Dissuading hybrid deterrence

Dissuading hybrid deterrence – case study of NATO Eastern Flank

By Patryk Borowski

Recent and prospective increases in defence expenditure invite scrutiny of whether these investments are aligned with the character of the threat they are meant to counter. This essay maintains that prioritising the development and procurement of traditional armaments, such as tanks, field guns and howitzers, alone, is no longer sufficient against Russia, given the fusion of hybrid methods with transformed forms of conventional warfare. Although it continues to play a vital role in symmetrical traditional conflicts of this kind (Calcagno & Marrone, 2024), this study examines the limits of traditional force-centric responses. It identifies multi-domain strategies and capabilities that can more effectively deter and respond within this integrated security landscape.

Among NATO members, some introduced measures, which seem to be in theory more effective in countering Russian actions, such as Finland and Sweden with their ‘total defence’ approach. These measures, however, are regularly tested, and in terms of the complexity of the actions taken, there appear to be blind spots.

This article adopts an empirical approach, using a case study of the defence and foreign policies of Eastern Flank NATO members. It is organised into three parts. First, it defines the threat by outlining traditional and hybrid warfare, identifying the relevant actors, and delimiting the geographic scope. Second, drawing on the theoretical framework of hybrid attacks, the case study assesses current and potential countermeasures, considering their operational and financial effectiveness. Third, it synthesises the findings to derive policy implications.

When writing about the Russian hybrid attacks against NATO, it is impossible not to mention Russia’s invasion of Ukraine and the relationship between these two processes. One is what Ukraine is currently experiencing, and that is traditional war, which has broken out as a consequence of the Russian invasion in 2022. The second is hybrid warfare, or, more generally, actions that can be grouped under the term “hybrid threats”. In this chapter, I aim to dispel doubts and clarify the meanings of the terms mentioned and their roles in the rapidly evolving European security architecture.

Traditional warfare has historically been symmetrical, meaning it assumes direct interstate clashes without the participation of non-state actors. The armies are regular and uniform and should adhere to the rules of the Geneva Conventions governing interstate conflicts. Other typical features of conventional warfare include territorial control as a central objective, the use of conventional weapons, the aim of eliminating the enemy’s forces, and adherence to Clausewitzian logic, which regards war as a political instrument (Williams, 2025). With the Russian invasion of Ukraine, it became visible that this way of waging war is still present. It is pursued in accordance with the warfare handbooks of the 19th and 20th centuries. The invasion was to be conducted through a rapid annihilation strategy and was planned to last no more than a week, let alone three years. During this period, the war transitioned from a rapid offensive to a war of attrition. This is implemented by, among others, means of child kidnappings, attacks on residential buildings and civil infrastructure in the whole country.

The Russian invasion also reflects a core element of Clausewitz’s understanding of war: it functions as an instrument for advancing state objectives. In this instance, it serves multiple goals for the Kremlin, including reinforcing Putin’s position in domestic politics and promoting a narrative of restoring the Russian empire. It also serves as a means of drawing Ukraine, and potentially other states from the post-Soviet space, back into Russia’s sphere of influence, which in turn is linked to its broader systemic confrontation with the West.

The Russian Federation has increasingly relied on measures short of a formal declaration of war in its conflict with the West. This pattern became especially visible after the full-scale attack on Ukraine. At the same time, the conflict demonstrates that methods of fighting are not fixed. Along with artillery, armour, and territorial defence, the war is complemented by the use of new technologies and other military and non-military means. This mix of traditional warfare and new or improved methods, compared with those that have long accompanied warfare, provides the immediate context for the next section, which turns to the concept of hybrid warfare and the mechanisms through which such approaches are organised and applied.

The terminology surrounding hybrid warfare is usually foggy because the phenomenon it seeks to capture is itself ambiguous. Scholars conceptualise it in divergent ways and attach different meanings.

According to Hoffman, “hybrid warfare can be waged by states or political groups, and incorporates a range of different modes of warfare, including conventional capabilities, irregular tactics and formations, terrorist acts including indiscriminate violence and coercion, and criminal disorder” (Hoffman, 2007).

Another definition presented by the authors of the paper “Understanding Hybrid Warfare” defines hybrid warfare as “the synchronised use of military and non-military means against specific vulnerabilities to create effects against its opponent. Its instruments can be ratcheted up and down simultaneously, using different tools against different targets, across the whole of society.” (Cullen & Reichborn-Kjennerud, 2017).

Source: IISS - https://www.iiss.org/research-paper/2025/08/the-scale-of-russian--sabotage-operations--against-europes-critical--infrastructure/

In a more contemporary approach, Mumford and Carlucci, drawing on MCDC definitions, distinguish hybrid warfare from hybrid threats. They assume that hybrid warfare entails the use of military and kinetic force alongside non-military and non-kinetic means within a military conflict (Mumford & Carlucci, 2022). Hybrid warfare is closely related to hybrid threats. On NATO’s webpage, they are defined as a combination of military and non-military means, both covert and overt, including disinformation, cyberattacks, economic pressure, the development of irregular armed groups, and the use of regular forces. The goal of those includes blurring the lines between war and peace and sowing doubt in the minds of targeted populations, aiming at destabilisation and undermining societies (NATO, 2025a). This definition does not address its application in the context of a military conflict. However, it implies the use of military means, such as regular forces or irregular armed groups.

Considering the different objectives of Russian operations in Ukraine and in NATO member states, as well as the distinct means used to pursue them, the distinction between deterrence capability building in traditional warfare and hybrid warfare becomes evident. From the perspective of NATO security, and particularly that of the North-Eastern Flank, capability development can be approached in two parallel segments.

First, in the current context, where the West is not engaged in a direct full-scale war with Russia and the primary concerns relate to hybrid attacks in their various forms, investment should prioritise defence, resilience, and deterrence tailored to these ongoing challenges. Second, the Alliance must continue to invest in conventional capabilities that underpin deterrence against a potential Russian kinetic attack. These two efforts should be pursued simultaneously and treated as mutually reinforcing. The first is unlikely to become redundant, as the Ukrainian case indicates. Hybrid threats can remain relevant during an armed conflict. They may adapt to shifts toward more traditional forms of warfare, consistent with Russia’s recent operational practice across multiple conflicts.

Traditional deterrence capacity building is still relevant for the Alliance to effectively deter traditional threats and to avoid full-scale conflict within its borders. However, hybrid threats accompanying hybrid warfare in the conditions of full-scale war can easily spill over into neighbouring countries, especially where the aggressor state has ties to them, for instance, through the provision of military support. These traditional deterrence capabilities fail because they aim to deter different kinds of warfare. Specifics of hybrid threats rely on their blurred boundaries and pose distinct challenges.

The first challenge is ambiguity. Although this element is a key component of hybrid warfare and hybrid threats (Mumford & Carlucci, 2022) and is present across all other challenges, I present it here as a distinct challenge. In this matter, the biggest challenge is identifying the perpetrator. This is a consequence of the primary purpose of ambiguity: hindering a response to an attack (Mumford, 2020). It makes the decision about the response riskier and slower, if a response is made at all.

Another challenge is that many actions are maintained below a certain threshold of force and intensity, which means that a symmetrical response by a NATO member state may lead to further escalation. In this case, I want to emphasise actions undertaken by military means, which, depending on circumstances, may be kinetic or non-kinetic. By military means, I mean, in particular, the use of fighter jets or armed-capable drones.

The third challenge is non-military and material actions, such as cyber and economic activities that can negatively influence the targeted country and, consequently, have adverse political effects. This challenge is particularly evident in economic or infrastructure sabotage.

The fourth challenge is narrative shaping and the erosion of public perception of security. Due to disinformation campaigns and other operations targeting Western societies, their sense of security declines, creating divisions among them and simultaneously discouraging citizens of Ukraine living in those countries from supporting Ukraine as a country. This is evident in the declining support for Ukraine and the willingness to provide further support.

Based on the theoretical scope I analysed above, I will review the challenges posed by particular empirical cases of hybrid threats from countries on the Eastern NATO Flank. I decided to focus on two challenges – NATO Article 5 threshold and non-military and material actions.

Operations conducted below NATO’s Article 5 threshold can be readily illustrated by cases involving overt military activity and kinetic effects, given that Article 5 is invoked by an “armed attack” (NATO, 2025b). At the same time, NATO’s own interpretation is broader. Official guidance emphasises that Article 5 is not confined to traditional state-on-state military strikes and that, depending on scale and effect, certain cyber and other hybrid attacks could be assessed as amounting to an armed attack (NATO, 2025b). Nevertheless, Russia’s actions have not triggered Article 5, underscoring the persistent ambiguity surrounding hybrid threats and escalation thresholds.

Two recent incidents fall within this category. On 9 September 2025, 23 drones violated Polish airspace, with some reportedly shot down (Burrows, 2025; Miłosz, 2025). Later that month, on 19 September 2025, three Russian fighter jets entered Estonian airspace for approximately 12 minutes, reportedly reaching up to 10 kilometres inside Estonian territory, while Allied aircraft provided an escort (Szymański et al., 2025).

In both cases, Article 4 consultations were initiated (Henley, Krupa, 2025; Olech, 2025), contributing to the launch of Operation Eastern Sentry. Within this framework, Allies provide additional assets to reinforce the Eastern Flank, including fighter aircraft, helicopters, transport aircraft, air-defence systems, surveillance platforms, and frigates (NATO, 2025c). The resulting posture is therefore highly militarised and largely translates into conventional deterrence.

However, a key limitation remains. Eastern Sentry does not resolve the cost asymmetry of using expensive, high-end aircraft (including platforms such as the F-35) against comparatively low-cost drones. Moreover, the Estonian case does not primarily indicate Alliance unpreparedness. Rather, it suggests that existing procedures and force posture can function effectively in managing airspace violations. Against this background, proposals to add more traditional and cost-efficient capabilities are justified, yet they do not necessarily imply a broader doctrinal shift in NATO’s approach to hybrid threats.

Among potential solutions appear conventional measures such as strengthening the national military capacities of Eastern Flank states, thereby reducing excessive reliance on Allied reinforcement in the early phases of a crisis. A more far-reaching alternative would be a policy adjustment toward a more assertive posture against hybrid activities. For example, moving from predominantly reactive responses to more proactive measures, including yet unidentified kinds of pre-emptive strikes or retaliation, as mentioned by the Chair of the NATO Military Committee, Admiral Dragone (Milne, 2025).

Responses to hybrid activities that involve military force (or credible kinetic escalation) can often draw on familiar instruments of conventional deterrence. By contrast, hybrid operations conducted through non-military, material disruption, such as sabotage of infrastructure or economically significant targets, pose a different problem. They generate security effects without crossing clear military thresholds, which makes it harder to justify or design Allied responses that rely primarily on military tools.

Two recent examples illustrate this challenge. On 25 December 2025, the Eastlink-2 undersea cable connecting Finland and Estonia experienced an outage (AP News, 2025). In the aftermath, Finnish authorities seized a vessel named “Eagle S”, which was reportedly linked to Russia’s shadow fleet (Guardian, 2024). Other cases are even more clearly economic and infrastructural in character. In May 2024. A fire was set beneath a shopping centre in Warsaw. Polish authorities described the incident as sabotage coordinated by Russian special forces (Prokuratura Krajowa, 2025). In another episode, in November 2025, Polish authorities reported damage to a railway line between Warsaw and Dorohusk consistent with an explosive incident. Two suspected Ukrainian nationals reportedly fled to Belarus (Michalak, 2025).

Across these incidents, one recurring feature is that the alleged perpetrators were not Russian citizens. Most notably, Ukrainian nationals appear in two out of three mentioned cases, while investigative findings and official statements nevertheless point to Russian intelligence involvement in planning or direction. A second pattern concerns accountability. Suspects were either acquitted, as in the Finnish case, or avoided prosecution by escaping jurisdiction, including by crossing into Belarus. Finally, in Poland, these incidents also triggered diplomatic measures, which in result escalated and worsened already tense bilateral relations. The closure of the Russian consulate in Kraków was followed by Russia’s closure of the Polish consulate in Kaliningrad, presented as retaliation (Walker, 2025). Following the publication of another investigation, Poland closed the Russian consulate in Gdańsk, and Russia responded by closing Poland’s consulate in Irkutsk (Psujek, 2025; Bartkiewicz, 2025).

NATO’s efforts to address hybrid threats rely on conventional military responses, including actions that may involve the use of force. The underlying logic is to reinforce deterrence and signal resolve, in the expectation that a strengthened posture will shape Russian behaviour. This approach was evident in the response to the drone incursions over Poland and, despite the more ambiguous and non-military character of “shadow fleet” activity, in the measures adopted under Baltic Sentry.

At the same time, these initiatives should be understood less as a doctrinal innovation than as an incremental expansion of existing instruments and deployments. In both contexts, persistent shortcomings remain evident, particularly regarding accountability. States have yet to develop fully effective legal and operational mechanisms for attributing responsibility, prosecuting perpetrators, and preventing repeat incidents. More broadly, neither military adjustments nor diplomatic steps have thus far been sufficient to halt Russian provocations.

Taken together, the current pattern of response remains predominantly reactive rather than preventive, focused on managing incidents after they occur rather than systematically reducing the conditions that enable them.

Bibliography

AP News. (25.12.2025). Undersea power cable linking Finland and Estonia hit by outage, prompting investigation. https://apnews.com/article/finland-estonia-cable-outage-baltic-estlink2-orpo-a904d86cce60f2bc76866bcb53051d3e

Bartkiewicz, A. (19.11.2025). Rosja reaguje na decyzję Polski o zamknięciu konsulatu w Gdańsku. Rzeczpospolita. https://www.rp.pl/dyplomacja/art43360571-rosja-reaguje-na-decyzje-polski-o-zamknieciu-konsulatu-w-gdansku

Burrows, E. (11.09.2025). NATO’s first drone battle pits million-dollar jets against cheap drones, exposing vulnerabilities. AP News. https://apnews.com/article/poland-russia-drones-jamming-ukraine-incursion-nato-27b1aeed542604c91386df1fbe4463c7

Calcagno, E., Marrone, A. (10.09.2024). Artillery in Present and Future High-Intensity Operations. Documenti IAI 24. Instituto Affari Internazionali. https://www.iai.it/sites/default/files/iai2410.pdf

Cullen, P., Reichborn-Kjennerud, E. (2017). ‘Understanding Hybrid Warfare’, Multinational Capability Development Campaign (MCDC).

Henley, J., J. Krupa, J. (20.09.2025). Nato intercepts Russian fighter jets on ‘reckless’ violation of Estonian airspace. The Guardian. https://www.theguardian.com/world/2025/sep/19/estonia-accuses-russia-of-brazen-violation-of-its-airspace

Hoffman, F. (2007). Conflict in the 21st Century: The Rise of Hybrid Wars. Potomac Institute for Policy Studies.

Michalak, A. (24.11.2025). ABW sfrustrowane działaniami ws. aktów dywersji? „Niech sami łapią szpiegów”. Rzeczpospolita. https://www.rp.pl/przestepczosc/art43386891-abw-sfrustrowane-dzialaniami-ws-aktow-dywersji-niech-sami-lapia-szpiegow

Milne, R. (01.12.2025). NATO considers being ‘more aggressive’ against Russia’s hybrid warfare. Financial Times. https://www.ft.com/content/dbd93caa-3c62-48bb-9eba-08c25f31ab02

Miłosz, M. (10.09.2025). Rosyjskich dronów było ponad 20. Strzelały głównie holenderskie F-35. Rzeczpospolita. https://radar.rp.pl/przemysl-obronny/art42986931-rosyjskich-dronow-bylo-ponad-20-strzelaly-glownie-holenderskie-f-35

Mumford, A. (September 2020). Ambiguity in Hybrid Warfare. Hybrid CoE Strategic Analysis / 24. Hybrid CoE.

Mumford, A., Carlucci, P. (2022). Hybrid warfare: The continuation of ambiguity by other means. European Journal of International Security (2023), 8, 192–206

NATOa. (07.05.2025). Countering hybrid threats. https://www.nato.int/en/what-we-do/deterrence-and-defence/countering-hybrid-threats

NATOb. (12.11.2025). Collective defence and Article 5. https://www.nato.int/en/what-we-do/introduction-to-nato/collective-defence-and-article-5

NATOc. (23.10.2025). Strengthening NATO’s eastern flank. https://www.nato.int/en/what-we-do/deterrence-and-defence/strengthening-natos-eastern-flank

Olech, A. (10.09.2025). Poland Triggers NATO’s Article 4. Defence24.com https://defence24.com/geopolitics/poland-triggers-natos-article-4

Prokuratura Krajowa. (24.10.2025). Wyrok skazujący trzy osoby za udział w zorganizowanej grupie przestępczej o charakterze sabotażowo-terrorystycznym. https://www.gov.pl/web/prokuratura-krajowa/wyrok-skazujacy-trzy-osoby-za-udzial-w-zorganizowanej-grupie-przestepczej-o-charakterze-sabotazowo-terrorystycznym

Psujek, G. (19.11.2025). Polska zamyka rosyjski konsulat w Gdańsku. Kreml reaguje natychmiast. Business Insider. https://businessinsider.com.pl/wiadomosci/polska-zamyka-rosyjski-konsulat-w-gdansku-kreml-reaguje-natychmiast/bypm6zv

Szymański, P., Chmielewski, B., Menkiszak, M. (22.09.2025). Russian fighter jets in Estonian airspace: a test of NATO’s unity. Analyses OSW. https://www.osw.waw.pl/en/publikacje/analyses/2025-09-22/russian-fighter-jets-estonian-airspace-a-test-natos-unity

The Guardian. (26.12.2024). The Finnish Coast Guard boards a tanker suspected of causing power and internet cable outages. https://www.theguardian.com/world/2024/dec/26/finnish-coastguard-boards-eagle-s-oil-tanker-suspected-of-causing-power-cable-outages

Walker, S. (12.05.2025). Poland to close Russian consulate in Kraków over Warsaw fire. The Guardian. https://www.theguardian.com/world/2025/may/12/poland-to-close-russian-consulate-krakow-warsaw-shopping-centre-fire

Williams, M. J., et al. (2025). Chapter 9: Conventional War and Warfare. In M. J. Williams et al. Understanding International Security – Theory and Practice (p. 171 – 190). Cambridge University Press.