What the Russia-Ukraine Cyber War Actually Means for Business and Regional Security

The Russia-Ukraine conflict has shown us something that most business leaders and policymakers didn’t fully appreciate before: cyber warfare isn’t some distant threat anymore. It’s real, it’s happening now, and it’s reshaping how countries think about security, borders, and the cost of conflict.

I’ve built products in competitive markets. I know what it means when someone has better intelligence than you do. They move faster. They anticipate your moves. They find your weaknesses before you do. Now imagine that dynamic playing out at a national scale, with surveillance capabilities and attack vectors that make corporate espionage look quaint. That’s where we are right now.

The New Reality of Surveillance and Information Warfare

What’s happening between Russia and NATO isn’t just about military hardware anymore. The extensive surveillance operations that have been documented over the past few years tell a much bigger story: information asymmetry is the real weapon now.

When one side can monitor the other’s movements, communications, and intentions in real time, the traditional concepts of warfare break down. You can’t execute a strategy when your opponent knows what you’re planning. You can’t mount an effective defense when your networks are already compromised. This isn’t theoretical—it’s been playing out in Ukraine and against NATO infrastructure for years.

Here’s what makes this genuinely frightening: cyber attacks don’t respect borders the way traditional warfare does. A cyber operation launched from Moscow can hit infrastructure in Berlin, Warsaw, or Tallinn instantly. There’s no build-up time. There’s no mobilization period where the world can see what’s coming. One moment your power grid is running fine, the next it’s dark.

From a practical standpoint, this creates a security dilemma that’s almost impossible to solve. If you’re a NATO member, you have to assume your networks are already under surveillance. That means your defensive posture has to assume compromise. You have to build systems that work even when they’re partially broken. You have to keep critical infrastructure running while assuming attackers have already infiltrated it.

Why Regional Powers Need to Wake Up Now

This is where the argument for ASEAN and other regional organizations really matters. If you’re watching what’s happening between Russia and the West and thinking “that’s their problem, not ours,” you’re missing the point entirely.

The techniques being developed and tested in Ukraine will be replicated elsewhere. The surveillance playbooks will be adapted. The attack methods that work against NATO will be studied and modified for use against other targets. This isn’t because cyber warfare is special—it’s because it’s effective and cheap compared to traditional military conflict.

For countries in Southeast Asia, that should be a wake-up call. You don’t have the luxury of staying out of this. Even if you maintain strict neutrality, your banks, your government systems, your power infrastructure—they’re all potential targets. Not necessarily because anyone wants to invade you, but because:

• Your systems might have valuable intelligence about regional rivals
• Disrupting your economy serves the interests of outside powers
• Testing new attack methods on your infrastructure has lower political cost than hitting a major power
• You’re probably underfunded in cyber defense compared to the threat

That last point is critical. Most countries, especially smaller ones, haven’t invested adequately in cyber defense. The gap between attack capability and defensive capability just keeps growing.

The Case for Avoiding Escalation

Here’s where I actually agree with the broader argument about avoiding war. And I say this as someone who’s comfortable with competition and conflict in business—because I understand the dynamics.

When cyber capabilities become weaponized at scale, when surveillance reaches the level we’re seeing, and when both sides have the ability to strike almost instantly, the calculus changes. Traditional deterrence theory breaks down. You can’t really deter someone if you don’t know for certain that they attacked you. By the time you figure out what happened, the attacker has already moved on to their next target.

The path to actual hot war becomes shorter and easier to stumble into. A miscalculation in cyberspace could trigger a real-world response. A real-world response could trigger a cyber counter-attack. Before anyone intended it, you’ve got escalation spiraling out of control.

That’s not pessimism. That’s just probability. When the barriers to action are lowered and consequences are unclear, more people take action.

For regional organizations, this means investing heavily in non-military deterrence. Build economic interdependence. Create communication channels that stay open even during tensions. Develop shared standards for what constitutes unacceptable cyber behavior. Make the cost of conflict clearly higher than any benefit.

It’s unglamorous work. It doesn’t make headlines. But it’s how you actually prevent wars instead of just hoping they don’t happen.

The Russia-Ukraine situation should be a case study for every country in how quickly things can spiral when multiple capabilities converge. Learn from it. Invest in cyber defense. Build relationships with neighbors before you need them. And understand that staying out of someone else’s fight means actually building the relationships and systems that make involvement unlikely.

Source: Extensive Russian surveillance of Nato and attacks on Kyiv mean Asean must forever abjure and avoid war — Phar Kim Beng