Mikko Hyppönen, one of cybersecurity’s most recognised figures after decades fighting malware, has pivoted to anti-drone defence, as reported by TechCrunch. In 2025, Hyppönen became chief research officer at Sensofusion, a Helsinki-based company developing anti-drone systems for law enforcement and military clients.
From floppy disks to a major industry
Hyppönen’s career spans the full arc of the malware era. He began in the late 1980s reverse-engineering software, then spent decades at Finnish antivirus maker F-Secure analysing thousands of malware variants. He was among those who analysed the ILOVEYOU virus in 2000, a worm that infected millions of Windows computers worldwide. His work on that outbreak centred on dissecting the worm’s communication protocol — mapping how it replicated, identifying the specific pattern in its network traffic, and using that signature to shut it down. It’s the same basic technique he now applies to drones: intercept the signal, fingerprint the protocol, neutralise the threat. He witnessed the shift from hobbyist virus writers distributing code on floppy disks to state-sponsored campaigns like Russia’s NotPetya attack in 2017.
The cybersecurity industry has professionalized to the point where exploits for devices like iPhones reportedly cost six figures to millions of dollars. That price floor effectively limits offensive tools to government-backed actors. Hyppönen believes the era of widespread viruses has ended — which is precisely why he moved on.
Why drones, and why now
The proximate cause is Ukraine. Drones have been responsible for a significant portion of casualties on both sides of the war. For Hyppönen — a Finnish citizen living near the Russian border, with grandfathers who fought in historical conflicts with Russia and a role in the Finnish military reserves — this is personal as well as professional. He has described the work as defending humans against autonomous machines, a mission he acknowledges sounds like science fiction but represents his concrete daily reality.
Same playbook, different threat
The structural parallels between malware defence and drone defence are striking. Both rely on signature-based detection: in cybersecurity, identifying malicious code patterns; in counter-drone work, recording radio frequencies to detect the protocols controlling unmanned vehicles. Once you identify the protocol, Hyppönen explained, you can jam it or exploit vulnerabilities to crash the drone.
The cat-and-mouse dynamic is identical. Defenders learn to neutralise a threat; attackers adapt. The cycle repeats. Even the adversary has stayed the same — much of Hyppönen’s cybersecurity career involved countering Russian malware threats, and his current work involves defending against Russian drone attacks.
What Hyppönen is building
At Sensofusion, Hyppönen’s team is developing detection systems that can identify and classify drones by their radio-frequency signatures — essentially building a threat database analogous to the virus definition libraries he maintained for decades at F-Secure. The company’s systems are designed for deployment by both law enforcement protecting civilian airspace and military units operating in active conflict zones. Companies like France’s CerbAir are building in the same space, but Hyppönen’s edge is the depth of his detection expertise: decades spent cataloguing how malicious code identifies itself, now applied to cataloguing how hostile drones betray their presence.
The challenge, as Hyppönen has described it, is speed. In cybersecurity, a new malware variant might circulate for days before signatures update. In drone warfare, the window between detection and response is seconds. That compression of the threat cycle — from days to moments — is the core engineering problem Sensofusion is trying to solve, and it’s where Hyppönen believes his career’s worth of pattern-recognition work matters most. As he has observed at security conferences, successful cybersecurity is invisible — when it works perfectly, no incidents occur. In drone defence, the stakes are bodies on the ground, and the margin for error is considerably thinner.
Feature image by Tima Miroshnichenko on Pexels
