Introduction: Defining Hybrid Threats in the European Context
The concepts of hybrid warfare and hybrid threats have been increasingly shaping security discourses. As part of a conceptual broadening of security beyond the military, they conceptualise various tactics ranging from cyberattacks and disinformation campaigns to exploiting economic dependencies or even terrorism. These threats are deliberately designed to operate below the threshold of traditional military conflict, challenging traditional military and political thinking on how to detect, attribute, and counter these threats. Just as hybrid warfare operates with ambiguity, no precise and uniform definition of the concept has been established in academic and political discourse, complicating policy formulation and implementation. The European Union (EU), in particular, has been at the forefront of addressing hybrid threats due to the significant security challenges it faces from state and non-state actors. This analysis explores the EU’s responses to hybrid threats, focusing on its policies, frameworks, and newly founded institutions to primarily address Russia’s actions against Europe since the attack on Ukraine in 2014.
EU Policy on Countering Hybrid Threats
The European Union’s policy approach to countering hybrid threats has evolved significantly since 2016. This development was mainly driven by the changing security environment and rising challenges in its eastern and southern neighbourhoods due to Russia’s imperialistic aggressions. Central to the EU’s approach is the Joint Framework on Countering Hybrid Threats (2016) as a comprehensive framework for addressing hybrid challenges. Hybrid threats are defined as a blend of coercive and subversive activities utilising both conventional and unconventional methods. The EU’s strategy focuses on fostering synergy among various existing policies, including the European Agenda on Security (2015), the EU Global Strategy for Foreign and Security Policy (2016), the European Defence Action Plan (2016), the Cybersecurity Strategy for the Digital Decade (2020) the Maritime Security Strategy (2014), and the Energy Security Strategy (2014). Specific actions include conducting hybrid risk assessments, establishing a Hybrid Fusion Cell within the EU Intelligence and Situation Centre (EU INTCEN) of the European External Action Service (EEAS) for information sharing, and coordinating strategic communication of the member states and the EU itself. Critical infrastructure protection in the energy, transport, and financial sectors is also particularly emphasised. The approach also stresses the importance of public-private partnerships and industry cooperation to bolster resilience against hybrid attacks. Cooperation with NATO, especially in areas like strategic communication, cyber defence, and crisis response, is a key feature of the policy. This integrated framework aims to build resilience across sectors, improve early detection and response, and enhance the overall coordination among EU member states and international partners. 
The Joint Framework on Countering Hybrid Threats also led to various initiatives to detect, analyse, and counter hybrid threats, including creating the Hybrid CoE. This hub, headquartered in Helsinki and operational since 2017, serves as a centre for expertise, training, and collaboration. It brings together EU member states, NATO allies, and other international organisations to share best practices, conduct research, and enhance resilience against hybrid tactics. The centre’s work is guided by the recognition that hybrid threats require a multidisciplinary response involving political, military, economic, and societal dimensions.
One of the Hybrid CoE’s critical contributions is its emphasis on deepening the nuanced understanding of various dimensions of hybrid warfare, operationalising the concept for assessment, and identifying the vulnerabilities that adversaries aim to exploit for proactive policy formulation. The centre’s publications highlight how adversaries often target societal fault lines, economic dependencies, and technological gaps to undermine trust in institutions and destabilise political environments. Moreover, the Hybrid CoE’s exercises[1]and scenario-based training programs have proven invaluable in preparing states to respond to hybrid attacks in real time and collaborate effectively. The Hybrid CoE also explores future trends in hybrid warfare, such as the increasing use of artificial intelligence, deepfakes, and information manipulation techniques. By anticipating these trends, the Hybrid CoE helps the EU and its member states develop proactive strategies against hybrid tactics.
A Conceptual Model for Analyzing Hybrid Threats
The paper The Landscape of Hybrid Threats: A Conceptual Model, published in 2021 by the Hybrid CoE, offers a structured and detailed framework central to the European Commission’s and the Hybrid CoE’s for understanding hybrid threats and their multidimensional and evolving nature. The model identifies 13 distinct domains – ranging from information and cyber to political and societal – that hybrid actors target in coordinated attacks. One of the key analytical insights is the interconnectedness of these domains, highlighting how vulnerabilities in one area can trigger cascading effects across others. For instance, weaknesses in information security can destabilise political environments. A crucial factor for the interconnectedness of hybrid threats is the central role of the public, which can be manipulated to promote social division as a goal in itself or to exert pressure on the government.
A significant aspect of the model is its systematic approach to vulnerability mapping also stressing the importance of identifying cross-sectoral vulnerabilities. The model advocates for integrating intelligence from various sectors to create a comprehensive risk assessment, thereby enabling better anticipation and prevention of hybrid attacks. This approach moves beyond a siloed understanding of threats and instead promotes a holistic perspective that captures the intricate interactions within the hybrid threat landscape.
The paper also introduces a sophisticated actor-centric analysis, categorising both state and non-state actors based on their motivations, operational doctrines, and strategic objectives. What makes this approach analytically rich is the recognition of how these actors adapt their tactics over time by continuously evolving their methods in response to changing geopolitical contexts. In this respect, the model doesn’t treat actors as static but as flexibly shifting their tools, strategies, and the operation’s scale depending on the vulnerabilities they identify in their targets. This adaptability enables actors to maintain strategic pressure without triggering full-scale military responses and remaining below the threshold of open conflict, which complicates decision-making processes for their targets. This produces ambiguity and strategic advantage for hybrid actors, as it creates hesitation and uncertainty in the responses of target states. Therefore, the model suggests that moving beyond traditional binary notions of war and peace is critical for effectively managing these grey-zone conflicts, although the traditional binary is deeply inscribed in European state institutions and security discourse.
Through a breakdown of the temporal dynamics, hybrid threats can be analysed in three phases: priming, destabilisation, and coercion. Each phase is associated with specific activities, such as disinformation campaigns and cyberattacks in the priming phase, which set the stage for escalatory actions later analogous to shaping the battlefield in conventional warfare. Importantly, these phases are non-linear and can overlap or regress, making hybrid threats unpredictable and challenging to counter. This temporal fluidity adds another layer of complexity, as it requires target states to maintain vigilance and readiness across all phases, even during periods of apparent de-escalation.
Overall, the paper’s conceptual model provides a robust and adaptable tool for policymakers, allowing for nuanced understanding and tailored responses to the evolving landscape of hybrid threats. The operational framework proposed for strategic responses to hybrid threats highlights the need for layered defences incorporating early detection systems and cross-sectoral communication and response mechanisms.
The EU’s Strategic Response to Russian Hybrid Warfare
The concept of hybrid warfare has been closely associated with Russia following the annexation of Crimea in 2014, the building and support of the eastern Ukrainian separatist movement, and its interference in European elections, all frequently cited as textbook examples of hybrid warfare. The EU’s response to Russian hybrid warfare is multifaceted, involving a combination of policy measures, institutional reforms, and coordinated actions at both the national and international levels. Central to this response is the development of resilience across critical sectors, including cybersecurity, energy security, and strategic communications. The EU has also prioritised enhancing situational awareness and information sharing among member states to deal with the time-sensitive nature of hybrid threats through warning and response mechanisms as already laid out.
Countering Disinformation: The East StratCom Task Force and EUvsDisinfo
One of the most visible aspects of Russia’s hybrid warfare is its use of disinformation to manipulate public opinion and destabilise political environments. The East StratCom Task Force within the European External Action Service (EEAS) was established in 2015 and operates the EUvsDisinfo platform, which has been instrumental in identifying and exposing false narratives spread by pro-Kremlin media and aligned online actors, particularly during election cycles and significant political events.
The task force’s work is complemented by broader strategic communication efforts targeting the resilience of public discourse and societies against disinformation by, for example, enhancing media literacy and promoting independent journalism. The EU’s Action Plan against Disinformation (2018) can be seen as a concrete attempt to leave its reactive stand in the battle for narrative control and recognise the existential threat of disinformation to democracy and social cohesion. It outlines different measures to strengthen the EU’s ability to deliver coherent and credible messages, counter hostile narratives, and support member states in developing their communication strategies.
Enhancing Cybersecurity and Protecting Critical Infrastructure
The EU’s cybersecurity strategy has evolved significantly in response to the growing threat of state-sponsored cyberattacks. The EU’s Cybersecurity Strategy for the Digital Decade builds on earlier initiatives, such as the EU Cybersecurity Act (2019) and the creation of the European Union Agency for Cybersecurity (ENISA). The strategy emphasises the need for coordinated action across member states to secure critical infrastructure, improve incident response capabilities, and promote cross-border cooperation. The importance of cybersecurity in the context of hybrid warfare cannot be overstated. Cyberattacks are a central component of hybrid operations, often used to disrupt critical services, steal sensitive data, and create confusion during crises. Russia’s cyber activities, such as the NotPetya attack in 2017 and ongoing operations targeting energy grids and financial systems, have highlighted the need for robust cyber defences across the EU. The EU’s approach involves not only improving technical capabilities but also fostering public-private partnerships.
Strengthening International Cooperation: EU-NATO Collaboration
Given the transnational nature of hybrid threats, the EU has recognised the need for closer collaboration with NATO and other international partners in the Joint Declaration on EU-NATO Cooperation (2016, 2018, 2023). The declaration calls for joint exercises, information sharing, and the development of coordinated responses to hybrid threats, ensuring that both organisations can leverage their respective strengths. This notion can also be found in the institutional setup of the Hybrid CoE, which is legally independent of the EU and NATO and thus serves as a bridge for joint research, cooperation, and training.
The EU-NATO partnership is particularly relevant in the context of Russian hybrid warfare, where the line between civilian and military domains is often blurred. While NATO is primarily responsible for collective defence, the EU’s role in building societal resilience, securing critical infrastructure, and countering disinformation complements NATO’s efforts.
Economic Resilience and Military Deterrence: The Duality after Russia’s full-scale Invasion
Following Russia’s 2022 invasion of Ukraine, the EU’s strategy against hybrid warfare also focused heavily on enhancing economic resilience and military deterrence. The crisis highlighted the EU’s dependence on Russian energy and called for swift diversification efforts and the launch of the REPowerEU plan to reduce reliance on Russian fossil fuels. This plan curbed Moscow’s energy leverage to guarantee the EU’s long-term economic security as a prerequisite for the survival of Europe’s energy-intensive industry and competitiveness. Alongside these measures, the EU imposed stringent sanctions targeting key Russian sectors to weaken its war-related industrial capabilities.
Militarily, the EU reinforced its deterrence posture by strengthening ties with NATO, boosting defence spending, and accelerating joint defence initiatives through the European Defence Fund. The 2022 Strategic Compass introduced rapid deployment capabilities and closer military integration among member states to counter hybrid threats, reflecting a shift toward proactive defence. This approach integrates economic and military tools to counter Russia’s hybrid tactics more effectively. By aligning energy security, economic sanctions, and enhanced military readiness, the EU tries to hinder Russia from recuperating its military capabilities, weakened and bound in Ukraine, for an attack on countries under EU and NATO protection.
Addressing the Challenges of Hybrid Threats: Gaps and Areas for Improvement
Despite the progress made by the EU in countering hybrid threats, several challenges remain to ensure a comprehensive and effective response. These challenges include disparities in capabilities among member states, the complexity of decision-making processes within the EU, impeded by political disagreement over threats or the means to counter them, and the need for continuous adaptation to the evolving nature of hybrid threats.
Differences in resources, expertise, and political priorities create vulnerabilities that adversaries can exploit. To address these disparities, the EU has launched several initiatives to build capacity and share knowledge among member states. For instance, the Permanent Structured Cooperation (PESCO) framework allows member states to collaborate on joint projects related to defence and security as well as hybrid threats. Some of the currently 66 projects coordinated under PESCO, for example, concentrate on cyber capabilitiesand protecting critical seabed infrastructure. Additionally, the Hybrid CoE offers tailored training programs and exercises that help member states make up leeway and develop a shared understanding of hybrid threats.
The Complexity of Decision-Making and Coordination
The EU’s decision-making process, which involves multiple institutions and a diverse set of stakeholders balancing the national competencies in foreign and security policy and the need for EU-wide coordination of transnational challenges, can sometimes lead to delays and a lack of coherence in policy implementation. This complexity is particularly problematic in the context of hybrid threats, where rapid response and seamless coordination are essential.
To mitigate this challenge, the EU has introduced mechanisms to streamline decision-making and improve coordination. For example, the Integrated Political Crisis Response (IPCR) mechanism enables swift and coordinated responses to crises, including hybrid threats, by bringing together relevant EU institutions and member states.
Conclusion: Necessary Improvements for Countering Hybrid Threats
The Russian aggression against Ukraine since 2014 fundamentally altered the European Union’s perception of war, shifting it from a distant possibility to an immediate and multifaceted threat. However, shortcomings like the patchy implementation of frameworks and strategies must be improved given the vast resources actors like Russia invest in operations against the EU. For example, initiatives like the East StratCom Task Force should be staffed to be up to the task of countering Russian disinformation to its full extent. For a proactive response, the EU can regain control over narratives by making joint threat assessments public and revealing the scope and intensity of hybrid threats and attacks to demask adversaries. This could be supported through intensified intelligence sharing, joint assessments and cooperation of intelligence and law enforcement agencies in investigations. For fast pollical responses, some experts suggest pre-agreeing on “fast-track” procedures or criteria for triggering collective mechanisms to strengthen deterrence and signal effective response capabilities. All things considered, an adequate EU approach to countering hybrid threats must combine big-picture situational awareness leading to resilience in society and institutions with concrete and fast action on different levels of administration, private industry, and government. Otherwise, hybrid threats may strike at Europe’s democracies in less overt ways than conventional war, yet with a severity that cannot be underestimated.
