# ANALYSIS: France's Cyber Defense Regiment Goes to Learn Digital Warfare from the Ukrainians

> On June 24, 2026, Intelligence Online revealed a piece of information that passed almost unnoticed beneath the noise of strikes and summits: the French Army's cyber defense regiment is sending specialists to Ukraine to acquire direct operational experience. Not to fight. Not to advise in the military sense of the term. But to learn — from practitioners who have been waging cybe

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Analysis
- Published: 2026-06-29
- Canonical URL: https://mad-max.co/en/article/analyse-le-regiment-cyber-francais-part-apprendre-la-guerre-numerique-au-contact

## Introduction: When France sends its cyber soldiers to learn from Ukraine

### A discreet decision, a powerful strategic signal

On **June 24, 2026**, **Intelligence Online** revealed a piece of information that passed almost unnoticed beneath the noise of strikes and summits: the **French Army's cyber defense regiment** is sending specialists to **Ukraine** to acquire direct **operational experience**. Not to fight. Not to advise in the military sense of the term. But to learn — from practitioners who have been waging cyber war in real conditions for more than ten years against the best state-sponsored attack groups on the planet.

This decision, however discreet its official framing, carries considerable strategic significance. It means that **French cyber defense** professionals are implicitly acknowledging that **Ukraine** possesses operational cyber expertise that **France** does not have — and that it is more effective to go learn it in the field than to acquire it through exercises or simulations. That is a remarkable admission of lucidity.

### Ukraine, living laboratory of cyber-military doctrine

Since **2014** — and on an unprecedented scale since **2022** — **Ukraine** has been enduring and repelling cyberattacks of an intensity, sophistication and diversity that no other country in the world has ever experienced over such a sustained period. Attacks against **power grids** (**Industroyer**, **2016**), **destructive malware** (**NotPetya**, **2017**), persistent campaigns by the **GRU** and **FSB** against command systems, officers' messaging apps, critical infrastructure — all of this has forged an absolutely unique Ukrainian operational experience.

Ukrainian armed forces and the **SBU** have developed responses that exist nowhere in **NATO** doctrinal manuals: **rapid recovery** procedures after an attack, resilient communication architectures, network **compartmentalization** protocols, **detection** and **attribution** methods for attacks within very short timeframes. That body of know-how is what French cyber soldiers are going to seek out.

*France did not settle for sending weapons or money. It sent its best cyber specialists to learn from the war. That choice says everything about French strategic vision: the war in Ukraine is not merely a conflict to support from afar. It is a learning laboratory whose lessons will transform the defense doctrine of the entire continent.*

*There is something profoundly honest about France's decision to send its specialists to learn in Ukraine. Rather than pretending our cyber doctrines are up to the task, we acknowledge a gap and go to fill it. That is precisely the opposite of the institutional arrogance that often characterizes great Western armies. Credit to those who made that decision.*

## The French cyber defense regiment: who are they?

### A specialized unit at the heart of the army's digital transformation

The **French Army's cyber defense regiment** — officially the **807th Transmissions Regiment**, based in **Douai** with detachments at **Cesson-Sévigné** — is the unit responsible for the operational cyber defense of French armed forces information systems. It works in close coordination with the **Cyber Defense Command** (**COMCYBER**), attached to the **Armed Forces Chief of Staff**, and with **ANSSI** (National Agency for Information Systems Security) on government aspects.

These specialists are trained in intrusion detection, incident response, digital investigation and protection of military command systems. Their competence is real. But it was developed in a context of exercises, simulations and low- to medium-intensity incidents — not in the context of a high-intensity war where a state adversary mobilizes all its cyber capabilities around the clock.

### High-intensity cyber war: a qualitative leap

The difference between cyber defense in peacetime and cyber defense in high-intensity war is of the same order as the difference between military training exercises and actual combat. In the first case, rules are known, scenarios are anticipated, systems are protected. In the second, the adversary actively seeks to surprise, to saturate and to exploit every vulnerability in real time, while targets are simultaneously under kinetic pressure.

That is the environment in which Ukrainian cyber defenders work. Their French counterparts are arriving to understand how one manages a **simultaneous attack** on command systems during a ground offensive, how one maintains operational communications when network nodes are systematically targeted, how one quickly attributes an attack to enable an appropriate response. Questions that only real experience can answer.

*There is an uncomfortable paradox in this situation: Ukraine learns to defend its cyber systems by suffering massive attacks. France sends its experts to learn from that experience — but without having to suffer the attacks themselves. That is the privileged position of the ally who learns by proxy. It is better than not learning at all. But it will never replace the reality of fire.*

## Ukraine's transformation into a NATO cyber center of excellence

### Expertise that crosses national borders

The French initiative is not isolated. Several **NATO** member states — notably the **United States**, the **United Kingdom**, **Estonia** and **Lithuania** — have developed enhanced cyber cooperation programs with **Ukraine** since **2022**. The **US Cyber Command** (**USCYBERCOM**) notably deployed **Hunt Forward Operations** teams in **Ukraine**, tracking adversary groups on Ukrainian networks to collect intelligence on the tactics, techniques and procedures of Russian groups.

This cooperation model — allies deploy their experts on Ukrainian networks, collect operational experience and share threat intelligence — is transforming **Ukraine** into a **de facto cyber center of excellence** for the **Atlantic Alliance**. The **NATO Cyber Centre** in **Tallinn** remains the reference institution for doctrine, but it is **Ukraine** that provides the real-world use cases.

### Lessons from the Ukrainian cyber war for NATO doctrine

Several major lessons emerging from the Ukrainian experience deserve to be integrated into **NATO**'s cyber doctrine. The first is the need for **architectural resilience**: systems designed to keep functioning even when partially compromised or attacked, with rapid recovery and degraded-mode capabilities. The second is the importance of **attribution speed**: quickly identifying the source and nature of an attack to enable an appropriate response. The third is the value of **cyber reserves**: civilian specialists who can be rapidly mobilized to reinforce military teams in a major crisis.

**Ukraine** has implemented innovative versions of all three approaches. Its **IT reserve**, composed of thousands of civilian digital professionals mobilized to defend critical infrastructure, is a model that existed in no Western military doctrine before **2022**. The French cyber soldiers arriving in **Kyiv** or elsewhere will likely depart with that reality firmly in mind.

*The Ukrainian IT reserve — those thousands of developers, network engineers and security specialists mobilized for national cyber defense — may be the most important doctrinal innovation of this war. No conventional army had envisioned anything like it. Ukraine invented it out of necessity. NATO countries should draw on it urgently.*

## Russian attacks of June 25, 2026: the immediate context

### The SBU-FBI revelation as an illustration of real-time threat

The revelation on **June 25, 2026** by the **SBU** and the **FBI** of a systematic Russian campaign of attacks against the messaging apps of Ukrainian officials and military personnel arrives precisely as French cyber soldiers are preparing their deployment. That is the type of operation those specialists will observe and learn to counter: sophisticated phishing, impersonation of official bots, psychologically timed pressure exploiting user fatigue.

These attacks against messaging apps illustrate a crucial point: cyber war does not only target critical infrastructure and military command systems. It also targets the individual communications of officials, seeking to collect human intelligence through digital means — at lower cost, with reduced exposure risk for the attacker. That is a form of **21st-century espionage** that conventional armies do not yet know how to counter effectively.

### The documented intensification since early 2026

**CERT-EU** documented as early as **February 2026** a sophisticated campaign impersonating the support bot of the **Signal** application, targeting political, military and journalistic figures in several **European** countries. That campaign was attributed with high confidence to the **APT28** group linked to the Russian **GRU**. It illustrates the extension of Russian cyber war beyond **Ukraine** — toward the allies supporting **Kyiv**.

It is precisely that dynamic of extension — from a cyber war initially targeting **Ukraine** toward a cyber war aimed at the entire **West** — that makes the Ukrainian experience so crucial for allied armies. What **Ukraine** is learning to counter today, **France**, **Germany** and the rest of **Europe** could have to counter tomorrow at comparable intensity.

*I wonder whether European political leaders truly understand how porous — and how rapidly disappearing — the boundary is between the cyber war being waged against Ukraine and the one being waged against us. The Signal attacks targeting European politicians in February 2026 are not an isolated incident. They are the beginning of a methodical extension. And we are not ready.*

## Implications for NATO preparation at the Ankara summit

### Cyber in the equation of allied capabilities

The **NATO** summit in **Ankara** on **July 7–8, 2026** is expected to see important announcements on collective defensive capabilities. Secretary General **Mark Rutte** announced contracts for "tens of billions of dollars" in three areas: **long-range deep strike**, **air defense** and **autonomous systems**. Cyber defense is not explicitly cited in that triad — but it is cross-cutting to all these capabilities.

No long-range strike capability, no air defense system, no autonomous drone can function without secure communication and command systems. If those systems are compromised by adversary cyber operations, the most sophisticated military capabilities become unusable or dangerous. Investment in cyber capabilities is therefore the prerequisite for the effectiveness of all other defensive investments.

### France and its vision of cyber "strategic autonomy"

France's approach of sending experts to **Ukraine** fits within **President Macron**'s vision of European **"strategic autonomy"** — a Europe capable of defending itself, complementing but not exclusively dependent on the **United States**. In the cyber domain, that strategic autonomy requires European countries to develop their own detection, response and, if necessary, cyber retaliation capabilities.

**Ukraine**, paradoxically, can help build that European cyber strategic autonomy. By sharing its operational experience with European allies, it contributes to strengthening the entire Western defensive ecosystem. That is a form of contribution to collective security that few commentators acknowledge, too busy measuring support in terms of tanks and missiles.

*European strategic autonomy in cyber is possible — but it requires massive investment, large-scale training and a culture of operational security that does not yet exist in most of our administrations. Ukraine can show us the way. The only requirement is having the humility to follow.*

## Franco-Ukrainian cooperation: beyond cyber

### A strategic partnership in development

The deployment of cyber specialists fits within a broader Franco-Ukrainian cooperation that has deepened since **2022**. **France** has provided **Ukraine** with **CAESAR** artillery systems, **AMX-10RC** armored vehicles, **SCALP** missiles (equivalent to the British **Storm Shadow**), and committed to delivering **Mirage 2000** aircraft. The French ambassador in **Kyiv** also confirmed in **June 2026** that **Rafales** will soon join **Ukraine**'s fleet, alongside **F-16s** and **Gripens**.

This increasingly close military relationship naturally creates a framework for technical and doctrinal exchanges in the cyber domain. Armies that fight with the same weapons systems have an interest in sharing their knowledge about protecting those systems against adversary cyber attacks. A **Rafale** or **Mirage** on a mission over **Ukraine** depends on communication and guidance systems that can be targeted by Russian electronic and cyber warfare.

### Mutual feedback: Ukraine also learns from France

If **France** sends its specialists to learn from **Ukraine**, that cooperation is likely bidirectional. Ukrainians can learn from the French regarding NATO standards, systems interoperability, certification procedures and doctrine for employing cyber capabilities within an allied framework. Cyber cooperation between allied nations is rarely a one-way flow — it is an exchange in which each side brings what it has and learns what it does not.

That reciprocity is valuable for **Ukraine** in its perspective of **NATO** membership. Joining the **Alliance** requires not only military capabilities but also systems, processes and organizational cultures compatible with allied standards. Cooperation with the French cyber defense regiment contributes to the gradual integration of Ukrainian practices into the **NATO** framework.

*Franco-Ukrainian cooperation in cyber seems to me one of the most intelligent investments France can make. Its cost is modest — a few dozen specialists deployed temporarily. Its potential return — acquiring operational experience that might otherwise take years to develop — is considerable. That is smart foreign policy.*

## The future: toward a revised allied cyber doctrine

### Integrating Ukrainian lessons into training curricula

The long-term challenge is not only sending a few French specialists to learn in **Ukraine** for a few weeks. It is to **systematize** this operational feedback, document it, integrate it into the training programs and doctrines of allied armies, and update the manuals governing the use of cyber capabilities accordingly. This institutionalization work takes time — but its impact is structural and lasting.

The **NATO Cyber Centre of Excellence** in **Tallinn** should play a central role in this integration. Exercises such as **Cyber Coalition**, organized annually by **NATO**, should be redesigned in light of the real scenarios documented in **Ukraine**. The training programs for cyber officers of allied armies should systematically include modules based on real Ukrainian cases. This work is underway — but it needs to accelerate.

### The question of resources: financing cyber excellence at the level of the threat

None of these doctrinal evolutions will be possible without substantial financial investment in the cyber capabilities of allied armies. Several **NATO** countries still dedicate an insufficient share of their defense budgets to cyber capabilities. In a context where **Alliance** members are called upon to reach **2% of GDP** in defense spending — and some are heading toward **3%** or more — the question is what proportion of those expenditures goes toward cyber capabilities.

The honest answer is: probably too little. Conventional equipment — tanks, aircraft, missiles — is more politically visible and benefits from well-established industrial lobbies. Cyber capabilities are less spectacular and their benefits are harder to quantify for elected officials confronting budget trade-offs. It falls to **cyber defense professionals** to make these investments legible and convincing for their political decision-makers.

*There is a political communication problem in the cyber defense world. Professionals speak of CVE, APT, TTPs — language intelligible to insiders, opaque for the political decision-makers who vote on budgets. Translating cyber stakes into concrete terms of risk for democracy and national security may be the most urgent task of our cyber-security communities.*

## The Ukrainian cyber war lessons for NATO doctrine

### A catalogue of techniques unprecedented in the history of cyber warfare

The Ukrainian cyber war has produced a **catalogue of techniques** and counter-measures without parallel in the history of modern conflict. Russia deployed virtually its entire cyber arsenal there: destructive wipers like **NotPetya** and its successors, attacks on critical infrastructure, large-scale disinformation, manipulation of industrial control systems. Ukraine survived those attacks through **improvised defense in depth**, the resilience of its technicians and the support of Western partners.

What French cyber specialists are coming to learn in Kyiv is precisely that experience of **defense under real attack**. Exercises and laboratory simulations cannot reproduce the psychological pressure, speed of decision and creativity required when critical systems are genuinely threatened. Ukrainian cyber soldiers have developed **defensive reflexes** that the best-equipped but unexposed armies do not have. That know-how is irreplaceable.

### Toward a reinforced allied cyber doctrine after Ankara

The **NATO** Ankara summit should include decisions on strengthening cyber cooperation within the Alliance. The presence of French and other allied specialists in Ukraine creates a base of shared experiences that can feed a **revision of NATO cyber doctrine**. Concepts emerging from Kyiv — active defense, critical infrastructure resilience, proportionate counter-action in cyberspace — are becoming the Alliance's new standards.

The **Franco-Ukrainian cyber cooperation** illustrates how the most engaged allies can influence the entire Alliance. France is not only sending its specialists to Ukraine to train them — it is sending ambassadors of its doctrine, who will bring the field's lessons back to Paris and contribute to **modernizing French operational concepts**. That is a bilateral investment with multilateral dividends. And it is exactly the type of cooperation NATO needs more of.

*The Ukrainian cyber war is the most advanced real-world laboratory in the history of modern conflict. What is being learned there — by Ukrainian defenders and now by French specialists — will shape allied doctrines for the next decade. No simulation, no exercise, no theoretical model can substitute for what two years of continuous combat against the best Russian cyber units have taught. The lessons are priceless. The question is whether we will use them in time.*

## Conclusion: The Ukrainian lesson, a strategic legacy for NATO

### What France will bring back from Kyiv

The specialists of the **French cyber defense regiment** heading to **Ukraine** will return with something irreplaceable: direct experience of a real combat cyber environment. They will have seen how professional teams manage incidents under maximum operational pressure. They will have observed methods and architectures developed out of necessity in a war context. They will have talked with counterparts who have lived through what no exercise can reproduce.

That knowledge cannot be transmitted through manuals or simulations. It is transmitted through shared experience. And that is precisely what **Ukraine** offers its allies — unique access to the most advanced frontier of modern cyber warfare. **France** had the wisdom to go seek that access. Other allied nations should follow without delay.

### Ukraine as a net contributor to NATO security

We often speak of **Ukraine** as a beneficiary of Western support — and that is an indisputable reality. But that relationship is more symmetrical than it appears. **Ukraine** is also a **net contributor** to **Western** security: by absorbing and repelling Russian military and cyber capabilities, it reduces the pressure **Moscow** can exert on other **Alliance** members. And by sharing its operational experience, it directly contributes to the defensive preparation of allied countries.

The French cyber defense regiment initiative is an implicit recognition of that reciprocity. It should accelerate the reflection on **Ukraine**'s **NATO** membership — not as a burden on the **Alliance**, but as a strategic asset whose value is now proven at the highest level.

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [Intelligence Online — French cyber defence regiment sending specialists to learn in Ukraine — June 24, 2026](https://www.intelligenceonline.com/europe-russia/2026/06/24/french-cyber-defence-regiment-sending-specialists-to-learn-in-ukraine,110818271-art)

- [UA.News — Russian intelligence agencies attacked the messaging apps used by Ukrainian officials and military — June 25, 2026](https://ua.news/en/ukraine/rosiiski-spetssluzhbi-atakuvali-mesendzheri-posadovtsiv-i-viiskovikh-v-ukrayini)

### Secondary sources

- [CERT-EU — Cyber Brief 26-03, February 2026 — February 3, 2026](https://cert.europa.eu/publications/threat-intelligence/cb26-03/)

- [Cyber Warrior 76 — Strategic Cyber Threat Intelligence Briefing, Russian cyber operations targeting NATO — June 27, 2026](https://cyberwarrior76.substack.com/p/strategic-cyber-threat-intelligence-e4b)

- [Brussels Signal — Europe's biggest military powers pledge stronger NATO role ahead of Ankara summit — June 25, 2026](https://brusselssignal.eu/2026/06/europes-biggest-military-powers-pledge-stronger-nato-role-ahead-of-ankara-summit/)

- [Army Recognition — French Ambassador confirms Rafale fighters will soon join Ukraine's F-16 and Gripen fleets — June 27, 2026](https://www.armyrecognition.com/news/aerospace-news/2026/french-ambassador-ukraine-rafale-gripen-f16-mirage-fighter-jets)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/analyse-le-regiment-cyber-francais-part-apprendre-la-guerre-numerique-au-contact