What Are Hybrid Threats? Cyber, Disinformation, Sabotage and Coercion Explained

Hybrid threats are difficult to understand because they do not fit neatly into one security category.

A cyberattack may initially look like a technical incident. Damage to critical infrastructure may resemble an accident. An information operation may appear unrelated to economic pressure. Political interference may be concealed. Military activity may be presented as signalling.

The strategic picture changes when apparently separate activities reinforce a common objective.

The Council of the European Union describes hybrid threats as coordinated harmful activities planned and carried out with malign intent, using a variety and often a combination of means.

NATO describes hybrid threats as combining military and non-military, covert and overt means, including disinformation, cyber attacks, economic pressure, irregular armed groups and regular forces.

“The key analytical question is not simply “What kind of incident occurred?” It is “Are apparently different activities connected by actor, intent, coordination or strategic effect?””

Key question

Hybrid threats at a glance

The shortest accurate explanation: hybrid threats use coordinated political, informational, cyber, economic, covert and potentially military instruments to create strategic effects while exploiting vulnerabilities and ambiguity.

What makes a threat “hybrid”?

There is no single universally binding definition covering every institution, actor and security environment. What follows is a useful analytical model rather than an official NATO definition.

Coordination

Activities may support a common strategic objective even when they are carried out by different actors, in different domains and at different times. An isolated cyberattack, sabotage incident, infrastructure failure or disinformation operation does not automatically establish the existence of a wider hybrid campaign.

Potential linking evidence can involve:

• actors
• infrastructure
• financing
• timing
• narratives
• technical indicators
• targeting
• strategic objectives

“Correlation is not proof of coordination.”

Key point

Combination

Hybrid campaigns may employ different instruments simultaneously or sequentially:

• cyber operations
• information manipulation
• sabotage
• economic pressure
• political interference
• proxy activity
• military coercion

The EU describes a variety and often a combination of means. That wording matters: multiple instruments are common, but they are not a mandatory feature of every case.

Exploitation of vulnerabilities

Hybrid activity tends to work with weaknesses that already exist rather than creating them from nothing. Potential weaknesses involve:

• institutions
• cyber systems
• infrastructure
• supply chains
• dependencies
• democratic processes
• information environments
• crisis management
• societal cohesion

Ambiguity

Ambiguity is often the point. Decision-makers are left holding questions such as:

• Who is responsible?
• Was the event intentional?
• Are the incidents connected?
• How confident is attribution?
• Has a threshold been crossed?
• What response is proportionate?

Are hybrid threats new?

No. Propaganda, espionage, sabotage, deception, economic pressure, coercion and the use of proxies are long-established instruments of statecraft and conflict.

What NATO emphasises in its current formulation is that hybrid threats have increased in speed, scale and intensity, driven by technological change and global interconnectedness. That is a statement about the environment, not a claim that hybrid warfare is a wholly new phenomenon.

Hybrid threats vs hybrid warfare

The two terms are related and frequently used loosely. Neither NATO nor the EU applies one universally binding taxonomy, so the comparison below is analytical.

Hybrid CoE treats hybrid threats as a broad spectrum ranging from influence and interference through to hybrid warfare. “Hybrid warfare” is generally used in a more conflict-oriented context, but there is no universally fixed boundary between the terms.

Applying “hybrid warfare” to every cyberattack, information operation or economic disagreement reduces the analytical usefulness of the term. If everything is warfare, the word stops distinguishing anything.

Hybrid threats vs grey-zone activity

“Grey zone” is an analytical term rather than a universally codified NATO category.

Hybrid generally refers to methods or combinations of instruments. Grey zone generally refers to an ambiguous competitive environment below overt armed conflict. The concepts overlap, but they are not exact synonyms.

Commentary published in NATO Review has examined grey-zone terminology and the risk of treating “hybrid warfare” as a catch-all label. NATO Review is analysis and commentary; it is not formal NATO policy.

Why are hybrid campaigns difficult to detect?

Detection is hard less because the individual activities are invisible and more because responsibility for seeing them is fragmented across organisations that each hold one fragment:

• cybersecurity team: a network incident
• police: suspected sabotage
• intelligence: foreign influence
• election authority: information manipulation
• infrastructure operator: unexplained disruption
• defence: coercive military behaviour

Assessment therefore moves through stages rather than arriving in one step:

• INDIVIDUAL INCIDENTS
• ↓ POSSIBLE RELATIONSHIPS
• ↓ CORROBORATED INDICATORS
• ↓ ASSESSED CAMPAIGN

Similarity is not enough. Timing is not enough. Political usefulness to an adversary is not enough. Evidence matters.

Cyber operations

NATO and the EU both explicitly identify malicious cyber activity as a potential hybrid instrument. Possible objectives include:

• espionage
• disruption
• theft or compromise of information
• compromise of systems
• interference with communications
• support to broader strategic pressure

A cyberattack is not automatically evidence of a broader hybrid campaign. Relevant assessment factors include the actor, intent, target, timing, infrastructure, attribution, relationship with other events and strategic context.

Disinformation, information manipulation and FIMI

Disinformation and Foreign Information Manipulation and Interference, or FIMI, are related but not synonymous. Disinformation describes false or misleading content spread deliberately. FIMI is narrower and more structural.

The European External Action Service uses FIMI as a framework for intentional and coordinated foreign manipulation of, and interference in, the information environment. Its 4th Annual Report on FIMI Threats, published on 12 March 2026, and accompanying EEAS material place increased attention on the networks, infrastructure and enabling architecture behind FIMI operations.

Potential effects can include confusing audiences, undermining trust, polarisation, obscuring responsibility, influencing perceptions and weakening confidence in institutions.

False or misleading content alone does not prove a coordinated state-backed hybrid campaign. The behaviour, coordination and infrastructure behind the content carry the analytical weight.

Sabotage and critical infrastructure

In its conclusions of 16 March 2026, the Council of the European Union specifically highlighted sabotage, including against critical infrastructure, malicious cyber activity, FIMI, election interference and the instrumentalisation of migration.

Critical sectors can include:

• energy
• communications
• transportation
• logistics
• food and water
• medicine
• government services
• information flows
• critical supply chains
• space-based services supporting essential functions

Not every disruption is sabotage. Infrastructure fails for mundane reasons, and early reporting is often wrong. The wider principle still holds: hybrid activity may seek not only direct physical damage but wider political, economic, military or psychological effect.

Economic coercion

NATO refers to economic pressure among hybrid means, while the EU uses the term economic coercion. Possible vulnerabilities include strategic dependencies, raw materials, supply chains, energy, market access, financing and critical technologies.

Not every tariff, sanction, trade dispute or commercial disagreement is a hybrid threat. Intent and strategic context matter, and economic statecraft is a normal part of international relations.

Political and election interference

NATO lists political interference among hybrid means, and the Council's March 2026 conclusions record specific concern about election interference.

Possible mechanisms can include covert influence, information manipulation, cyber compromise, intermediaries and concealed support networks.

Legitimate political activity, public diplomacy and ordinary foreign policy engagement are not automatically hybrid activity. Concealment, coordination and malign intent are what distinguish interference from influence.

Proxies and irregular actors

Hybrid activity is often carried out through proxy or intermediary organisations rather than directly. Relationships may involve varying degrees of direction, financing, infrastructure, intelligence, technical support, logistical support and political protection.

The operational actor and ultimate sponsor may not be identical, and not all proxy relationships involve direct command and control. Some are opportunistic, tolerated or encouraged rather than tasked.

Military pressure and coercive signalling

Hybrid activity is not synonymous with non-military activity. NATO includes both regular and irregular forces among possible hybrid means.

Potential coercive military behaviour can include coercive deployments, force movements, demonstrations of capability, coercive posture and threatening or coercive rhetoric. Military exercises may form part of coercive signalling depending on their context and purpose, but an exercise is not inherently hybrid activity.

“Hybrid does not mean non-kinetic.”

Key point

How different tools can form one hybrid campaign

The following sequence is a hypothetical illustration. It does not describe a specific state, campaign or real incident.

• unusual cyber activity against energy infrastructure
• ↓ service disruption
• ↓ coordinated false narratives online
• ↓ amplification through proxy networks
• ↓ economic pressure
• ↓ coercive military signalling

None of these facts individually proves a coordinated hybrid campaign. Investigators would need evidence connecting infrastructure, financing, actors, timing, narratives, targeting and objectives.

“A hybrid campaign cannot be identified simply by counting forms of pressure. The relationships between the activities matter.”

Key point

Why attribution is difficult

Attribution is rarely binary. Assessments carry confidence levels, and those levels can change as evidence accumulates or is reinterpreted.

Potential attribution obstacles include:

• proxies
• intermediaries
• compromised infrastructure
• false identities
• anonymous accounts
• covert financing
• misleading indicators
• information laundering
• mixed state and non-state involvement

Attribution matters because it shapes what can follow: policing, sanctions, diplomacy, public communication, military planning, alliance consultations and deterrence. EU policy treats attribution as a sovereign political decision, informed by all-source intelligence and considered case by case.

“Observing an incident is not the same as attributing the campaign behind it.”

Key point

How hybrid threats exploit the threshold of armed conflict

The EU's framing is precise: many hybrid campaigns seek to remain below a threshold that could constitute or be perceived as an act of war, because staying below it complicates the response.

That is a tendency, not a rule. Hybrid methods can also be used before conventional conflict, during conventional conflict, alongside overt military operations and after major hostilities decline.

Hybrid threats and critical infrastructure resilience

NATO's guidance for enhancing public-private cooperation for resilience, published on 16 July 2026, underlines that much critical infrastructure is privately owned and deeply interconnected, including supply chains, space-based dependencies and essential services.

Resilience is usually described as the ability to:

• WITHSTAND
• ADAPT
• CONTINUE
• RECOVER

Potential resilience measures include redundancy, continuity planning, backup communications, alternate suppliers, cyber defence, exercising, resilient supply chains, rapid repair, cross-sector coordination and secure information sharing.

Resilience does not guarantee prevention. What it can do is reduce the strategic benefit an adversary gains from disruption.

What role does artificial intelligence play?

AI is an amplifier, not a defining characteristic of hybrid threats.

NATO's approach to counter information threats, agreed in 2024, notes that artificial intelligence and deepfakes can amplify hostile information activity. On the defensive side, the same policy points to monitoring, analysis and assessment of information threats.

Claims beyond that should be treated carefully. Automated systems do not autonomously establish attribution or determine hostile intent. More automation does not automatically produce more certainty.

How NATO responds to hybrid threats

NATO organises its counter-hybrid work around three high-level lines:

• PREPARE
• DETER
• DEFEND

Publicly documented milestones include:

• 2015: NATO strategy for its role in countering hybrid warfare
• 2018: Counter Hybrid Support Teams agreed
• 2022: additional preventive and response options endorsed
• 2025: Special Coordinator for Hybrid Threats role created

Supporting activity includes intelligence sharing, hybrid analysis within the Joint Intelligence and Security Division, resilience work, political consultation, military preparedness and support to individual Allies on request. There is no single counter-hybrid instrument; the response is distributed by design.

Could a hybrid attack trigger NATO Article 5?

A hybrid attack does not automatically trigger NATO Article 5.

NATO states that significant malicious cyber activities and other hybrid attacks could, in certain circumstances, be considered an armed attack. That assessment is made case by case by Allies, on the basis of the nature and effects of the activity.

Sufficiently serious hybrid activity could, depending on its nature and effects, lead Allies to determine that an armed attack has occurred. The judgement is political and collective, not mechanical. Further detail is set out in NATO's page on collective defence and Article 5.

How the European Union responds to hybrid threats

The Council of the European Union adopted conclusions on advancing the EU's capacity to counter hybrid threats on 16 March 2026. The instruments referenced across EU policy include the EU Hybrid Toolbox, the Cyber Diplomacy Toolbox, legislation, restrictive measures, resilience and critical-infrastructure work, FIMI capabilities, international cooperation and cooperation with the private sector, academia and civil society.

The Hybrid Toolbox groups measures that are:

• preventive
• cooperative
• stability-building
• restrictive
• support

The underlying principle is straightforward: a cross-domain threat requires a cross-domain response.

NATO and EU responses: what is the difference?

NATO tools can include collective defence, military planning, deterrence, intelligence cooperation, resilience and political consultation.

EU tools can include legislation, regulation, sanctions, economic policy, cyber diplomacy, FIMI frameworks, infrastructure policy and financial instruments.

The two sets of instruments can be complementary, but the mandates are not identical and neither substitutes for the other.

How organisations can build resilience against hybrid threats

Understand critical dependencies

Map what the organisation genuinely depends on: suppliers, connectivity, energy, data, key personnel and the systems that carry authority. Dependencies that nobody has written down are the ones that fail first.

Preserve provenance

Record where information came from, when, through which route and with what handling caveats. Provenance is what allows an assessment to be revisited honestly when the picture changes.

Exercise cross-domain incidents

Exercise scenarios that cross the internal boundaries: a cyber incident with a physical consequence, an information operation during a supply disruption. Single-domain exercises rehearse single-domain responses.

Build redundancy

Alternate suppliers, backup communications and continuity plans reduce the effect of disruption even when its cause remains unclear.

Share information appropriately

Timely, lawful sharing with authorities, sector partners and relevant agencies is often what turns isolated incidents into a recognisable pattern.

Prepare to decide under uncertainty

Decisions rarely wait for certainty. Separating the following four categories, explicitly and in writing, keeps judgement honest:

• KNOWN FACTS
• ASSESSMENTS
• ASSUMPTIONS
• REMAINING UNCERTAINTY

Where SynapseCommand fits

SynapseCommand is not a hybrid-threat attribution system. It does not determine state responsibility, identify hostile governments, autonomously detect hybrid warfare, replace intelligence analysis or law enforcement, or perform national-security attribution, and it is not a NATO system.

SynapseCommand's relevance is at the decision-intelligence layer: working with authorised multi-source operational information, preserving provenance, reconstructing decision context and supporting structured course-of-action development and comparison.

That positioning is relevant to hybrid threats for one narrow reason. Where information arrives from many authorised sources and the situation is contested, the quality of a decision depends on knowing what is recorded, where it came from and how the picture changed over time. Related material is available on SynapseCommand interoperability and in the explainer on the Common Operational Picture.

Hybrid threats: the bottom line

Hybrid threats are not defined by one weapon, one domain or one type of actor. Their significance lies in the use of different instruments to exploit vulnerabilities and achieve strategic effects while often complicating detection, attribution and response. These instruments can include cyber operations, information manipulation, sabotage, economic coercion, political interference, proxy activity and military pressure.

Hybrid methods are not new. What has changed is partly the environment in which they operate. Digitally connected societies, interconnected infrastructure and global information systems can increase the speed, reach and scale of malicious activity.

The most useful analytical question is not simply “Was there a cyberattack?” It is “What happened, what is known, what remains uncertain, who may be responsible, are apparently separate activities connected, what strategic effect is being sought, and what response is justified?”

Understanding hybrid threats requires connecting evidence without jumping to conclusions. Countering them requires both the capacity to recognise coordinated hostile activity and the resilience to continue functioning when prevention fails.