Institutional Landscape

• Three principal agencies: Ukraine's intelligence architecture centres on three principal services with distinct but overlapping mandates. The GUR (Holovne Upravlinnia Rozvidky) is the military intelligence directorate, responsible for foreign military intelligence, special operations, agent networks abroad, and operational support to the Armed Forces. The SBU (Sluzhba Bezpeky Ukrayiny) is the internal security and counterintelligence service, with a broad mandate spanning counterterrorism, counterespionage, border security, cybersecurity, and the investigation of high-treason and collaboration cases. The SVR (Sluzhba Zovnishnioi Rozvidky) is Ukraine's foreign intelligence service, responsible for political intelligence collection abroad, though its profile in public reporting on the war has been lower than that of GUR and SBU.
• Wartime restructuring: The 2022 invasion exposed serious weaknesses in both GUR and SBU, particularly in the SBU, where Russian FSB penetration was subsequently confirmed to have been extensive at senior levels. President Zelensky replaced the heads of both SBU and GUR in July 2022, bringing in new leadership with mandates for comprehensive reform. The SBU purge that followed removed hundreds of officers with suspect loyalties or family ties to Russia, involved opening criminal proceedings against dozens of officials, and restructured internal security protocols to reduce penetration vulnerability. By 2024–2026, Ukrainian officials and Western intelligence assessors regard the post-purge SBU and GUR as substantially more capable and secure than their pre-war predecessors.
• Civilian talent integration: A distinctive feature of Ukraine's wartime intelligence evolution has been the systematic recruitment and integration of civilian talent, particularly from Ukraine's substantial technology and software sectors. Programmers, data scientists, cryptographers, and telecommunications engineers have been integrated into intelligence units, bringing civilian innovation culture to organisations that had previously been bureaucratically rigid Soviet institutional heirs. This talent infusion has accelerated technical capability development in signals intelligence, cyber operations, drone intelligence applications, and open-source intelligence analysis that would have taken years through traditional institutional development pathways.

GUR: Military Intelligence and Special Operations

• Agent networks and human intelligence: The GUR has developed and maintained extensive human intelligence (HUMINT) networks in Russian-occupied Ukrainian territories, in Russia proper, and among the Russian military. The effectiveness of these networks has been evidenced by the remarkable accuracy of Ukrainian targeting for long-range strikes against Russian military logistics, command posts, air defence systems, and ammunition depots. Information about Russian offensive intentions — including advance warning of several major Russian attacks in 2023 and 2024 that allowed pre-emptive Ukrainian defensive repositioning — has been attributed to GUR sources within Russian command structures. Managing these networks under wartime conditions, with Russian FSB counterintelligence actively hunting Ukrainian agents, represents a continuing operational challenge of the highest order.
• High-value target operations: The GUR has claimed responsibility for a series of high-profile operations targeting Russian military and security service personnel, including the elimination of several Russian generals, senior military planners, and figures associated with Russian war crimes. These operations have utilised a combination of agent-provided intelligence, signals intelligence for movement tracking, and special operations units for execution. The assassinations have served both operational purposes — disrupting Russian command continuity — and psychological and deterrence functions, demonstrating to Russian elites that participation in the war carries personal risk regardless of physical location within Russia.
• Maritime and deep-strike intelligence: GUR has played a central role in Ukraine's naval drone campaign against Russian Black Sea Fleet assets and maritime infrastructure. The intelligence fusion required for effective naval drone strikes — including real-time tracking of Russian ship movements, weather and sea state intelligence, and identification of vulnerabilities — has been among the most technically sophisticated aspects of Ukraine's intelligence operations. GUR officials have publicly acknowledged responsibility for planning the attacks on the Crimean Bridge and the Sevastopol naval base, framing these as legitimate military intelligence and special operations activities.

SBU: Security Service Transformation

• Counterintelligence reforms and results: The post-2022 SBU under Director Vasyl Maliuk has focused intensively on counterintelligence — both neutralising existing Russian agent networks within Ukraine and hardening institutional structures against future penetration. Thousands of counterintelligence cases were opened in 2022–2025, resulting in hundreds of convictions for high treason, espionage, and collaboration with Russian forces. The cases span a wide spectrum from low-level occupant collaborators providing targeting information via mobile phone, to former senior officials who maintained clandestine communications with Russian intelligence handlers throughout their period of service in Ukrainian institutions.
• Collaboration and occupied territory cases: SBU's mandate has expanded substantially to address the challenge of collaboration with Russian occupying authorities in territories that have fallen under Russian control and returned to Ukrainian jurisdiction. Investigating collaboration — which ranges from civilians who accepted humanitarian aid distribution roles under occupation (generally treated leniently) to those who voluntarily provided information leading to the deaths of Ukrainian soldiers or civilians (prosecuted severely) — requires nuanced legal frameworks and evidence collection standards. The volume of cases and the complexity of the legal distinctions involved have stretched SBU investigative and prosecutorial capacity significantly.
• Internal security and VIP protection: The SBU's traditional domestic security roles have been supplemented by wartime responsibilities including the investigation of Russian-orchestrated assassination attempts against Ukrainian leadership — of which several have been disrupted since 2022 — and the protection of Ukrainian officials and critical infrastructure against insider threats. The SBU operates a specialised department for protection of state leadership that has been credited with preventing multiple Russian intelligence operations targeting President Zelensky, senior ministers, and military commanders. Intelligence on planned assassination attempts, reportedly received in part through Western partner services, has been operationally valuable in these defensive operations.

Western Intelligence Cooperation

• Five Eyes and bilateral partnerships: Ukraine's intelligence cooperation with Western partners has reached an unprecedented depth since 2022, transforming what were previously arms-length relationships into close operational partnerships. US intelligence agencies, particularly the CIA and NSA, have provided substantial intelligence support to Ukraine including satellite imagery, signals intelligence derived from monitoring Russian communications, and advance warning of Russian missile and drone attacks that has enabled Ukrainian air defence to intercept a higher proportion of incoming threats. The UK's MI6 and GCHQ have also developed extensive working relationships with their Ukrainian counterparts. While the specifics of intelligence sharing arrangements remain classified, Ukrainian officials have publicly acknowledged the critical operational value of Western intelligence contributions to the war effort.
• Intelligence that enabled key operations: Several major Ukrainian military successes have been linked in reporting to Western intelligence support. The success of HIMARS strikes against Russian logistics depots in summer 2022, the sinking of the Moskva cruiser in April 2022, and various other operations have all been associated with intelligence that either originated from Western collection or was validated and operationalised with Western assistance. The degree of Western involvement in specific targeting decisions has been a sensitive diplomatic question, with Western governments generally avoiding public confirmation of details to maintain political deniability and avoid domestic controversy about the extent of involvement in Ukrainian offensive operations.
• Training and technical cooperation: Beyond direct intelligence sharing, Western services have invested substantially in building Ukrainian intelligence capacity through training programmes, technical equipment provision, and the deployment of advisers operating within Ukrainian intelligence facilities. CIA and MI6 involvement in training Ukrainian intelligence officers has been reported by multiple news organisations, with particular focus on human intelligence tradecraft, signals intelligence collection and analysis, and cyber operations. These capacity-building investments are designed to produce permanent improvements in Ukrainian intelligence capability rather than dependence on continued Western intelligence provision.

Operations Inside Russia

• Sabotage networks and infrastructure targeting: Ukrainian intelligence services have developed extensive sabotage networks operating inside Russia, targeting military logistics infrastructure, fuel depots, railway networks serving frontline supply lines, and military-industrial facilities. Explosions at Russian fuel and ammunition storage sites across multiple oblasts bordering Ukraine — and increasingly at sites hundreds of km from the border — have been attributed to Ukrainian intelligence operations through a combination of recruited local agents, remotely directed saboteurs, and advanced drone systems capable of penetrating Russian air defences at low altitude. The cumulative effect of these operations on Russian logistical capacity is difficult to quantify precisely but is assessed by Western analysts to be operationally meaningful.
• Political intelligence penetration: Ukrainian intelligence claims of sources within Russian political and military elite circles have been treated with cautious credibility by Western analysts. The quality of information that Ukrainian intelligence has demonstrated about internal Russian military decision-making — including details of debates within the Russian General Staff about operational priorities that were subsequently confirmed by events — suggests penetration of Russian military information spaces at a level that extends beyond what open-source collection or signals intelligence alone would explain. Russian FSB counterintelligence has responded with intensified internal security measures, travel restrictions on sensitive personnel, and communications security protocols, all of which impose costs on Russian institutional functioning.
• Influence and information operations: GUR and associated bodies have developed active information and influence operations directed at Russian audiences, exploiting the disillusionment created by wartime losses, economic hardship, and the visible gap between official Russian narratives and wartime realities experienced by soldiers and their families. These operations utilise social media platforms, alternative media channels operating anonymously, and direct outreach to specific target populations within Russia. While measuring the effectiveness of information operations is inherently difficult, Russian authorities' intense effort to block foreign platforms and restrict information flows inside Russia is at least partly a response to the threat these operations represent to domestic narrative control.

Counterintelligence Challenges

• Ongoing Russian infiltration attempts: Despite the post-2022 purges and reforms, Russian intelligence services — FSB, GRU, and SVR — have continued sustained efforts to penetrate Ukrainian institutions, military formations, and civilian infrastructure through agent recruitment, cyber intrusion, and influence operations. Russian intelligence has recruited sources among Ukrainian prisoners of war returned through exchanges, exploited financial vulnerability of military personnel and civil servants, and maintained dormant agent networks established before 2022 that have been activated at operationally relevant moments. The scale of Russian intelligence effort directed at Ukraine is assessed by Western agencies as among the most intensive ever observed against a single target country.
• Digital and signals security: Maintaining signals and communications security across a wartime military and government organisation of Ukraine's size presents profound challenges. Russian signals intelligence collection is persistent and technically sophisticated, and the widespread use of consumer digital devices — smartphones, messaging applications, social media — by military personnel creates attack surfaces that dedicated technical security measures cannot fully close. SBU's communications security directorate has invested heavily in security awareness training, secure communications infrastructure provision, and technical monitoring to detect compromise, but enforcing communications security discipline across hundreds of thousands of military personnel in contact with families and civilian networks is an inherently imperfect endeavour.
• Allied territory and diaspora security: As large numbers of Ukrainian refugees and military family members reside in European countries, Russian intelligence has targeted diaspora communities for recruitment, social network exploitation, and as channels for reaching military personnel through family communications. Several European security services have reported disrupting Russian intelligence operations targeting Ukrainian diaspora communities and monitoring the communications of Ukrainian military personnel through family members abroad. This threat dimension has complicated the relationship between Ukrainian refugee communities and their host country security services, requiring sensitive management to maintain community trust while addressing legitimate security concerns.

Technology and Innovation

• AI and data analytics in intelligence: Ukrainian intelligence services have been early adopters of artificial intelligence and machine learning tools for intelligence analysis tasks, including pattern recognition in satellite and drone imagery, social network analysis for identifying agent relationships and communication patterns, predictive modelling for Russian offensive activity, and large-scale processing of open-source information from Russian social media, news media, and government publications. The combination of commercial AI tools adapted for intelligence applications with custom-developed analytical systems — developed with both internal Ukrainian talent and Western technology partners — has substantially expanded the analytical capacity of intelligence services whose trained analyst workforce was severely stretched by wartime demands.
• Drone intelligence applications: The integration of drone technology into intelligence collection has been a major operational innovation. Small commercial drones adapted for extended autonomous operation provide persistent surveillance of Russian rear areas, supply lines, and command facilities that was previously only achievable through aerial reconnaissance aircraft or satellite systems controlled by Western partners. GUR has invested heavily in a drone intelligence programme that operates at multiple levels — from tactical battlefield reconnaissance to longer-range intelligence-collection missions over Russian territory — creating a genuinely indigenous collection capability that supplements Western-provided intelligence.
• Open-source intelligence systematisation: Ukraine has emerged as a global leader in operationalising open-source intelligence (OSINT) for military and intelligence purposes. The systematic exploitation of Russian social media, geo-tagged photographs posted by Russian soldiers, commercially available satellite imagery, flight tracking data, and public financial records has yielded operationally valuable intelligence that has complemented and validated classified collection. Ukraine's OSINT ecosystem, spanning both government analytical units and the extensive civilian volunteer OSINT community that has developed during the war, represents a genuine intelligence innovation with implications for how future conflicts will be fought and understood.

Frequently Asked Questions