Mikko Hyppönen, one of cybersecurity’s most recognizable figures, has spent decades analysing malware. Now he’s applying those same defensive instincts to a different kind of threat: drones. As TechCrunch reports, the Finnish veteran has joined Sensofusion, a Helsinki-based anti-drone company, as a senior research lead focused on applying cybersecurity methodologies — particularly protocol analysis and signal intelligence — to counter-drone systems. His work reportedly involves building detection frameworks that catalogue drone communication signatures, much as antivirus databases catalogue malware variants.

From floppy disks to a $250 billion industry

Hyppönen’s career arc mirrors the cybersecurity industry’s own transformation. He began his career in the late 1980s reverse-engineering software. In those early years, virus writers were hobbyists driven by curiosity. Early viruses in the 1990s, which spread via floppy disk, sometimes did nothing more than display a message on a user’s screen — yet they travelled globally, even reaching remote research stations. The ILOVEYOU worm of 2000 infected over 10 million Windows computers worldwide.

Today, the cybersecurity industry is estimated to be worth hundreds of billions of dollars, and the economics of exploitation have shifted fundamentally. Exploit tools targeting an iPhone or Chrome browser now reportedly cost six figures to several million dollars, according to Hyppönen — effectively pricing out financially motivated criminals and limiting the most sophisticated attacks to state-backed actors. For Hyppönen, this means the era of widespread virus attacks has largely ended, and the defensive challenge has moved elsewhere.

Why drones are the next defensive frontier

The pivot to drone defence is driven by a specific and urgent strategic context. According to a report by Latvia’s Constitution Protection Bureau, drones are responsible for between 70 and 80 percent of casualties on both sides of the war in Ukraine. For Hyppönen, who lives roughly two hours from Finland’s border with Russia, the threat is not abstract. That proximity informs the urgency of his work at Sensofusion, which has focused on building counter-drone capabilities tailored to the specific threat profiles emerging from the conflict in Ukraine — including small first-person-view (FPV) drones that can be assembled for a few hundred dollars and deployed with devastating tactical effect.

The parallels between malware and drone defence

The technical overlap between the two fields is striking. In cybersecurity, defenders build signature-based systems to identify and block malicious code. In drone defence, the equivalent involves recording radio frequencies — known as IQ samples — to detect the protocols used to control unmanned vehicles. Once a drone’s control frequency is identified, defenders can deploy targeted countermeasures. Jamming, for example, involves broadcasting noise on the drone’s control frequency to sever the link between operator and aircraft — functionally similar to a denial-of-service attack in cybersecurity. More sophisticated approaches exploit vulnerabilities in the drone’s communication protocol itself: sending malformed packets that cause the flight controller to crash, or spoofing GPS signals to redirect the vehicle. Hyppönen has drawn a direct comparison to buffer overflow exploits in software — the principle is the same, but the target is a physical system in flight.

At Sensofusion, Hyppönen’s team is reportedly developing a continuously updated library of drone signal signatures, analogous to the threat intelligence feeds that power enterprise cybersecurity platforms. The goal is to reduce the time between first detection of a new drone type and deployment of an effective countermeasure — compressing what in traditional cybersecurity might take weeks into hours.

Structural dynamics at play

Hyppönen’s career shift illustrates a broader pattern in the defence technology sector: as traditional cybersecurity matures and device security hardens, expertise migrates toward emerging physical-digital threat domains. The anti-drone market is attracting growing investment as militaries and governments worldwide grapple with the asymmetric advantage that low-cost unmanned systems provide.

What makes the drone challenge structurally different from traditional cybersecurity is the speed of the feedback loop. The cat-and-mouse dynamic that defined decades of malware evolution is compressed in drone warfare, where tactical adaptation happens in days rather than years. Hyppönen has framed the work as defending humans against autonomous machines — a scenario that may sound futuristic but reflects the concrete reality of counter-drone operations.

The institutional incentives are clear. A cybersecurity industry valued in the hundreds of billions has largely solved the consumer device problem — at least for those who can afford an iPhone. The unsolved problem, the one where defensive expertise has yet to catch up with offensive capability, is now airborne.

Feature image by Frederic Bartl on Pexels