Mikko Hyppönen, one of the most prominent figures in global cybersecurity, has shifted his focus from three decades of malware combat to the emerging frontline of drone defense. Speaking at the 2025 Black Hat conference in Las Vegas, the Finnish security expert highlighted that while his career has been defined by invisible digital battles, the physical threat posed by unmanned aerial systems has become his new, critical mission.
The Evolution of Digital Warfare
Hyppönen describes the cybersecurity industry as a game of “Tetris,” where successes remain invisible while failures accumulate. With over 35 years of experience, he witnessed the industry’s transformation from the era of floppy-disk viruses to the modern, professionalized $250 billion sector. He recalls the early 2000s, specifically the ILOVEYOU virus—which he helped identify—as a turning point in how malicious code could propagate globally.
Today, the landscape has shifted. The “hobbyist” hacker is largely gone, replaced by state-sponsored actors and cybercriminals driven by financial gain or espionage. For Hyppönen, the fact that modern devices like iPhones are now exceptionally secure serves as proof that the industry has matured, successfully raising the cost of exploitation to levels only accessible by high-resource entities.
From Code to Counter-Drones
In mid-2025, Hyppönen joined Sensofusion, a Helsinki-based firm specializing in anti-drone technology for military and law enforcement. His move is deeply personal; living near the Russian border and serving in the Finnish military reserves, he views the proliferation of drone warfare—particularly in the conflict in Ukraine—as an urgent existential challenge.
The transition from software security to hardware defense is not as drastic as it seems. According to Hyppönen, the methodology remains remarkably similar:
- Signature Detection: Just as antivirus software identifies malware via code signatures, drone defense systems record radio frequency “IQ samples” to detect and categorize unknown aerial threats.
- Protocol Exploitation: By identifying the communication protocols used to control drones, defenders can execute cyberattacks that force the units to malfunction or crash.
The Same Adversaries, New Battlefield
Hyppönen notes that the “cat-and-mouse” game remains constant. The enemy adapts, and so must the defense. However, the stakes have evolved from protecting data to protecting physical infrastructure and human lives. “I spent a big part of my career fighting against Russian malware attacks,” Hyppönen said. “Now I’m fighting Russian drone attacks.”
As he continues to lead research into these autonomous threats, his goal remains the same as it was in the 1980s: staying one step ahead of the adversary, whether they are operating through a line of code or a radio signal.
For more insights into his perspective on industry challenges, you can watch his full keynote presentation from the 2025 Black Hat conference.