In Ukraine, a cybersecurity presentation can be interrupted by a ballistic attack, and resume only after air defence clears the sky.
This is not a hypothetical. It happened during the talk by Anastasiia Voitova, Head of Security Engineering at Cossack Labs, at DOU Day 2026. It reflects the reality security engineers here actually work in: elevated risk, limited time, and constant pressure to solve problems that often have no established answers yet. Traditional approaches to security are no longer sufficient.
Here are a few key points from Anastasiia’s talk about continuous cybersecurity attestation of defence and mission-critical systems:
*The defence technology ecosystem is growing and adapting to new threats. This is a heterogeneous environment: web and mobile applications, specialised hardware, APIs, robotic devices, and a wide range of supporting infrastructure. Viewed through a cybersecurity lens, it becomes clear that traditional cybersecurity frameworks, where certifications happen once a year, no longer hold.
*Cybersecurity keeps pace with change. There is no longer a static notion that “the system is secure”; instead, systems are authorised to perform specific operations under defined conditions. This is achieved through deliberate, forward-looking system design, together with continuous security maintenance and re-assessment processes.
*In practice, this includes organisational security processes and ISMS, measuring and assessing product security posture, defining requirements and recommendations for data exchange, implementing SSDLC, and establishing security requirements for robotic devices, control systems, and other components of the wider ecosystem.
We are grateful to DOU Day for the opportunity to share the lessons Cossack Labs engineers have drawn from our work securing mission-critical and defence technology.
