Proactive NATO: a real shift or rhetoric?

The clearest recent example comes from NATO’s Chair of Military Committee, Admiral Giuseppe Cavo Dragone. Speaking to the Financial Times, he noted that the Alliance is „studying everything,” acknowledging that NATO’s posture in cyberspace remains largely reactive. He signalled a potential shift in thinking, suggesting that adopting a more assertive or proactive approach is under consideration. In his words, a „pre-emptive strike” could, under certain conditions, be understood as a form of „defensive action.” At the same time, Dragone recognised the structural barriers limiting NATO’s ability to act. Chief among these is the rule of unanimity in the North Atlantic Council, which requires agreement from all 32 Allies, including on any decision to adopt more offensive or pre-emptive measures.

NATO's offensive cyber operations: tacitly active, yet constrained

Offensive cyber operations have arguably a lower threshold for initiation, given their lack of immediate physical destruction compared with more kinetic methods — at least in a traditional sense. Within the Alliance, there is already a track record of employing cyber capabilities that lean towards the offensive.

The United States Cyber Command’s Persistent Engagement campaign is perhaps one of the most prominent examples among NATO allies. The campaign is built on a distinctly proactive posture. The U.S. cyber doctrine emphasises elements ofdefending forward andpersistent engagement, underscoring the inherently proactive rather than reactive nature of its cyber operations by disrupting, degrading, and neutralising adversarial capabilities at their source.

Other national-level examples include the Netherlands and France. The Dutch authorities openly exposed and neutralised GRU unit operation targeting the OPCW by publishing evidence and signalling an assertive counter-posture. France’s doctrine openly states the possibility of using offensive cyber capabilities and, when it deems appropriate, to make those capabilities available to NATO.

On a bilateral level, the U.S.-UK partnership constitutes another locus of potential offensive cyber operations. Their intelligence agencies maintain one of the closest relationships in the world, translating into enhanced espionage and disruption capabilities that can, when required, be channelled into a more proactive posture in the cyber domain.

Much of NATO’s current offensive posturing remains classified — and for a good reason: there is a strategic advantage in ambiguity. The largely covert nature of these activities suggests that there is likely far more under way than meets the public eye.

However, two caveats emerge when analysing the mentioned examples. First, all three cases, the U.S., the Netherlands, and France, are contingent on their national capabilities, which does not automatically translate into a coherent NATO-level strategy or a more proactive Alliance-wide cyber posture.

Second, being largely intelligence-driven — especially in the example of U.S.-UK partnership — creates its own challenges. Cyber operations remain embedded within intelligence structures and therefore enmeshed in secrecy, which in turn complicates information-sharing on thresholds, capabilities, and intentions at the broader NATO level. This inherent information reticence further hampers NATO’s ability to integrate offensive cyber capabilities into collective planning and doctrine, particularly given the significant disparities in cyber capabilities between Allies.

Beyond cyber – to shoot or not to shoot?

The national-level considerations also appear on the kinetic end of the hybrid spectrum, including airspace incursions, the „shadow fleet,” and disruption to critical infrastructure. Generally, debates on how to respond to kinetic hybrid attacks swing between the limits of existing legal frameworks and the very real operational constraints that shape what states can actually do.

Recent airspace incursions have sparked debates among analysts and policymakers, with some arguing that a forceful response is necessary — often invoking Türkiye’s 2015 shoot-down as precedent — while others propagate a more cautious approach, like NATO’s Secretary General Mark Rutte. On the Alliance-wide level, the recent incursions triggered Article 4 consultations at most. While these are valuable for aligning political assessments and ensuring situational awareness across the Alliance, they are not reflective of a broader shift towards a more proactive posture within NATO.

Furthermore, the discussions extend not only to jurisdictional aspects, but also operational ones. In the case of drones and balloons many of the detected objects are unarmoured, decoys, or simply so inexpensive to produce that intercepting them with high-value missiles becomes strategically and economically disproportionate. Furthermore, in urbanised areas shooting them carries risks for civilians, as recent incidents in Poland have shown. Lastly, given the short time some of these objects are in the airspace it might not even be possible to intercept them on time, let alone reach a collective decision on how to proceed.

The incursions in the Baltic Sea face similar caveats. Even Allies traditionally more hawkish toward Russia are grappling with legal uncertainty. A recent example is the Finnish court’s dismissal of a case involving the Russian-linked vesselEagle S, suspected of damaging electricity and data cables. The case was dropped on jurisdictional grounds — as the incident occurred in international waters — and doubts about intent. Finland’s Foreign Minister, Elina Valtonen, described this outcome as effectively giving Russia” carte blanche” beyond territorial limits. Like Admiral Dragone, she noted that a more assertive posture is under review, while warning against „hysterical” reactions and urged Allies to „trust” in existing operational frameworks. The attribution problem is especially exposed when dealing with opaque actors, like the „shadow fleet,” which further complicates efforts to craft a fixed doctrine due to their dual-use nature.

A real shift or just rhetoric?

In an interview for Onet, Polish General Leon Komornicki said that „neither NATO nor Poland has a strategy for conducting symmetric retaliatory actions vis-à-vis Russia.” While Allied responses to date, particularly in the cyber domain, should not be dismissed, Admiral Dragone’s recent emphasis on a potentially more assertive posture seems far from becoming operational reality. Even if such measures do materialise, much of the action is still likely to unfold at the national level rather than within a coherent, NATO-wide framework.

This is not to suggest that a more proactive movement has been completely absent; the shift is underway, but its current materialisation is partial and slow. The missing piece of the puzzle is pace, which is inhibited by jurisdictional and operational hurdles. Without resolving these constraints, the Alliance risks ceding initiative to adversaries who are shaping the strategic environment faster than NATO can realistically respond.

Author: Karolina Kisiel