Military conflict as a risk factor for the IT sector: a systematisation of threats and mitigation strategies

Abstract

Purpose. To systematise documented threats that military conflict creates for IT companies and to build a «threat group – mitigation strategy – expected effect – limit of effectiveness» matrix with the evidentiary status stated explicitly. Design/methodology/approach. A desk analysis of documented evidence with subsequent qualitative systematisation. The source base was selected purposively from records verified by DOI or URL: association releases carrying National Bank of Ukraine data, peer-reviewed Ukrainian and international publications, and a vendor cyber-threat report. A four-level scale of evidentiary status was introduced for each matrix row, and the limits of what was actually read are recorded explicitly. Findings. The classification criterion – the affected asset of an IT company – is substantiated, and six groups of wartime threats are identified: personnel; computing and energy infrastructure; data and the IT perimeter; financial flows; legal and regulatory status; client relations. Each group is matched with a mitigation strategy, an expected effect and the limit beyond which it ceases to work, with the evidentiary basis marked separately. The strategies act complementarily: the failure of one link is not compensated by reinforcing its neighbour. Originality/value. Wartime threats are brought together not as a list of measures but as a matrix with explicit limits of effectiveness and an evidentiary status for each row. The specificity of the wartime factor is attributed not to the list of groups but to the profile of their simultaneous activation, which removes the effect of intra-firm diversification. The matrix suits a preliminary diagnosis and requires empirical validation.

JEL: D81, L86, M10.