Europe Still Treating Symptoms, Not the System

Hybrid threats have long since ceased to be a set of individual attacks. They work as a single mechanism that exploits the weaknesses of the European information environment itself. While Brussels continues filing threats by category, the adversary acts at multiple levels simultaneously.

In a Carnegie Europe paper entitled Assessing Information Ecosystems: How Governments Can Get Ahead of Hybrid Threats, analyst Raluca Csernatoni and Alicia Wanless, director of the Information Environment Project, propose abandoning the habitual hybrid approach. In their opinion, the very notion of ‘hybrid threats’ now obscures more than it clarifies, confusing deliberate attacks, business negligence and systemic drift of institutions. As a result, European governments set up separate offices for hybrid threats that lack the capacities and authority required for genuine coordination.

The authors show that the key issue lies deeper. European information ecosystems are complex systems where humans, technologies, infrastructure, institutions, and incentives are in constant interaction. Not all vulnerabilities are exogenous. There are domestically produced ones: concentrated media ownership, algorithmically amplified polarization, hollowed-out local journalism, and dependence on foreign clouds and satellites. In exploiting these weaknesses, the adversary just accelerates a process that has already started.

Recent years’ examples are particularly illustrative of this. The sabotage of cables in the Baltic Sea, drone incursions into EU airspace, navigation spoofing, pressure via platforms, and the annulment of the elections in Romania all look like isolated incidents. But in fact they amount to probing the seams of a single ecosystem. In March 2026, the EU Council adopted wide-ranging conclusions on hybrid threats that referred to dozens of instruments. Yet those documents still lack a strategic logic that would bind together infrastructure, information, economics, and trust.

The authors propose switching to an ecosystems approach: regular analysis of national information environments, creating cross-domain response protocols, and treating technological sovereignty as a matter of democratic governance, not just industrial policy. This looks convincing on paper. In practice, Europe continues moving in the opposite direction as it multiplies instruments and keeps its institutions fragmented.

An additional complexity is that many threats are now being amplified by artificial intelligence. Generative AI systems can already scale the production of synthetic content, while agentic tools enable more adaptive and semiautonomous campaigns. European institutions that work at human pace are increasingly unable to comprehend developments – to say nothing of preventing them. And domestic vulnerabilities – platforms’ business incentives, disrupted local media and erosion of institutional trust – are still being reproduced by European societies themselves.

Another important point is that the ecosystems approach distinguishes among three problems. The first one is deliberate aggression. The second problem is carelessness or commercial greed of companies that leave systems vulnerable. The third issue is system drift, with no one specifically to blame but the whole framework gradually degrading. Hybrid language mixes them all up. As a result, ordinary market logic comes to be perceived as a security threat, and true hostile acts dissolve in overall noise.

So long as the European institutions treat individual symptoms rather than address the whole system’s condition, the hybrid threats will only exacerbate. And the longer Brussels delays genuine coordination, the higher price every new disruption will charge. At some stage, the fragmented instruments will no longer create even an illusion of control. It will then transpire that Europe has spent years categorizing threats – but has never learned to manage the environment that gave rise to those threats.

Original publication: https://carnegieendowment.org/europe/research/2026/07/assessing-information-ecosystems-how-governments-can-get-ahead-of-hybrid-threats