, (Date of Access: 17.10.2026).
[vi] “Joint Statement from Tallinn Mechanism Member States: 10 March 2026”, UK Foreign, Commonwealth & Development Office, https://www.gov.uk/government/news/joint-statement-from-tallinn-mechanism-member-states-10-march-2026, (Date of Access: 17.10.2026).
[vii] “ESTDEV Signs Contracts with Twelve Companies from Seven Countries to Implement Cybersecurity Projects until 2030”, Estonian Centre for International Development (ESTDEV), https://estdev.ee/en/articles/estdev-signs-contracts-twelve-companies-seven-countries-implement-cybersecurity-projects, (Date of Access: 17.10.2026).
