Estonia: Total cyberdefence, preparedness and competitiveness

In 2007, Estonia was the first state to experience a coordinated large-scale cyberattack targeting government, financial, and media infrastructure. For a small, highly digitalised country on NATO's eastern border with Russia, cyber resilience means survival. Since then, Estonia has pioneered a Total Defence concept that seamlessly integrates civilian and military cyber capabilities, positioning the nation as Europe's digital security laboratory and host to NATO's Cooperative Cyber Defence Centre of Excellence. Estonia is the third case study framed in the exploratory research activity on regions, dual-use and open strategic autonomy (REGDUALOSA) of the Joint Research Centre. This report presents the findings of an in-depth review of the Estonian cybersecurity and cyberdefence ecosystem, applying an adapted version of the Joint Research Centre's POINT methodology and extracting lessons from its experience. With a whole-of-society approach, Estonia has developed dedicated mechanisms and pioneering infrastructure to convert national security requirements into innovation capacity, start-up development, and cyberdiplomacy. However, tensions are also present in this small country, including talent availability and retention, the appetite of foreign investors, and the risk of scale-up company delocalisation. These findings offer evidence for policy design of relevance to European policymakers, in a context of unprecedented geopolitical uncertainty. As the EU prepares the new financial framework 2028–2034 in which defence, preparedness, and strategic autonomy are on the rise, these priorities must go hand in hand with sustainable competitiveness and the right to stay in your own territory