The metaphor arrived during a keynote at Black Hat USA 2025. Mikko Hyppönen, one of cybersecurity's most recognizable figures, stood on stage in a teal suit and described his profession as cybersecurity Tetris. Complete a line, and it vanishes. Succeed, and nothing visible happens. Fail, and the bricks pile up.
As TechCrunch reported this week, Hyppönen has now applied that same logic to a different domain entirely. After more than 35 years fighting malware – from the floppy-disk viruses of the late 1980s to the state-sponsored spyware of today – the Finnish security veteran has pivoted to counter-drone technology. He joined Helsinki-based Sensofusion as chief research officer in mid-2025.
The move deserves attention beyond the cybersecurity trade press. It signals something about where defensive expertise is migrating, what threats European institutions should be tracking, and how the skills developed in one domain can transfer to another when the underlying logic remains constant.
The Mechanism Behind the Pivot
Hyppönen lives approximately two hours from Finland's border with Russia. That proximity shapes his threat perception. The war in Ukraine, where the majority of deaths have reportedly come from unmanned aerial attacks, has made drone defense feel urgent in a way that another malware variant does not.
But geography alone does not explain the career shift. The deeper logic is about maturity curves. Hyppönen argues that traditional cybersecurity has professionalized to the point where the hardest problems are now expensive problems. An iPhone exploit, he notes, can cost six figures or even millions of dollars. That price point effectively restricts such tools to governments and well-resourced intelligence agencies – a significant win for consumer security, even if it does not eliminate the threat.
Drone defense, by contrast, remains almost uncharted territory. The protocols are less understood. The signatures are less developed. The defensive infrastructure is nascent. For someone who built a career on reverse engineering and pattern recognition, this represents a new frontier with familiar mechanics.
Signatures, Frequencies, and the Logic of Detection
The technical parallels between malware defense and drone defense are more direct than they might appear. In cybersecurity, defenders build signatures – patterns that identify malicious code and distinguish it from legitimate software. Detection systems scan for these signatures and block or quarantine threats.
Sensofusion's approach to drones follows a similar architecture. Instead of scanning code, the system records radio frequencies – what Hyppönen calls IQ samples. From these samples, the system detects the communication protocols used to control drones. Once the protocol is identified, defenders can build signatures for recognizing unknown drones, jam their control signals, or even attempt cyberattacks against the drone's onboard systems to cause malfunctions.
We detect the protocol from there and build up signatures for detecting unknown drones.
Mikko Hyppönen
The constraint-based framing matters here. This approach works when drones rely on radio communication with a ground operator. Fully autonomous drones operating on pre-programmed flight paths or onboard AI present a different challenge – one that signature-based detection may not fully address. The field is evolving faster than the defenses.
What This Means for European Security Policy
For policymakers and foresight practitioners, Hyppönen's pivot illuminates several dynamics worth tracking.
Talent Migration Patterns
When senior practitioners move between domains, they carry institutional knowledge, methodological frameworks, and professional networks. The cybersecurity-to-drone-defense pipeline is not yet a flood, but Hyppönen's visibility may accelerate it. European defense ministries and procurement offices should consider how to facilitate – or at least not obstruct – this kind of cross-domain expertise transfer.
The Nordic Security Cluster
Finland's proximity to Russia has concentrated minds. Sensofusion is based in Helsinki. The country's defense posture, its recent NATO accession, and its technology sector create conditions for counter-drone innovation that may not exist elsewhere in Europe. Whether this becomes a regional export capability or remains a national priority depends on procurement frameworks and alliance coordination.
Dual-Use Technology Governance
Counter-drone systems sit at the intersection of civilian and military applications. Airports, stadiums, and critical infrastructure all face drone threats. So do military installations and forward operating bases. The regulatory frameworks for these systems – export controls, certification standards, liability regimes – remain underdeveloped. The EU's approach to dual-use AI under the AI Act provides some precedent, but counter-drone technology raises distinct questions about kinetic effects and rules of engagement.
The Cybersecurity-Physical Security Convergence
Hyppönen's career arc embodies a broader trend: the boundaries between cyber and physical security are dissolving. Drones are networked systems. So are vehicles, medical devices, and industrial control systems. Defenders who understand both the software layer and the physical consequences of compromise will be increasingly valuable. Training pipelines and professional certifications have not yet caught up.
The Limits of the Analogy
The Tetris metaphor has its limits. In cybersecurity, a successful defense often means the threat is neutralized – the malware is blocked, the vulnerability is patched, the attacker is locked out. In drone defense, the physical stakes are different. A jammed drone may crash. A crashed drone may cause collateral damage. The feedback loops are faster and less forgiving.
Hyppönen acknowledges this shift in framing.
We're on the side of humans against machines, which sounds a little bit like science fiction, but that's very concretely what we do.
Mikko Hyppönen
The statement is revealing. Cybersecurity has always involved adversarial humans – virus writers, criminal gangs, state-sponsored hackers. The humans against machines framing suggests a different mental model, one where the autonomous system itself becomes the adversary. Whether that framing holds as drone AI advances remains to be seen.
The Broader Pattern
Hyppönen's career trajectory – from Commodore 64 hacking to F-Secure to Sensofusion – traces the evolution of digital threats over four decades. The early virus writers operated out of curiosity. The ILOVEYOU worm in 2000, which Hyppönen and his colleagues were the first to discover, infected over 10 million Windows computers worldwide. Today, malware is almost exclusively the domain of criminals, spies, and mercenary spyware makers.
The cybersecurity industry is now estimated at $250 billion. The professionalization that Hyppönen describes – from free tools to paid services, from hobbyist defenders to enterprise security operations – took decades. Counter-drone technology is at an earlier stage of that curve. The question is whether it will follow the same trajectory, or whether the physical stakes and military applications will shape a different path.
For European institutions, the practical implication is clear: the expertise developed in one security domain can transfer to another, but only if the institutional pathways exist. Procurement frameworks, research funding, and talent mobility policies all shape whether Europe can capitalize on its cybersecurity depth to address emerging physical threats.
The bricks are piling up. The question is who will clear the lines.
For those tracking these convergences – where cyber meets physical, where defense meets governance, where European institutions meet emerging threats – the conversations that matter most happen in rooms, not on feeds. Human x AI Europe convenes on May 19 in Vienna. The right people, the right room, the right day. Details here.
Frequently Asked Questions
Q: Who is Mikko Hyppönen and why did he leave cybersecurity?
A: Mikko Hyppönen is a Finnish cybersecurity expert with over 35 years of experience fighting malware, formerly at F-Secure. He joined Helsinki-based Sensofusion as chief research officer in mid-2025 to work on counter-drone technology, motivated by the drone warfare in Ukraine and Finland's proximity to Russia.
Q: How does counter-drone technology work?
A: Counter-drone systems record radio frequencies (IQ samples) to detect the communication protocols used to control drones. Once identified, defenders can build detection signatures, jam control signals, or attempt cyberattacks to cause drone malfunctions.
Q: What is Sensofusion and what does the company do?
A: Sensofusion is a Helsinki-based company that develops anti-drone systems for law enforcement agencies and military applications. The company focuses on detecting, tracking, and neutralizing unauthorized drones using radio frequency analysis.
Q: How are cybersecurity skills relevant to drone defense?
A: Both domains rely on signature-based detection, pattern recognition, and protocol analysis. Cybersecurity defenders identify malware through code signatures; drone defenders identify threats through radio frequency signatures. The underlying logic of detection and neutralization transfers between domains.
Q: What are the policy implications of the cybersecurity-to-drone-defense talent migration?
A: European policymakers should consider procurement frameworks, export controls for dual-use technology, and talent mobility policies that facilitate cross-domain expertise transfer. Counter-drone systems require governance frameworks that address both civilian and military applications.
Q: What limitations exist in current counter-drone detection methods?
A: Signature-based detection works when drones rely on radio communication with ground operators. Fully autonomous drones operating on pre-programmed flight paths or onboard AI present challenges that current signature-based approaches may not fully address.