Active Deterrence Doctrine: A new NATO strategy against hybrid threats

Introduction: definition of hybrid threats

According to NATO’s definition, adopted at the Warsaw Summit in 2016, hybrid threats are: “a broad, complex, and adaptive combination of conventional and non-conventional means, as well as overt and covert military, paramilitary, and civilian measures employed in a highly integrated manner by state and non-state actors to achieve their objectives”. They are conducted below the threshold of war to blur the lines between war and peace. Examples of hybrid threats include disinformation, propaganda, espionage, cyberattacks, economic coercion, migration pressure, and sabotage of critical infrastructure. These types of attacks are often conducted simultaneously. Attribution poses another key challenge – Russia frequently uses proxies or one-off agents with criminal backgrounds, motivated by financial gain, to obscure the link between the perpetrator and the state behind it.

All these actions should be perceived as part of a coordinated, long-term hybrid strategy that should not be reduced only to the Gerasimov Doctrine, a term based on a misreading by Western media rather than an actual Russian military doctrine. Moscow endeavours to paralyse the functioning of the state, cause social chaos, expose weakness, test the limits of single states and the whole Alliance’s resilience, and normalise behaviour that in the past was unacceptable. At the same time, Russian objectives should not be seen from a short-term perspective – they are not focusing as such on initiating an immediate crisis, but rather on systematically undermining the stability of the state.

Towards a new NATO strategy on hybrid threats

Since 2015, NATO has based its strategy on three pillars: preparedness, deterrence, and defence. Following the logic of collective defence, the Alliance must be prepared to assist any member state facing hybrid attacks. Nevertheless, when required, the North Atlantic Alliance also needs to demonstrate its strength and genuine capacity to respond.

Given the growing intensity of hybrid threats, a comprehensive strategy is required – one that combines deterrence with an offensive, more assertive and active posture. Russia’s malicious attitude demonstrates that this country understands the language of strength, not diplomacy. Therefore, it is necessary to establish clearly defined thresholds whose breach would automatically entail a corresponding response. This strategy should not be limited solely to defensive measures as there is a clear need for NATO to adopt a consistent position towards malicious incidents so that the Kremlin understands the consequences of its actions and recognises that each subsequent violation will be met with a predictable and coordinated response.

To operationalise this shift, the Alliance should adopt the “Active Deterrence Doctrine”. It remains below the threshold of open war while allowing for proportional and predictable responses to hybrid attacks. At the same time, the new approach combines resilience-building with the credible threat of offensive counter-coercion, rooted in clearly defined thresholds. Moscow must understand that crossing agreed red lines would trigger a coordinated NATO response. Moreover, considering the limited responses to previous drone incursions, hundreds of acts of arson, and attacks on critical infrastructure, it is imperative to emphasise in external communication that hybrid actions against one or more Allies could lead to a decision to invoke Article 5 of the North Atlantic Treaty, as was implemented in 2016.

To operationalise the concept of red lines, it is necessary to formalise the structure of the escalation ladder by establishing three threshold levels. The first level comprises low-intensity incidents, such as disinformation campaigns, individual cyberattacks not targeting critical infrastructure, and isolated acts of arson or sabotage that do not result in casualties. Such incidents require strategic communication. What is more, a relevant supplement might be sanctions implemented by the EU on Russia’s critical sectors.

The second level – medium-intensity incidents – would include attacks on critical infrastructure (undersea cables, pipelines, or energy grids), both physical and cyberattacks, during which no casualties are noted. Such incidents should be a sufficient premise to increase NATO’s active cyber defence measures (e.g. launch of cyber pressure targeting Russian military logistics), expand the military presence in the affected state, as well as in other member states and the Baltic Sea, and initiate consultations under Article 4.

The final threshold level – high-intensity incidents – is reached when casualties occur or when a systemic failure of critical infrastructure affects a significant part of a state’s population. This stage should be perceived as a crossing of red lines that should trigger consultations regarding the possible invocation of Article 5, followed by the intensification of coordinated actions against Russian intelligence networks in Europe.

Assessment of the political results of the new strategy

Russia will continue to test the Alliance’s tolerance for hybrid aggression only for as long as the costs of doing so remain acceptable to the Kremlin. Without a doubt, implementing a new strategy based on a more offensive and assertive attitude would force Moscow to alter its strategic calculations. Certainly, it would establish mutual predictability, so that Russia receives a clear message that any incident would result in a predetermined and proportionate response. On the NATO side, the Alliance would no longer need to assess each incident in isolation, but rather as part of a broader campaign directed against NATO as a whole. The implementation of the new doctrine should be perceived as a balance between the current resilience-based posture, which has proven insufficient, and a fully militarised response that would breach NATO’s status as a defensive alliance.

Recommendations

Following this updated strategy, it is imperative to highlight that NATO should be able to effectively counter hybrid threats and have sufficient capabilities to defend the Alliance and each member state. Moreover, the Alliance should be able to put pressure on the Kremlin. To implement this idea effectively, it is necessary to include cyber, economic, and information components that will create a coordinated strategy. The combined use of these instruments would strengthen deterrence.

The division of responsibilities between NATO and the EU reflects their institutional comparative advantages – NATO retains primary responsibility for deterrence and defence – including military presence, active cyber defence, and Articles 4 and 5 mechanisms. At the same time, the EU’s added value lies in economic and diplomatic instruments, particularly sanctions on Russian individuals and critical sectors, and negotiations with third countries, including Türkiye, to curb circumvention of the sanctions regime. However, this division is not absolute – both organisations increasingly share responsibility for protecting critical infrastructure and building societal resilience, which requires closer institutional integration.

As mentioned earlier, the North Atlantic Alliance needs a comprehensive strategy that will simultaneously include deterrence and offensive measures. NATO should place greater emphasis on strengthening its activities in cyberspace. According to a Microsoft report published in 2025, Russia has increased cyberattacks against NATO states by 25% over the past year. Therefore, NATO, together with its Centres of Excellence, should implement the concept of active defence based not only on responding to incidents but also on precisely disrupting the infrastructure used by Russian-sponsored groups. Each member state, in coordination with its Allies, should possess the capability to conduct cyber operations that would still occur below the threshold of armed conflict. This would allow member states to avoid the use of conventional military force while generating measurable operational and psychological effects. Many NATO member states are rapidly developing Cyber Forces, whose growing capabilities could play an important role in implementing this strategy.

What is more, active defence should be followed by common exercises between national cyber forces, including cooperation in the field of counterintelligence and efforts to strengthen societal resilience against disinformation. Furthermore, to address attribution challenges, member states should increase legal and operational costs for perpetrators of hybrid attacks and strengthen international prosecution mechanisms. As part of the proposed strategy, NATO should expand initiatives such as Baltic Sentry, establishing a permanent naval and border-guard presence, supported by air forces, to patrol sensitive areas of the Baltic Sea near critical infrastructure and counter the ongoing shadow fleet operations.

Summary

NATO is a defensive alliance, as established by the Washington Treaty, and this fundamental characteristic should remain unchanged. Nevertheless, the growing hybrid campaign conducted by the Russian Federation requires fundamental modifications. Deterrence by denial alone is no longer sufficient. The North Atlantic Alliance should combine resilience with rapid and predictable responses whenever established red lines are crossed.