Hybrid Warfare Blurs the Line Between War and Peace
The most dangerous war today may not begin with tanks crossing a border.
It may begin with a rumour.
A hacked power grid.A fake video before an election.A cyberattack on a hospital.A coordinated social media campaign.A sudden migrant crisis at a border.A drone flown by a proxy group.A damaged undersea cable.A financial pressure campaign.A criminal network quietly working for a state.A legal claim designed to confuse sovereignty.A series of “accidents” that are too convenient to be accidental.
This is hybrid warfare.
It is war without declaration. It is aggression without clear attribution. It is coercion without always crossing the threshold that would trigger a conventional military response. It is designed to weaken a country before the first shot is fired — and sometimes without any shot being fired at all.
NATO defines hybrid threats as a combination of military and non-military, covert and overt methods, including disinformation, cyberattacks, economic pressure, irregular armed groups and regular forces. NATO also states that hybrid methods are used to blur the line between war and peace and to sow doubt in target populations.
That phrase — blurring the line between war and peace — captures the essence of the problem.
Modern states may no longer know whether they are at peace, under attack, being manipulated or being prepared for future conflict. A country may wake up one morning and find that its banks are disrupted, its citizens are angry over false information, its border is under pressure, its elections are being targeted, its companies are being sanctioned, and its infrastructure is being probed — yet no enemy army has crossed the border.
This is the strategic power of hybrid warfare. It does not always try to defeat a state militarily. It tries to confuse it, divide it, exhaust it and make it doubt itself.
The New Battlefield Is Society Itself
Traditional war attacks armies. Hybrid warfare attacks societies.
It targets the institutions that allow a state to function: trust, information systems, financial networks, energy grids, ports, data centres, elections, courts, media ecosystems, public health systems and social cohesion. The aim is not merely to destroy physical assets. The aim is to weaken confidence.
If citizens stop trusting elections, democracy weakens.If people stop trusting official information, crisis management fails.If businesses stop trusting digital infrastructure, economic confidence falls.If communities turn against each other, national unity breaks.If the state cannot identify the attacker, deterrence becomes difficult.
The Council of the European Union describes hybrid threats as coordinated harmful activities carried out with malign intent, using methods such as information manipulation, cyberattacks, economic coercion, covert political manoeuvring, coercive diplomacy and threats of military force.
This shows why hybrid warfare is so hard to counter. It does not operate in one domain. It operates across many. A military response alone is insufficient because the attack may be political, digital, economic or psychological. A police response alone is insufficient because the attacker may be a foreign state. A diplomatic protest alone is insufficient because the aggression may be deniable.
Hybrid warfare is not one weapon. It is a method.
Grey Zone: The Space Between Peace and War
Hybrid warfare often operates in the grey zone.
The grey zone is the space between normal competition and open war. It includes hostile activity below the threshold of direct state-on-state conflict. The UK Parliament’s 2025 Defence Committee report described grey-zone activity as hostile activity below the threshold of direct conflict, designed to coerce governments or erode their ability to function.
This is where adversaries test limits.
They ask: How far can we go without triggering war?How much pressure can we apply before the target responds?Can we create confusion about attribution?Can we use proxies instead of soldiers?Can we weaponise information instead of missiles?Can we divide the target’s society from within?
The grey zone is attractive because it lowers risk for the attacker. A conventional invasion is costly and obvious. A hybrid campaign is cheaper, deniable and continuous. It can be escalated or paused. It can be denied. It can be outsourced.
The victim faces the opposite problem. If it responds too strongly, it may look reckless. If it responds weakly, the attacker gains confidence. If it cannot prove attribution, it struggles to mobilise allies. If public opinion is divided, the state loses strategic clarity.
This is why hybrid warfare is so effective against democracies. Democracies require debate, transparency and legal process. Hybrid attackers exploit those strengths and turn them into vulnerabilities.
Disinformation Is a Strategic Weapon
Disinformation is not merely fake news. In hybrid warfare, it is a weapon of strategic confusion.
Its purpose is not always to make people believe one false story. Sometimes the purpose is to make people believe nothing at all. If citizens are flooded with contradictory claims, manipulated videos, anonymous accounts, conspiracy theories and emotionally charged narratives, they may stop trusting every source of information.
That is victory for the attacker.
A society that cannot agree on basic facts cannot respond coherently to crisis. It cannot debate policy rationally. It cannot maintain public confidence during war, pandemic, terrorism, economic shock or election tension.
The European External Action Service describes foreign information manipulation and interference, including disinformation, as a growing security and foreign-policy threat for the European Union.
Microsoft’s 2025 Digital Defense Report also warned that nation-state actors increasingly use cyber and influence operations together, including AI-enabled influence campaigns, synthetic media and public-perception manipulation.
Artificial intelligence has made this danger worse.
Earlier, propaganda required human networks, media outlets and long preparation. Now, AI can generate thousands of posts, fake images, synthetic voices and deepfake videos. A fake statement by a political leader, a fabricated military video, or a manipulated communal incident can spread before verification catches up.
The new battlefield is the feed.
Cyberattacks Are No Longer Just Technical Incidents
A cyberattack is often treated as an IT problem. In hybrid warfare, it is a national-security problem.
A cyber operation can target banks, ports, hospitals, electricity systems, telecom networks, satellites, railways, airports, election databases, military communications and government records. It can steal secrets, disrupt services, create panic, damage trust and prepare for future sabotage.
Microsoft’s 2025 report states that cyber threats are evolving from technical problems affecting businesses into events affecting economic stability, individual safety and society as a whole.
That shift is crucial. Cybersecurity is no longer only about protecting passwords. It is about protecting state capacity.
If a hospital’s systems are locked by ransomware, patients suffer.If a power grid is disrupted, cities stop.If port systems fail, trade slows.If a bank is attacked, confidence falls.If government data is stolen, national security is compromised.
Cyberattacks also create attribution problems. A hostile state may use criminal hackers. Criminal hackers may sell access to intelligence agencies. A proxy group may carry out the attack while the sponsoring state denies responsibility. This ambiguity is central to hybrid warfare.
The attacker wants the damage of war without the accountability of war.
Criminal Networks Are Becoming Proxy Actors
One of the most alarming features of hybrid warfare is the use of criminal networks.
States can use criminals because criminals provide deniability. A cybercrime group, smuggling network, sabotage cell or organised gang can be used to carry out operations that serve political objectives. The criminal group gains money, protection or access. The state gains distance.
Europol’s 2025 Serious and Organised Crime Threat Assessment warned that hybrid threat actors exploit criminal networks for deniability and political or economic gain, while criminals benefit from protection, tools and operational opportunities.
This creates a “shadow alliance” between crime and geopolitics.
A ransomware attack may not be only about money. A smuggling route may not be only about profit. A sabotage incident may not be only vandalism. A criminal network may become an arm of foreign policy.
This is extremely dangerous because it breaks the old separation between internal security and external security. Police may be investigating a crime, while intelligence agencies see a foreign operation behind it. Courts may require evidence beyond doubt, while national-security agencies must act on probability. Public communication becomes difficult because attribution may be classified.
Hybrid warfare thrives in that gap.
Critical Infrastructure Is a Prime Target
Hybrid warfare often targets infrastructure because modern societies depend on invisible systems.
Undersea cables carry data. Pipelines carry energy. Ports move trade. Rail networks move goods and people. Power grids sustain cities. Satellites enable navigation and communication. Data centres host essential services.
Damage to these systems can create fear disproportionate to the physical attack.
NATO launched “Baltic Sentry” in January 2025 to increase critical infrastructure security in the Baltic Sea after recent sabotage damaged energy and communication cables. NATO’s Secretary General said the alliance would work together to ensure the safety of critical infrastructure.
The European Commission and High Representative also presented actions in February 2025 to strengthen Europe’s ability to prevent, detect, repair and respond to sabotage affecting cables.
The logic is clear. An attacker does not need to destroy a capital city. It can cut a cable, damage a pipeline, disrupt a port, or attack a railway network. The incident may be small, but the psychological message is large: your systems are vulnerable.
This is why infrastructure resilience is now a defence priority.
Economic Coercion Is Hybrid Warfare by Other Means
Hybrid warfare is not always violent. It can be economic.
A state can use trade restrictions, investment pressure, energy supply manipulation, sanctions, tourism controls, regulatory harassment, debt dependence, supply-chain leverage or market access to coerce another country.
Economic coercion is powerful because it targets political decision-making through commercial pain. It tells a state: change your policy, or your economy will suffer.
The Council of the European Union includes economic influence or coercion among the tools used in hybrid threats.
This matters especially in an interconnected global economy. Countries depend on energy imports, semiconductor supply chains, export markets, critical minerals, shipping routes, payment systems and technology platforms. Those dependencies can be weaponised.
In earlier decades, economic interdependence was expected to reduce conflict. Today, interdependence can also become a pressure point.
The modern state must therefore ask: where are we dependent, and who can exploit that dependence?
Lawfare: Using Law as a Weapon
Hybrid warfare also includes lawfare — the strategic use of legal claims, domestic laws, international forums and procedural ambiguity to gain advantage.
A state may pass a domestic law to justify control over disputed territory. It may issue maps to normalise claims. It may file legal cases to delay action. It may use international institutions to delegitimise opponents. It may reinterpret treaties selectively. It may exploit legal uncertainty around cyberattacks, undersea cables, autonomous systems or maritime grey-zone activity.
Lawfare is not always illegitimate. Law is a normal part of international politics. But in hybrid warfare, law is used not to clarify rules but to create confusion, delay response or legitimise coercion.
This is visible in maritime disputes, cyber attribution, sanctions, migration pressure and information regulation. The target state must fight not only on the ground or online, but also in courts, institutions, treaties and public legal narratives.
In hybrid warfare, legitimacy itself becomes a battlefield.
Migration Can Be Weaponised
One of the most sensitive hybrid tools is migration pressure.
Forced migration is usually caused by war, poverty, persecution or climate stress. But states and non-state actors can manipulate migration flows to pressure neighbouring countries, create political tension, overwhelm border systems or fuel domestic polarisation.
This is dangerous because it turns vulnerable people into instruments of coercion.
A state facing such pressure must protect borders and uphold humanitarian obligations at the same time. If it responds harshly, it may face moral and legal criticism. If it responds weakly, the pressure may increase. If domestic politics polarises, the attacker achieves a strategic objective without firing a shot.
Hybrid warfare is often most effective when it forces democracies into morally difficult choices.
Elections Are a Strategic Target
Elections are the nervous system of democracy.
That is why hybrid warfare targets them.
The goal may not be to change vote totals directly. It may be to reduce trust in the process, amplify social divisions, discredit candidates, spread manipulated information, hack party systems, leak selective documents, impersonate officials, or create confusion on voting day.
The United States Election Assistance Commission maintains election-security preparedness resources for election officials, including cybersecurity and election-administration materials, reflecting the continuing need to protect democratic infrastructure.
The danger is that election interference does not need to be fully successful to damage democracy. Even the perception that an election was manipulated can weaken legitimacy.
If citizens believe results are fake, democratic stability suffers. If parties accuse each other of foreign manipulation without evidence, trust falls. If platforms cannot control coordinated influence campaigns, public debate is distorted.
Hybrid warfare targets elections because it understands that democracy depends on belief.
AI Has Supercharged Hybrid Warfare
Artificial intelligence has increased the speed, scale and sophistication of hybrid operations.
AI can help generate phishing emails, identify targets, create synthetic media, automate propaganda, translate influence content across languages, clone voices, analyse public sentiment and adapt narratives in real time. It can also help defenders detect threats, but the offensive advantage is growing quickly.
Microsoft reported that nation-state actors in 2025 increasingly used AI to produce automated, large-scale influence campaigns and synthetic media designed to manipulate public perception.
AP’s coverage of Microsoft’s 2025 findings noted that Russia, China, Iran and North Korea were increasingly using AI to conduct cyberattacks and spread disinformation, including credible phishing, deepfake government-official clones and automated hacking techniques.
This changes the economics of manipulation.
A small team can create the appearance of a large movement. A fake video can create real anger. A cloned voice can trigger panic. A bot network can make a fringe opinion appear mainstream. AI does not need to be perfect. It only needs to be fast enough to outrun verification.
Truth now competes with speed.
Hybrid Warfare Is Designed to Exhaust
Hybrid warfare rarely seeks one spectacular victory. It seeks cumulative exhaustion.
A cyberattack today.A disinformation campaign tomorrow.A border provocation next week.A sabotage incident next month.A fake video during an election.A financial pressure campaign during a crisis.A proxy attack when the state is distracted.
Each event may seem manageable. Together, they create fatigue.
The target government becomes reactive. Security agencies are stretched. Citizens become anxious. Media cycles become unstable. Opposition parties accuse the government of failure. Allies demand evidence. Businesses lose confidence.
This is why hybrid warfare is sometimes more corrosive than conventional war. Conventional war creates visible unity, at least initially. Hybrid warfare often creates confusion and suspicion. People disagree not only about the response, but about whether an attack is happening at all.
The attacker wins when the target society begins fighting itself.
Russia-Ukraine Shows the Hybrid-Total War Continuum
Russia’s war against Ukraine demonstrates that hybrid warfare and conventional warfare are not separate categories. They can operate together.
Before and during the full-scale invasion, Ukraine faced cyberattacks, disinformation, proxy warfare, economic pressure, political subversion and military force. The conflict showed that hybrid tools can prepare the battlefield before conventional attacks and continue alongside them.
NATO’s hybrid-threats framework explicitly recognises that hybrid methods can involve both irregular armed groups and regular forces.
The lesson is important: hybrid warfare is not a replacement for conventional war. It is often its companion.
A state may use disinformation to confuse the target, cyberattacks to disrupt command systems, proxies to create deniability, economic coercion to weaken resolve, and conventional troops when the moment is right.
The modern battlefield is layered.
China and the Grey Zone
China’s maritime behaviour in the South China Sea and around Taiwan is often discussed through the grey-zone lens.
Coast guard pressure, maritime militia activity, air and naval patrols, legal claims, economic leverage and information messaging allow Beijing to apply pressure without necessarily starting open war. The aim is to change facts gradually while keeping escalation controlled.
This model is not identical to Russia’s, but the strategic logic is similar: operate below the threshold of war, test the opponent’s resolve, and create a new normal through repeated pressure.
For countries like India, Japan, the Philippines, Vietnam and Taiwan, the lesson is clear. Defence preparedness must include grey-zone resilience, not only conventional deterrence.
India Faces a Hybrid Threat Environment
India is deeply exposed to hybrid threats.
It faces conventional security challenges, cross-border terrorism, cyberattacks, disinformation, radicalisation networks, drone smuggling, financial fraud, information manipulation, communal provocation, maritime vulnerabilities and economic dependencies.
India’s own defence leadership has acknowledged the changing nature of warfare. In April 2025, India’s Defence Minister said the world is in an age of grey-zone and hybrid warfare, where cyberattacks, disinformation campaigns and economic warfare can be used against states.
CERT-In’s 2025 record also shows the scale of India’s cyber challenge. According to a January 2026 PIB release, CERT-In handled over 29.44 lakh cyber incidents in 2025, issued 1,530 alerts, 390 vulnerability notes and 65 advisories.
These numbers show that cyber resilience is not optional for India. A country that is digitising governance, payments, health, education, logistics and identity systems must protect those systems as national infrastructure.
India’s digital transformation increases national capacity, but it also expands the attack surface.
India’s Social Fault Lines Are a Security Concern
Hybrid warfare often exploits existing divisions.
It does not create every internal problem. It amplifies them.
In India, social media rumours, communal misinformation, manipulated videos, regional anxieties, political polarisation and foreign influence campaigns can become national-security concerns if they trigger violence, delegitimise institutions or weaken crisis response.
This does not mean every disagreement is foreign interference. Democracies must protect dissent. But they must also recognise coordinated manipulation.
The challenge is balance.
If the state overreacts, it may suppress legitimate speech. If it underreacts, hostile actors can exploit openness. The solution is not censorship as a first instinct. The solution is transparency, rapid fact-checking, platform accountability, media literacy, forensic attribution and trusted public communication.
Hybrid warfare is defeated not by silencing society, but by strengthening its immunity to manipulation.
The Military Alone Cannot Defeat Hybrid Warfare
Hybrid warfare requires a whole-of-state response.
The armed forces matter, but they cannot defend everything. Cyber agencies, intelligence services, police, regulators, election bodies, central banks, energy operators, telecom companies, media institutions, courts, schools, technology platforms and citizens all have roles.
The military can deter invasion. It cannot alone stop viral disinformation.The police can investigate sabotage. They cannot alone secure undersea cables.Cyber agencies can issue advisories. They cannot alone create public trust.Diplomats can protest. They cannot alone harden infrastructure.Platforms can remove fake accounts. They cannot alone rebuild civic literacy.
This is why hybrid resilience must become a national culture.
A society that depends only on the state to detect every threat will remain vulnerable. Citizens must learn to pause before forwarding. Journalists must verify before amplifying. Companies must report breaches quickly. Political parties must avoid weaponising fake news for short-term gain. Institutions must communicate clearly during crises.
Hybrid warfare attacks the seams between institutions. The defence must connect those seams.
Attribution Is the Hardest Problem
In conventional war, identifying the attacker is usually straightforward. In hybrid warfare, attribution is often contested.
A cyberattack may appear to come from one country but be routed through another. A fake news network may use domestic accounts. A sabotage incident may look like an accident. A criminal group may deny state links. A proxy militia may act independently or under direction. Evidence may exist but remain classified.
Without attribution, response becomes difficult.
Sanctions require proof. Diplomatic retaliation requires confidence. Public communication requires credibility. Military response requires a high threshold.
Attackers exploit this. They create ambiguity not because they expect everyone to believe their denial, but because ambiguity slows decision-making.
Hybrid warfare does not need innocence. It needs doubt.
Deterrence Must Be Reimagined
Traditional deterrence is based on punishment: if you attack us, we will retaliate.
Hybrid warfare requires a broader deterrence model.
First, denial: make attacks harder to succeed. This means cyber hardening, infrastructure protection, public awareness, resilient supply chains and rapid recovery.
Second, exposure: publicly reveal hostile campaigns when evidence is strong. Sunlight can reduce the effectiveness of covert operations.
Third, punishment: impose costs through sanctions, prosecutions, expulsions, cyber countermeasures or diplomatic action.
Fourth, resilience: ensure that even if an attack succeeds, society does not collapse into panic or division.
Hybrid deterrence is not only about fear. It is about reducing payoff.
If attackers believe their operations will be exposed, absorbed and punished, they may hesitate. If they believe a target society is divided, fragile and slow, they will continue.
Democracies Have a Weakness — and a Strength
Democracies are vulnerable to hybrid warfare because they are open.
They allow free media, elections, protest, debate, courts, opposition and civil society. These freedoms can be exploited by hostile actors. False narratives can spread. Polarisation can be amplified. Domestic actors may unknowingly echo foreign influence campaigns.
But democracy is also a strength.
Open societies can self-correct. Independent media can investigate. Courts can review abuses. Citizens can expose manipulation. Civil society can build resilience. Public debate can produce legitimacy.
The answer to hybrid warfare cannot be to become authoritarian. That would hand the attacker a deeper victory.
The goal is to make democracy harder to manipulate without destroying democracy itself.
The Private Sector Is on the Front Line
Many hybrid targets are privately owned or operated.
Banks, telecom networks, ports, airlines, data centres, cloud providers, energy companies, social media platforms, logistics firms and media houses are private or semi-private actors. Yet attacks on them can have national consequences.
This means national security now depends on public-private coordination.
Companies must invest in cybersecurity, report incidents quickly, participate in information-sharing networks, protect supply chains and prepare continuity plans. Governments must provide intelligence, legal clarity, incentives and crisis coordination.
The old model — where national security belonged only to the state — no longer works.
Education Is Strategic Defence
One of the most underestimated defences against hybrid warfare is education.
A population that understands how propaganda works is harder to manipulate. A citizen who checks sources before forwarding messages is a small unit of national resilience. A journalist trained in verification can prevent panic. A student who understands deepfakes is less likely to be deceived. A voter who recognises emotional manipulation is harder to polarise.
Media literacy should be treated as civic defence.
This is especially important in India, where language diversity, mass smartphone use and rapid social media circulation create both democratic energy and vulnerability.
The future citizen must be digitally literate, emotionally restrained and institutionally aware.
Hybrid Warfare Makes Peace More Unstable
The greatest danger of hybrid warfare is that it makes peace unstable.
When hostile acts occur continuously below the threshold of war, countries may remain in a permanent state of tension. The public does not experience full war, but neither does it experience true peace. The result is strategic anxiety.
This is exhausting for governments and societies.
It also increases escalation risk. A state that absorbs repeated hybrid attacks may eventually respond forcefully. The attacker may miscalculate. A deniable operation may produce undeniable casualties. A cyberattack may cause physical damage. A proxy action may trigger a treaty response.
Hybrid warfare is designed to avoid war, but it can accidentally produce one.
What India Should Do
India needs a clear hybrid-warfare doctrine.
First, India must strengthen cyber defence across critical infrastructure, not only government networks. Power, transport, finance, telecom, health and logistics must be treated as national-security assets.
Second, India needs faster attribution capacity. Cyber forensics, intelligence fusion, open-source intelligence and inter-agency coordination must improve.
Third, India must build information resilience. Government communication during crises should be rapid, credible and multilingual.
Fourth, election systems and political parties need stronger cybersecurity and disinformation preparedness.
Fifth, border and coastal security must account for drones, smuggling, proxies and maritime grey-zone tactics.
Sixth, economic security must map strategic dependencies in technology, energy, minerals, finance and supply chains.
Seventh, India must train “hybrid warriors” across civilian and military institutions: cyber experts, information analysts, legal strategists, infrastructure planners and psychological-operations specialists.
India’s challenge is not only to defend territory. It must defend trust.
Conclusion: The War Before War
It does not need a formal invasion. It needs a divided society, weak cyber systems, fragile infrastructure, careless media, exposed supply chains, distrustful citizens and slow institutions.
The battlefield is no longer only the border.It is the bank server.It is the election database.It is the WhatsApp group.It is the undersea cable.It is the port terminal.It is the television debate.It is the court filing.It is the fuel supply chain.It is the public mind.
This does not mean conventional war is obsolete. Tanks, missiles, aircraft and soldiers still matter. But the war before war now matters just as much.
A country that waits for the first bullet may already be late.
The future of national security belongs to states that can detect ambiguity, absorb shocks, protect truth, secure infrastructure, coordinate institutions and keep public trust alive under pressure.
Hybrid warfare is dangerous because it makes aggression look like confusion.
The first task of a resilient democracy is to refuse that confusion.
It must know when it is being manipulated. It must know when it is being tested. It must know when peace has already become a battlefield.
And it must respond before the invisible war becomes visible.
