This article is authored by Olesya Danylchenko, Head of Tallinn Mechanism Project Office.

The Tallinn Mechanism (TM) is a pioneering model of international cooperation, bringing together Ukraine and its partners to shape a resilient digital future. The mechanism turns fragmented assistance into coordinated action. By spotlighting innovative projects and an expanding circle of countries, the article positions the Tallinn Mechanism not only as vital for Ukraine today, but as a blueprint for a more secure, connected, and cooperative digital world.

Common Threat

Since the beginning of the full-scale invasion, cyberattacks on Ukrainian critical infrastructure and government information resources have become one of the main facets of Russia’s war against Ukraine. Such cyberattacks were not something new for Ukraine, as, de facto, the country has been resisting Russian aggression since 2014. The NotPetya cyber operation, which took place in late June 2017, on the eve of Ukraine’s Constitution Day, remains the largest supply chain attack in terms of information systems affected not only in Ukraine, but globally.  According to Microsoft Digital Defence Report, Ukraine is consistently among the top-3 countries most impacted by nation-state cyber threat activity. 

What is Distinctive about Cyberattacks Targeting Ukraine?

Unlike many financially driven cyber incidents elsewhere, the primary focus of cyber operations linked to Russia against Ukraine has not typically appeared to be profit. These activities have targeted key financial institutions, transportation networks, and telecommunications providers, with the apparent aim of disrupting services, spreading fear, eroding public confidence in state institutions, and testing national crisis response capacity.

Efforts to weaken international backing for Ukraine have also extended beyond its borders, particularly into Europe, with growing frequency. The CyberPeace Institute has documented more than 2,000 cyber incidents connected to the war, affecting entities in over 50 countries, a pattern that suggests a broader strategy of disruption. As a result, Ukraine’s cyber resilience evolved from a national concern into an international one. It became increasingly evident that responding effectively to these threats required collective action. This recognition laid the groundwork for what is now known as the Tallinn Mechanism.

Responding to Global Challenges

At the end of 2023, the Ministries of Foreign Affairs of Ukraine, Canada, Denmark, France, Germany, the Netherlands, Poland, Sweden, the United Kingdom, and the United States Department of State (DoS), at the initiative of the Estonian Ministry of Foreign Affairs, announced the launch of a new instrument of international cooperation. This instrument was named the Tallinn Mechanism after the location of the initial meeting.

From the outset, this international initiative has focused exclusively on strengthening cyber resilience, as well as developing Ukraine's civilian cyber capabilities. A systematic approach is the main feature that distinguishes the Tallinn Mechanism from other similar formats of international assistance.

How does it work? The recipients of the Tallinn Mechanism are Ukrainian central executive authorities, regional state administrations, and critical infrastructure operators (including state enterprises and joint-stock companies fully owned by the state).

Submitted projects are first assessed by a Technical Working Group (TWG) formed by high-level technical experts. They evaluate projects based on approved criteria, focusing on their technical side. For instance, projects must fall within the domains of cyber security, cyber defence, or cyber resilience, and at least 50–60 percent of the overall scope should be cyber-related.

At the next stage, projects are assessed by an Interagency Working Group (IWG). Its structure is approved by a resolution of the Cabinet of Ministers of Ukraine, and includes representatives of a wide range of government bodies. Among them are the Ministry of Digital Transformation of Ukraine, the Ministry of Foreign Affairs of Ukraine, the Security Service of Ukraine, the State Service for Special Communications and Information Protection of Ukraine, and the National Cyber security Coordination Centre. The IWG evaluates projects in terms of their strategic importance and alignment with the  goals of the Tallinn Mechanism.

As a result, international partners are offered projects that meet Ukraine's priority needs, and each of them can choose the initiatives that best align with their interests.

What Advantages Does the Tallinn Mechanism Offer?

1. This approach provides an opportunity to systematise international assistance in the field of cybersecurity and eliminate potential duplication of projects. In addition, one large-scale project may be co-financed by several countries. How does it work? The project is broken down into several “needs,” each of which can be supported by a different donor. Thanks to this, the synergy of international assistance becomes a real tool for strengthening Ukraine's cyber resilience, allowing large-scale projects to be implemented more quickly when they are most needed.

2. Thanks to the Tallinn Mechanism, projects are evaluated regularly and transparently by Ukrainian experts within the technical working group. The interagency working group, which is the next step after the TWG, helps to systematise pre-selected projects and submit the most relevant ones to international donors for consideration. 

3. The Tallinn Mechanism allows for a rapid response to challenges, ranging from attacks on critical infrastructure to the need for specialist training. Such responsiveness is crucial in wartime. It increases the effectiveness of support, as donor resources are directed precisely where they are most needed.

4. In addition to responding to current requests, support is aimed at developing internal cyber expertise in Ukraine and building institutional capacity. This allows not only to defend against cyberattacks, but also to develop our own capabilities for building Ukraine's digital future.

Launch of the Tallinn Mechanism Project Office

To increase transparency, coordination, and efficiency in project implementation, the Tallinn Mechanism Project Office (TMPO) was launched in April 2025 at the initiative of the Ministry of Digital Transformation of Ukraine and with the support of the Estonian Centre for International Development (ESTDEV) and EU CyberNet.

The list of TMPO's main tasks includes:

• Providing technical support, ensuring transparency and accountability of projects and initiatives funded through the Tallinn Mechanism.
  
  

• Coordinating project implementation efforts between donors, Ukrainian implementing partners, and beneficiaries.
  
  

• Supporting the functioning of the Catalog — an online platform that ensures effective interaction between donors and beneficiaries by simplifying the processes of verification and support for submitted projects/needs.
  
  

• Enhancing communication and trust between international partners and Ukraine regarding TM's activities.

TMPO's activities enable Ukraine to formalise feedback with international partners within the Tallinn Mechanism and strengthen mutual trust. This contributes to the emergence of new assistance programmes and increases the transparency and accountability of the use of funds, which is especially important for international partners who want to see real results. This, in the long term, opens up opportunities for new support programmes.

Reaching a New Level

In 2025, international cooperation within the Tallinn Mechanism has deepened, culminating in the launch of the TMPO. In May, the World Bank became an official observer of the Tallinn Mechanism. NATO and the EU had already held this status. This level of involvement is a powerful signal of confidence in the project and an understanding of the importance of the tasks it faces. 

The number of participating countries is also expanding. In July, Norway joined the initiative and will allocate 2.1 million euros annually to support Ukraine's cyber resilience. Italy, which became part of the Tallinn Mechanism in 2024, announced in July that it would contribute 1 million euros.

In June, the Swedish International Development Cooperation Agency (Sida), under the Tallinn Mechanism, allocated a 12.2 million euro aid package to strengthen Ukraine's cyber resilience. Swedish support will enable the implementation of a number of critical projects, including upgrading IT infrastructure, improving email and application security, and training employees of key government agencies.

Canada contributed 3 million CAD (approximately 1.8 million Euro) to support projects that will strengthen Ukraine's systemic readiness to counter cyber threats, train qualified personnel, support the stable operation of critical infrastructure, and create reliable systems for detecting and responding to cyberattacks.

The exchange of best practices, joint training, and public case studies of projects implemented within the TM demonstrate how international consolidation can work in practice. This makes the Tallinn Mechanism relevant not only for Ukraine, but also for the entire democratic world seeking effective models for countering global cyber threats.

The views expressed in this article are those of the author(s) and do not necessarily reflect the views of the World Economic Forum. The content was provided by the contributing organisation and is shared to encourage dialogue and the exchange of diverse perspectives. The World Economic Forum remains impartial and does not necessarily endorse any political views or specific language used.