Navigating Cyber Warfare: Insights from MOD’s Cybersecurity Trailblazer

Navigating Cyber Warfare: Insights from MOD’s Cybersecurity Trailblazer

At a glance

• Major General Jonathan Shaw was the first Head of the Defence Cyber Security Programme at the UK Ministry of Defence (MOD).
• Cyber operations have moved from a side concern to a core part of national defense.
• Shaw tells organizations to stay hard to spot, assume they will be breached and plan for it.
• He says supply chains are a common way in, so security rules have to extend to partners.
• Shaw also argues that leaders should trust the specialists closest to the problem.

A soldier who learned cyber

Few people in British defense have thought longer about cyber conflict than Major General Jonathan Shaw. As the first head of the Defence Cyber Security Programme at the Ministry of Defence (MOD), he helped shape how the UK approached cyber warfare as digital threats grew. He started out knowing nothing about it. In a March 2025 interview with CloudComputing News, he said his proudest achievement was learning to explain “a digital subject in an analogue way.”

Why cyber breaks the chain of command

Shaw’s appointment marked a turning point in how the MOD treated digital threats. National defense had been built around physical assets and conventional forces. “Cyber is fundamentally disruptive,” he said, because it upends the usual order in which senior leaders get information first.

His answer is what the military calls mission command: train and trust the people at the coalface, who often understand the threat better than the executives above them. Many senior leaders, he said, were “cyber tourists.”

Three steps Shaw recommends

Shaw’s first step is to avoid being spotted. He tells organizations to assume cyberspace is insecure and to limit how visible they make themselves online, which can clash with marketing, and he admits people trade privacy for convenience too easily.

His second step is to “accept that you will be hacked at some point.” That means building resilience and redundancy and training staff to respond to a breach.

Supply chains and partners

The third step is to make sure the whole supply chain follows strict security rules. Vendors are a common way in.

Shaw points to Russia’s 2007 cyberattack on Estonia, which disrupted banking, government and media after a dispute over a Soviet war memorial. Estonia responded by building a national cyber defense unit and is now seen as a model. He also cited the SolarWinds attack as a sign of more supply chain attacks to come.

States, criminals and deterrence

Shaw believes major states avoid all-out cyber war with each other for fear of retaliation. The bigger danger, he says, comes from criminal groups that act as proxies for states. They have no infrastructure to hit back at, but they operate from real countries, and governments can use diplomatic and economic pressure against them.

He also warned against treating blockchain as a guaranteed fix. It has been hacked.

Lessons for defenders today

Shaw’s experience as the MOD’s first cyber chief points to a few lasting lessons: keep a low profile, prepare for a breach, hold suppliers to the same standard, and push decisions down to the people who understand the threat. As attacks on national infrastructure grow, those lessons apply to companies as much as to armies.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.