A Russian drone striking the headquarters of Ukraine’s Security Service on September 4 turned an organisation built around secrecy into one of the most visible targets in Kyiv. President Volodymyr Zelensky said the weapon had been aimed directly at the office of acting SBU chief Oleksandr Poklad, who was not injured.
The choice of target carried an obvious logic. Since Russia’s full-scale invasion, the SBU has moved far beyond the conventional image of a domestic security agency, becoming a central participant in counterintelligence, cyber defence, battlefield operations and attacks against Russian military infrastructure deep behind the front.
It has claimed responsibility for some of Ukraine’s most audacious operations, including attacks on the bridge linking Russia to occupied Crimea and Operation Spiderweb, the 2025 drone assault on strategic bombers at air bases hundreds and, in some cases, thousands of kilometres from Ukrainian-controlled territory.
Yet Ukraine’s SBU security service is not simply an intelligence agency that learned to fly drones. Its importance comes from an unusually broad accumulation of functions: counterintelligence, criminal investigation, counterterrorism, cyber security, military counterintelligence and increasingly large armed formations capable of fighting directly.
According to Daycom’s analysis of verified public records and reporting, this concentration explains both the SBU’s wartime effectiveness and the institutional dilemma surrounding it. The invasion rewarded speed, secrecy and operational reach — precisely the qualities that make democratic oversight more difficult once an emergency becomes prolonged.
The organisation emerged from the Ukrainian branch of the Soviet KGB when independence dismantled the USSR’s security architecture in 1991. Ukraine inherited not merely buildings but personnel, files, working habits and a highly centralised security culture that successive governments then tried to reshape for an independent state.
That origin matters because the SBU was never designed along the narrower institutional lines common to many Western democracies. Its remit developed as a combination of intelligence and law enforcement, giving it authorities that elsewhere might be divided between an FBI-like agency, a domestic intelligence service and specialised police bodies.
In peacetime, that breadth generated persistent criticism. Reform advocates argued that the service should focus more tightly on counterintelligence and national security while surrendering functions that overlapped with police, economic-crime investigators and other law-enforcement institutions.
War changed the incentives almost overnight. Russia’s invasion created a requirement for exactly the kind of sprawling institution reformers had questioned: one capable of hunting agents, protecting military secrets, investigating collaborators, running cyber operations and deploying armed personnel without waiting for several agencies to coordinate.
The problem was especially acute because Russian penetration was not theoretical. Ukraine’s security establishment had spent decades interacting with its Russian counterparts after emerging from the same Soviet system, leaving personal and professional networks that became liabilities once Moscow turned openly hostile.
The invasion consequently forced the SBU to fight two wars at once: one against Russian intelligence operations inside Ukraine and another against the vulnerabilities within Ukraine’s own security apparatus. Arrests of suspected agents and collaborators became one of its most visible domestic activities.
At the same time, a very different public image was being constructed. The SBU increasingly presented itself not as a bureaucratic successor to the KGB but as a technologically aggressive wartime organisation able to use drones, sabotage and intelligence fusion to reach targets Russia once considered safely beyond Ukraine’s range.
Operation Spiderweb became the clearest expression of that transformation. In June 2025, drones launched from concealed positions inside Russia struck several air bases holding strategic aircraft. Satellite imagery subsequently showed Russian bombers destroyed or damaged, although Ukrainian claims about the total scale exceeded what independent imagery could immediately establish.
The military significance lay not only in the aircraft lost. Russia’s strategic bombers are expensive, difficult to replace and routinely used to launch cruise missiles at Ukraine. The operation also forced Moscow to reconsider a basic assumption: that distance from the Ukrainian border could substitute for intensive local air defence.
The SBU had already used a similar logic against the Crimean Bridge. It later acknowledged responsibility for the October 2022 truck-bomb attack, and in June 2025 announced another operation using underwater explosives against bridge supports. Russia disputed the scale of the latter attack, although it temporarily halted traffic.
These operations helped turn asymmetry into an institutional doctrine. Ukraine cannot reproduce Russia’s much larger conventional arsenal, but a security service able to combine intelligence, small teams and inexpensive autonomous systems can sometimes impose losses far greater than the cost of the weapon used.
The SBU’s Alfa Special Operations Centre sits near the core of that change. Once best known as an elite counterterrorism formation, Alfa now operates as a substantial combat organisation whose personnel use drones and other weapons both along the front and against targets behind Russian lines.
Ukrainian legislation enacted in July 2025 formally reflected that expansion. The law sets the SBU’s ordinary authorised strength at 37,000, including 10,000 personnel in the Alfa special-operations component — an extraordinary figure for what is nominally still a domestic security service.
The commonly repeated figure of a 41,000-person “wartime cap” needs qualification. The statute sets 41,000 for a special period outside martial law. During martial law itself, overall staffing is determined by Ukraine’s mobilisation plan, while Alfa must contain at least 10,000 personnel.
The exact wartime headcount is therefore not public. But the statutory structure alone illustrates the scale of institutional change: the SBU now contains a combat element large enough to resemble a major military formation while retaining the investigative, intelligence and secret powers of a national security agency.
Leadership has changed with that evolution. Vasyl Maliuk, who became closely associated with the SBU’s expansion into asymmetric operations, was replaced in January 2026. Alfa commander Yevhenii Khmara initially took over on an acting basis as Zelensky pressed for even more aggressive operations against Russia.
The leadership shifted again on July 17. Zelensky relieved Khmara of the acting role and placed First Deputy Head Oleksandr Poklad in temporary charge of the service. The presidential decree remains the clearest formal confirmation of Poklad’s current status.
Poklad had been promoted to first deputy head in January. His office was the one Zelensky said Russia targeted on September 4, giving the strike an unusually personal dimension: the weapon was not merely aimed at an institutional headquarters but, according to the Ukrainian president, at its current commander.
The SBU’s acknowledged operations are only one part of its wartime reputation. Reuters describes it as widely regarded as a major participant in a campaign of covert killings of Russian military figures and others whom Ukraine accuses of involvement in war crimes. Moscow calls such killings terrorism.
That assessment requires careful boundaries. The SBU has openly claimed responsibility for Spiderweb and certain attacks on the Crimean Bridge. That does not mean every assassination, explosion or sabotage incident inside Russia attributed vaguely to “Ukraine” can be assigned to the service with confidence.
Covert action deliberately produces uncertainty. Ukrainian authorities sometimes remain silent; Russian investigators may blame Kyiv before disclosing evidence; intelligence reporting may rely on unnamed officials. An institutional profile therefore has to separate admitted operations from plausible attribution and plausible attribution from established fact.
The same expansion that produced operational success has also intensified competition inside Ukraine’s security establishment. The most important overlap is with the Defence Ministry’s Main Intelligence Directorate, or HUR, which possesses its own special forces, covert networks and long-range operational capabilities.
The relationship has long mixed cooperation with rivalry. Both organisations seek intelligence sources, specialist personnel, technological resources and presidential approval for sensitive operations. When their missions converge inside the same battlespace, unclear boundaries can become more than an organisational inconvenience.
That became dramatically visible in Kyiv in early September. A dispute involving SBU and HUR personnel escalated into gunfire, leaving three military-intelligence officers injured. Zelensky ordered an investigation into how a confrontation between two of the country’s most important security institutions reached that point.
The dispute centred on the disappearance of a Russian nationalist fighting on Ukraine’s side. Accounts of the episode differed, while the SBU said its actions were connected to an operation against an alleged Russian plan targeting anti-Kremlin activists. The investigation had not produced a definitive public account.
The significance extends well beyond an internal scandal. Competition between intelligence organisations can sometimes improve performance by encouraging initiative. But armed confrontation between them points toward the opposite risk: secrecy and overlapping authorities becoming obstacles to state coordination rather than advantages against Russia.
That is precisely where Ukraine’s European reform agenda intersects with the war. The European Commission’s 2025 assessment said cooperation and coordination among Ukrainian law-enforcement institutions remained weak and warned that new SBU security-check powers over law-enforcement personnel lacked sufficient safeguards against potential abuse.
The criticism is not an argument for weakening counterintelligence while Russia is actively recruiting agents and attacking Ukrainian institutions. It addresses a different problem: how to give a secret service extraordinary capacity without allowing extraordinary wartime authorities to become an indefinite substitute for ordinary institutional rules.
That question will become more difficult, not easier, after the fighting eventually subsides. The SBU Ukraine had before 2022 and the service that will emerge from this war are no longer the same organisation. Thousands of personnel have acquired battlefield experience and capabilities that cannot simply be erased by returning to an old reform blueprint.
Alfa is the most obvious example. A force legally structured around at least 10,000 personnel during martial law cannot easily revert to a narrowly defined hostage-rescue or counterterrorism unit. Ukraine will have to decide which of its wartime combat functions remain necessary against a long-term Russian threat.
The same applies to operational reach. Spiderweb demonstrated the strategic value of clandestine preparation and cheap drones. A future Ukrainian government would be reluctant to surrender that capability merely because a ceasefire or peace settlement had formally ended a phase of hostilities.
Yet preserving every wartime authority would create its own danger. A democratic state ordinarily places different checks on an intelligence officer, a criminal investigator and a combatant. When a single organisation performs all three functions, oversight must become stronger precisely because operational efficiency is so attractive.
This tension is central to understanding the SBU rather than incidental to it. Its success in war does not automatically settle whether its peacetime design is healthy. A brilliant special operation and an unresolved institutional-governance problem can exist inside the same organisation at the same time.
Nor does the September clash with HUR erase the achievements of either service. It illustrates the costs of a security system that has expanded at extraordinary speed under existential pressure. The state has had to build capabilities faster than it has been able to settle every boundary between the institutions using them.
Russia’s September 4 strike crystallised another consequence of that transformation. Moscow was no longer merely attacking a government office inherited from the post-Soviet state. It was hitting an institution associated with some of the most damaging and humiliating operations conducted against Russian forces during the war.
The strike did not amount to the destruction of the SBU. The service has regional offices, specialised units and distributed operational structures, and there was no public evidence that hitting its Kyiv headquarters paralysed its work. Its website continued to identify Poklad as acting head.
Its importance is therefore better understood as a network than as the building on Volodymyrska Street. Investigators, cyber specialists, counterintelligence officers, analysts and combat personnel work across Ukraine, while some operations by definition depend on assets and networks beyond Ukrainian-controlled territory.
The headquarters strike nevertheless supplied Moscow with a symbolic reversal. The SBU has spent years demonstrating that Russian strategic depth can be penetrated. Russia, in turn, showed that the agency orchestrating part of that deep war could itself be reached in the historic centre of Kyiv.
This reciprocity reflects the changing nature of intelligence conflict. Secret services once evoked recruited agents, surveillance teams and intercepted communications. In Ukraine’s war, they can also command drone formations, strike infrastructure, operate maritime systems and participate directly in lethal combat.
For Kyiv, that transformation has been a response to necessity. Fighting a much larger adversary rewards institutions able to fuse intelligence with technology and produce disproportionate effects from limited resources. The SBU has become one of the clearest embodiments of that strategy.
Its eventual test, however, will not be whether it can design another Spiderweb. It will be whether Ukraine can preserve the capabilities that helped it survive while building sufficiently strong civilian, legal and parliamentary controls around an institution whose wartime power has grown dramatically.
That is why the question “What is Ukraine’s SBU?” no longer has a simple answer. It is at once a successor to a Soviet security apparatus, the country’s principal counterintelligence service, a law-enforcement body, a cyber-security institution and an increasingly formidable combat and covert-action organisation.
The war has made that hybrid exceptionally useful. Peace, whenever it comes, will make the same hybrid exceptionally difficult to govern. Ukraine needed the SBU to become stronger in order to survive Russia’s invasion. Its longer-term institutional challenge will be proving that the democratic state remains stronger than the secret service it created to defend it.
