NATO Pushes Allies Towards a More Unified Response to Hybrid Attacks

NATO’s top military commander has called on allied governments to share intelligence more systematically, identify those responsible for hybrid attacks and respond collectively, as European countries face a growing number of sabotage incidents, cyberattacks and other operations targeting critical infrastructure.

Speaking to members of the European Parliament on 28 September, NATO Supreme Allied Commander Europe General Alexus Grynkewich said that allies needed to develop a common picture of hybrid incidents before deciding how to respond. He outlined a three-step approach: intelligence sharing, attribution and a coordinated response, with continued support for Ukraine forming part of the broader strategy.

The emphasis on intelligence sharing reflects a practical problem facing European governments. Hybrid operations often involve incidents that appear isolated when viewed nationally but can reveal a wider pattern when information is combined across countries. NATO has increasingly treated sabotage, cyberattacks, interference with infrastructure and drone incidents as interconnected security challenges rather than purely domestic law-enforcement issues.

From isolated incidents to a common security picture

Grynkewich argued that the first requirement is for allies to exchange information quickly enough to establish what he described as a common operating picture. That can help governments determine whether apparently unrelated incidents are connected, identify recurring methods and assess whether a hostile state is directing them.

This approach is becoming more important as European infrastructure becomes increasingly exposed to security risks. NATO itself notes that military operations depend heavily on civilian transport, communications, energy and other infrastructure, much of which is privately owned. The Alliance estimates that around 90% of military transport for large operations is provided by civilian assets, while more than 70% of defence-related satellite communications rely on commercial providers.

The vulnerability therefore extends beyond military installations. Railways, ports, airports, telecommunications networks, energy systems, satellites and undersea cables can all become part of the security environment in which NATO countries have to operate.

Attribution is becoming part of deterrence

The second element of Grynkewich’s approach is attribution. Rather than treating sabotage or cyber incidents simply as criminal investigations, NATO increasingly sees identifying the actor behind an operation as part of deterrence.

The logic is that public attribution can expose the networks involved and make it more difficult for an adversary to operate anonymously. Grynkewich said he favoured attribution in almost every case, arguing that it can increase the costs for those conducting hybrid operations.

That represents a shift in how European governments are approaching activities below the threshold of conventional military conflict. Attribution does not automatically trigger a military response, but it can establish a common political position and provide the basis for diplomatic, economic, legal or security measures.

Recent events have reinforced the issue. European authorities have investigated suspected sabotage and other incidents affecting infrastructure and facilities connected with support for Ukraine, while NATO has also responded to drone incidents and other forms of pressure along its eastern flank.

A wider Russian hybrid campaign

The renewed NATO focus comes amid warnings from European intelligence services that Russia could intensify hybrid activity against Western countries. Denmark’s defence intelligence service recently assessed that the risk of Russian hybrid operations could increase and warned of a growing, although still limited, risk of a more direct military confrontation involving NATO countries.

NATO Secretary General Mark Rutte has separately said the Alliance has response options for sabotage, cyberattacks and drone incidents, although he stressed that some measures would not be made public. NATO has also expanded measures such as Baltic Sentry, which is designed to improve protection of critical infrastructure in the Baltic Sea.

The Alliance's broader policy already recognises hybrid activity as a security challenge that can target political institutions, public opinion and civilian infrastructure. NATO says the speed, scale and intensity of such operations have increased as technological development and global connectivity have created new vulnerabilities.

Ukraine remains part of the response

Grynkewich also linked the response to hybrid attacks with continued military support for Ukraine. NATO officials have increasingly presented assistance to Kyiv not only as support for Ukraine's defence but also as part of efforts to prevent Russia from achieving its broader strategic objectives in Europe.

That argument places hybrid security within the wider European security architecture. If sabotage, cyber operations and infrastructure incidents are intended to weaken public support for Ukraine or create divisions among NATO members, a coordinated political response becomes as important as the technical ability to investigate individual attacks.