Eastern Europe: Growth Potential in the Shadow of Geopolitics

Geopolitics is the dominant factor shaping the modernization market in Eastern Europe. The war in Ukraine since February 2022 has had a cascading impact on the entire region: from direct IT infrastructure destruction, through talent migration, to a fundamental shift in priorities — cybersecurity and system resilience have become matters of national security.

Ukraine, despite the ongoing conflict, shows remarkable IT sector resilience. Before the war, Ukraine's IT sector employed over 300,000 specialists and generated $7.5 billion in export revenue. The war caused 30–40% of IT specialists to migrate, but simultaneously accelerated digitalization: the Diia system (Ukrainian e-government) became a global model for digital administration under crisis conditions.

Balkan countries (Serbia, Bosnia and Herzegovina, Montenegro, North Macedonia, Albania, Kosovo) are at various stages of EU integration, directly affecting access to funds and modernization standards. Serbia and Montenegro, as EU candidates, benefit from pre-accession programs (IPA III), but the pace of digital reform is uneven.

Moldova and Georgia, with granted EU candidate status, are experiencing accelerated modernization driven by European aspirations. However, both countries struggle with limited budgets, weak infrastructure, and Russian geopolitical influence.

Cyberattacks on critical infrastructure in the region have increased 300% since 2022, making cybersecurity not just a technical issue but an existential one. Organizations in the region must build digital resilience under active threat conditions, which is a fundamentally different challenge than compliance-driven cybersecurity in Western Europe.

Eastern Europe has the lowest digital maturity in Europe, with DESI scores of 30–45 (compared to 55–70 in Western Europe and 45–55 in Central Europe). The EIB survey found that advanced digital technology adoption is only 41% in Eastern Europe, compared to 71% in Western Europe.

Cloud adoption in the region stands at 30–40%, with significant country-level variation. Serbia and Montenegro achieve 35–40%, while Moldova and Albania are below 25%. Key barriers include: limited IT budgets, lack of cloud specialists, insufficient network infrastructure (especially outside capitals), and data security concerns.

The public sector is particularly behind. Many government institutions in the region operate on systems from the 1990s or earlier, with minimal modernization investment. E-government is at an early stage (with the exception of Ukraine and Estonia, which technically belongs to Central Europe but is often cited as a model for the region).

Paradoxically, low digital maturity also means a smaller legacy footprint in some sectors. Organizations that never invested in advanced on-premise systems can migrate directly to cloud — the "leapfrog" effect is stronger than in any other European region. Startups and new companies in the region often build on modern architectures from the start, without legacy burden.

Eastern Europe is on the front line of European cyberwarfare. Cyberattacks on critical infrastructure have increased 300% since 2022, and the region experiences attacks that serve as testing grounds for techniques later used against Western European targets.

Cybersecurity spending in the region is only 1.8% of IT budget — nearly half of Western Europe's 3.2%. This gap is particularly dangerous given rising threats. Organizations in the region often lack basic protection mechanisms: no network segmentation, weak identity management, no continuous monitoring.

Ukraine has become a global cybersecurity laboratory. Experience defending against Russian cyberattacks (NotPetya, WhisperGate, HermeticWiper) generates unique know-how that is increasingly valued in the global market. Ukrainian cybersecurity specialists are among the world's most experienced in defending against advanced persistent threats (APTs).

NIS2, while formally applying to EU countries, affects the entire region — countries aspiring to EU membership must align their cybersecurity frameworks with European standards. This creates modernization pressure but also requires investments that many organizations in the region cannot afford.

The Zero Trust model is particularly relevant in the region where threats are real and active. However, implementing Zero Trust requires advanced infrastructure and competencies that the region lacks. Simplified Zero Trust models for SMEs and partnerships with Western European cybersecurity firms may be the solution.

Eastern Europe experiences the strongest brain drain in Europe. The salary differential is dramatic: €20–35K for senior developers in the region vs €60–100K+ in Western Europe. An estimated 25–35% of IT specialists in the region experience skills shortages, while the best specialists emigrate.

The war in Ukraine accelerated this trend — 30–40% of Ukrainian IT specialists migrated to Poland, Germany, the Netherlands, and other countries. However, many continue working remotely for Ukrainian firms or Western European clients, creating a distributed IT diaspora.

The paradox is that brain drain also has positive effects. The IT diaspora builds networks, gains experience in advanced projects, and transfers knowledge back to the region. Ukrainian IT specialists working in Western Europe often engage in pro bono projects for Ukrainian organizations, transferring best practices.

Balkan countries experience a similar trend on a smaller scale. Serbia and Bosnia lose talent to Germany and Austria, but simultaneously develop IT outsourcing sectors that attract Western European projects.

Solving the talent paradox requires: building regional attractiveness (higher salaries, better conditions), developing remote work (allowing Western European salaries without emigration), investing in education (STEM, bootcamps), and leveraging the diaspora as a bridge to Western European markets.

Public sector modernization is a key priority in Eastern Europe, both for practical reasons (improving citizen services) and strategic ones (EU integration requires administrative digitalization).

Ukraine's Diia system is the most spectacular e-government modernization example in the region. Launched in 2020, Diia offers over 120 digital services, from ID cards to business registration. Under wartime conditions, the system proved crucial for state continuity — citizens could handle administrative matters even during evacuation.

Balkan countries are at an earlier stage. Serbia is implementing the e-Government Gateway, but adoption is low (below 30% of citizens use digital services). Bosnia and Herzegovina, with its complex administrative structure, is one of the most challenging e-government modernization cases in Europe.

Moldova, with EU and World Bank assistance, is modernizing tax and registry systems. Georgia is developing the my.gov.ge platform, but progress is hampered by limited budgets and specialist shortages.

A key challenge is interoperability — public systems in the region often don't communicate with each other, forcing citizens to enter the same data multiple times. Estonia's X-Road model is often cited as a template, but its implementation requires fundamental rebuilding of government IT infrastructure.

EU funds (IPA III for candidates, Eastern Partnership for partners) provide financing, but absorption is limited by weak administrative capacity and corruption in some countries.

Based on the analysis of the Eastern European modernization market, we formulate five key recommendations.

First, prioritize cybersecurity. In a region where threats are real and active, cybersecurity cannot be treated as a cost — it's an investment in survival. Simplified Zero Trust models for SMEs, partnerships with Western European cybersecurity firms, and training programs should be priorities.

Second, focus on e-government. Public sector modernization is not just an efficiency issue but a condition for EU integration. Ukraine's Diia model and Estonia's X-Road should serve as inspiration, adapted to local conditions.

Third, develop EU fund absorption capabilities. Countries aspiring to EU membership have access to pre-accession programs (IPA III), Eastern Partnership, and other instruments. Building administrative capacity to absorb these funds is crucial.

Fourth, leverage the IT diaspora. Instead of treating brain drain solely as a problem, organizations should build networks with the IT diaspora, creating channels for knowledge transfer, mentoring, and investment. "Return talent" programs and tax incentives can attract some emigrants back.

Fifth, build geopolitical resilience. Organizations in the region must factor geopolitical risk into modernization plans: distributed infrastructure, redundancy, business continuity plans, and partnerships with international organizations. Legacy modernization in Eastern Europe is not just a technology issue — it's an element of building state and societal resilience.