Finland is drafting a doctrine for active cyber defense and developing cyber defense capabilities, according to Pia Hüsch, a researcher at the Royal United Services Institute. ' Finland is developing an active cyber defense that may include offensive countermeasures, according to experts. The line between defensive and offensive actions in cyberspace is blurry, experts say, with distinguishing between defensive and offensive cyber techniques being difficult as the same techniques can be used for both purposes.
According to Pia Hüsch and an unnamed Finnish expert, techniques are often multi-purpose, and disabling an opponent's logical element can be intelligence gathering in one context and influence in another. Offensive capabilities are needed to expel malicious actors from networks and shut down servers used in attacks, experts argue. There is a consensus that active intervention should be possible against hostile activities in one's own network.
Finland's cyber doctrine distinguishes between 'active countermeasures' (DCO-RA) and purely offensive measures, according to an unnamed Finnish expert. The public is more accepting of DCO-RA-type actions than purely offensive measures, the expert adds. However, what specific offensive countermeasures are being considered in Finland's active cyber defense development remains unclear, and how Finland's cyber doctrine defines 'active countermeasures' (DCO-RA) versus purely offensive measures in practice is not specified.
Finland has so far used its cyber capabilities only for defensive purposes, according to Pia Hüsch. Russia and China are the most significant state threats to cybersecurity, experts note. This cyber development occurs against a backdrop of heightened tensions with Russia.
Protecting systems solely through information security measures is no longer sufficient and requires 'new means, such as enhanced international information exchange, sanctions, or active cyber defense.'
In 2025, Russia treated Finland in a more hostile tone compared to previous years, according to a Finnish government report on information influence. The report attributes Russia's aggressive communication to Finland's strengthened NATO cooperation and President Alexander Stubb's visible role in foreign and security policy discussions. These findings provide context for Russia's 2026 warnings over Finland's nuclear weapons policy review.
In March 2026, Russia warned Finland that it would respond if Finland installs nuclear weapons on its territory, following Helsinki's consideration of lifting a long-standing ban on hosting such weapons. The Kremlin's spokesperson, Dmitry Peskov, called this a move that escalates tension in Europe. Previously, President Alexander Stubb expressed support for opposition parties after a meeting with parliamentary party leaders about nuclear weapons policy, criticizing those who had mocked dissenters and emphasizing the importance of parliamentary debate.
The government's proposal to remove nuclear weapons restrictions from law had sparked controversy, with opposition parties demanding broader consultation. The identity of the unnamed Finnish expert discussing cyber doctrine and their exact role or affiliation is unknown. Additionally, the legal or ethical frameworks governing Finland's potential use of offensive cyber capabilities are not detailed in the available information.
Finland's move toward active cyber defense aligns with its broader security posture amid NATO integration and regional tensions, as the country navigates complex cyber threats and geopolitical pressures. The development of active cyber defense capabilities reflects Finland's proactive approach to cybersecurity in an era where traditional defensive measures are increasingly insufficient against sophisticated state-sponsored threats. Experts emphasize that this shift is part of a global trend where nations are re-evaluating their cyber strategies to include more assertive measures while grappling with the ethical and legal implications of such actions.