How to Counter Hybrid Warfare: Defence Strategies

If hybrid warfare means combining military and non-military means — disinformation, economic pressure, cyberattacks, instrumentalised migration, unmarked forces — to wear down an adversary without crossing the threshold of open war, the inevitable question is: how does a state defend itself against something that does not look like war? This guide reviews the main lines of response developed by the most exposed countries, with documented examples. For the basic concepts, start with what hybrid warfare is: origins, doctrine and Crimea 2014.

The core problem: attribution and threshold

The greatest defensive difficulty is not technical but political. Hybrid actions are designed to be deniable and to stay below the threshold that would justify a military response or forceful sanctions. An unsigned cyberattack, a disinformation campaign amplified by fake accounts or a migrant surge pushed by a neighbouring regime rarely allow a government to prove to its public — or its allies — who is behind it and with what intent.

That is why the first line of defence is investigative and attribution capacity: technically capable intelligence services, cybersecurity forensics teams and mechanisms to share evidence with allies. Without credible attribution there is no possible response, only suspicion.

Resilience: society as the first line

The Nordic and Baltic countries, the most exposed to Russian pressure, have made societal resilience official doctrine. The concept is simple: if the adversary's goal is to sow division, distrust and fear, the best defence is an informed, cohesive society prepared to function in a crisis.

• Media literacy: Finland integrates digital literacy and critical thinking into the school curriculum from primary level, and regularly tops the European index of resilience to disinformation.
• Total defence: Sweden and Finland maintain 'total defence' plans assigning companies, municipalities and citizens a role in national resistance; the Swedish booklet 'If Crisis or War Comes' was distributed to every household in 2018 and updated in 2024.
• Institutional trust: comparative studies show disinformation takes hold less where trust in public media and institutions is high.

Protecting critical infrastructure

Submarine cables, pipelines, power grids and transport systems are ideal hybrid targets: their sabotage or disruption generates enormous pressure with a footprint that is hard to trace. The response involves three measures: inventory and surveillance of critical points, redundancy (alternative energy and data routes) and international cooperation, such as NATO's cell for undersea critical infrastructure created after the 2022 Nord Stream sabotage and the cable cuts in the Baltic.

Countering disinformation without censoring

Accumulated experience shows that outright bans work poorly and carry democratic costs. The strategies that have delivered better results combine several tools: independent fact-checking, labelling and reduced algorithmic spread of manipulated content, transparency about the funding of media and campaigns, and public exposure of detected influence operations. The EU's EUvsDisinfo service and the NATO-EU Hybrid Centre of Excellence in Helsinki document and publish cases precisely so that exposure becomes a cost for the aggressor.

Cyber defence and isolating what matters

In the cyber domain, defence combines technical measures — network segmentation, backups, physical isolation of the most sensitive systems — with cooperation: NATO response teams can deploy to an ally under attack, and the EU has its own cyber-diplomacy framework for attribution and sanctions. On the physical isolation of critical networks and its real limits, see our article on the air gap.

Deterrence: making the cost exceed the benefit

Hybrid deterrence does not work like nuclear deterrence: there is no massive, automatic punishment. It works by accumulating costs: coordinated sanctions, expulsions of diplomatic staff, prosecution of agents, publication of evidence and visible military reinforcement in exposed countries. The Baltic states' experience suggests speed matters more than magnitude: responding early and in public, even with modest measures, breaks the aggressor's calculation of impunity.

Sources and references