“Almost everything happening there is interesting,” says Colonel Mietta Groeneveld about Ukraine. She is referring to a country that, under wartime conditions and partly thanks to the digital vision of Minister Mykhailo Fedorov, has transformed itself into one of the fastest innovating armed forces in the world, far beyond the level of a single weapon system or specific attack.
Colonel Groeneveld is Director of the NATO Command & Control Centre of Excellence. In this conversation for Security Innovation Stories, she explains how Ukraine has turned the race for technological advantage into a continuous cycle of innovation, and why she believes that speed goes to the heart of what innovation in security means today. For her, it is primarily about how quickly you learn what works and what does not.
This episode of Security Innovation Stories is part of a special series around Cybersec Netherlands on 9 and 10 September at Jaarbeurs Utrecht. On Thursday 10 September, from 13:05 to 13:25, Colonel Mietta Groeneveld will join Jeroen Gaiser, Deputy CISO at the Dutch Ministry of Infrastructure and Water Management, for a duo session about the gap between geopolitical cyber threats and the daily reality of CISOs responsible for critical infrastructure.
From report to fix in three hours: how the battlefield co-develops the software
In the conversation, Colonel Groeneveld describes how Ukraine has organised the fight across three layers. The first is about detection and interception: everything fired at the country should, as far as possible, be detected and stopped. To achieve this, Ukraine rapidly built a sensor network and warning apps for the population.
The second layer goes beyond defence alone. It is about preventing the attack itself, for example by ensuring that drones do not take off. This requires insight into where and how attacks originate and a detailed overview of potential targets. By combining increasing amounts of data, a digital system emerged with hundreds of data layers providing situational awareness and identifying trends, not only for military personnel but also for civilians who need to take action.
The third layer is actively maintaining international involvement. Ukraine treats its alliances as an instrument of warfare rather than merely diplomatic context. Without the international community, the supply of the adversary’s weapons cannot be exhausted.
According to Colonel Groeneveld, what distinguishes this approach from the way NATO countries are used to operating is the speed at which information from the battlefield flows back to developers.
“As soon as the battlefield reports that something is not working, there is an immediate response. Within three hours, the updated software is already on its way to Ukraine and can be implemented.”
This direct cooperation with industry makes the difference. Ukraine aims to remain at least ten steps ahead of Russia in its innovation cycle, and achieves this by allowing companies to test new capabilities immediately and feed improvements or failures back at great speed.
From a grenade under a DJI drone to fully autonomous swarming
Colonel Groeneveld also illustrates the pace of innovation with another example. Before the war, DJI drones were already widely known as consumer products. As soon as someone in Ukraine attached a hand grenade to one, a toy became a weapon and a race between attack and defence began.
The network behind those drones soon became a target itself, pushing the conflict further into electronic warfare. Development moved from simple frequency hopping to much more complex spectrum operations, and even to solutions as basic as connecting a thin wire to the drone to make digital disruption impossible.
According to Colonel Groeneveld, the next step is already visible: drones that navigate and operate completely autonomously, for example using image recognition, and drones controlling other drones through swarming techniques.
The same technology also plays a role at a very different level: the headquarters directing the operations that will ultimately determine the course of the war. At that level, commanders use AI to recognise patterns in large volumes of historical data, making unusual movements on the battlefield visible much faster than if analysts had to work through the data manually. AI is also increasingly used to support complex planning, simulations and the measurement of effects.
Why an armed force is naturally the least creative part of an organisation
“Creativity is extremely important on a battlefield, but it is actually one of the least developed things within an armed force. We think warfare contains surprise, but in reality it is often a very symmetrical approach. If you suddenly do something different and it is effective, that is what makes it surprising.”
For Colonel Groeneveld, this paradox explains much of what has happened in Ukraine. Even before the war, the country was relatively advanced in digitalisation, including in the cyber domain.
When that knowledge was combined with a uniform, it created an environment with a far more diverse range of experts who could, for example, make old equipment usable again by adding new electronics.
By rewarding the sharing of data, it also became easier to demonstrate that new technologies, particularly drones, were effective, making innovation the new norm. The innovation was therefore not accidental. It was the direct result of a developed society that was already accustomed to moving quickly before the war began.
Speed as the new core of military innovation
For Colonel Groeneveld, innovation in security is primarily about speed: the speed at which an organisation discovers what works and what does not, and translates that knowledge into an adjustment that can immediately be deployed.
In Ukraine, she sees an approach in which failure on the battlefield leads to an updated version of a system within hours, powered by a combination of military experience, commercial partnerships and a society already accustomed to digital change.
That three-hour cycle is not merely an operational detail. For her, it is the clearest evidence that surviving in a modern threat environment requires an organisation that learns continuously, rather than one that waits for the next major plan.
Colonel Groeneveld also points to a structural weakness in the national cybersecurity landscape: NIS2 does not apply to Defence and a number of other government organisations. Organisations that are not required to report a cyberattack do not contribute to the collective threat picture.
The chain is only as strong as the weakest link that is not required to report. For CISOs responsible for critical infrastructure, this is not a technical footnote: it means their situational awareness will, by definition, remain incomplete for as long as this exception exists.
Colonel Groeneveld concludes the conversation with a statement she deliberately connects to NATO’s underlying philosophy:
“The ultimate art of war is not to fight.”
For her, that sentence represents a defence and deterrence organisation focused on protecting a way of life rather than fighting for the sake of fighting itself.
At the same time, she warns against the opposite extreme. If everything is secured and everyone is placed behind the dikes, ultimately there may be very little left worth living for.
The challenge is easy to formulate but difficult to achieve: after all the innovation and all the defence, make sure there is still something left that is worth protecting.
