NATO's gray-zone pivot: SACEUR signals a more proactive response to hybrid attacks

From counter-UAS to public attribution, the Alliance weighs how to impose costs without blurring its defensive identity

On December 4, NATO's Supreme Allied Commander Europe, Gen. Alexus Grynkewich, told reporters that hybrid threats are "a real issue" and warned the Alliance must prepare for more. Speaking at NATO's military headquarters in Mons, Belgium, the U.S. Air Force general went further: he called for naming perpetrators publicly and suggested NATO should "provide dilemmas" to adversaries—language that signals a shift from passive resilience toward selective, proactive disruption. While he was careful to reaffirm NATO's defensive mandate, his remarks mark the clearest articulation yet of a gray-zone pivot, acknowledging that deterrence-by-denial alone is no longer enough.

The timing is no accident. Across Europe in 2024 and 2025, suspected Russian hybrid operations have accelerated: railway sabotage in Poland, arson attempts targeting defense facilities, GPS jamming near airports, drone incursions over critical infrastructure, and persistent cyberattacks. These incidents sit below the threshold of armed attack but above the level of tolerable friction. Grynkewich's call reflects a growing consensus within NATO and EU circles that ambiguity—the lifeblood of hybrid warfare—must be met with clarity, speed, and consequences.

The pattern NATO is confronting

Hybrid threats, as Grynkewich defined them, span cyberattacks, disinformation, infrastructure sabotage, drone operations, and irregular proxies. The incidents over the past eighteen months form a consistent pattern attributed by European officials to Russia. In Poland, suspected sabotage of rail infrastructure prompted the government to activate approximately 10,000 personnel to guard critical sites, as Crisis.Zone previously reported. Drone incursions have disrupted airports across Denmark, Norway, Belgium, and Germany, exposing persistent airspace vulnerabilities. Undersea cable damage, arson plots, and coordinated disinformation campaigns complete the portfolio.

These operations exploit three strategic advantages: deniability, speed, and the difficulty of collective response. Individual member states often bear the cost and uncertainty of attribution, while NATO's consensus-driven decision-making can lag behind events. Grynkewich's emphasis on public attribution is designed to reverse that dynamic, turning ambiguity into a liability for attackers.

What NATO has built—and why it's not enough

Since Russia's annexation of Crimea in 2014, NATO has elevated hybrid threats to a strategic priority. The Alliance adopted its first Counter Hybrid Strategy in 2015, anchored in three pillars: prepare, deter, and defend. In 2016, Allies acknowledged that hybrid actions could, on a case-by-case basis, trigger Article 5 collective defense. After Russia's full-scale invasion of Ukraine in 2022, NATO accelerated practical measures: cyber defense exercises, deployment of counter-unmanned aircraft systems like the AI-powered Merops platform to frontline allies, and deeper cooperation with the EU through the European Centre of Excellence for Countering Hybrid Threats in Helsinki and the Strategic Communications Centre of Excellence in Riga.

In November 2025, Allied experts met in Oslo to advance a revised Counter Hybrid Strategy focused on protecting critical infrastructure and deepening private-sector partnerships. Yet the campaign continues to outpace institutional response. Italy's defense minister, Guido Crosetto, proposed a dedicated 5,000-strong hybrid force and a command hub. NATO has deployed AI-powered counter-drone systems on the eastern flank, but coverage remains uneven. Grynkewich's call for readiness acknowledges this gap: capabilities exist, but they are not yet scaled, integrated, or authorized to operate at the speed and scope required.

Exclusive Analysis Continues:

Members are reading: How NATO plans to disrupt hybrid networks preemptively while staying within its defensive mandate and political consensus.

Become a Member for Full Access

Guardrails and escalation risks

The shift carries real risks. Attribution, while powerful, can be politicized if intelligence is overreached or selectively disclosed, fracturing Alliance unity. Escalation management is a live dilemma: shooting down drones over civilian areas or responding to cross-border incidents risks normalization of kinetic responses in the gray zone. Legal thresholds matter. Most hybrid actions sit below Article 5; treating them as existential threats could devalue the Alliance's core guarantee. Restraint and proportionality must govern every step.

Public attribution, Grynkewich's emphasis, serves as much as a unity signal as a deterrent. By naming adversaries collectively, NATO denies hybrid actors the strategic benefit of ambiguity and forces member states to align their messaging, evidence standards, and response options. The challenge is maintaining that coherence across 32 sovereigns with different threat perceptions and political calendars.

What comes next

The revised Counter Hybrid Strategy, expected to be finalized in 2026, will test whether NATO can institutionalize this pivot. Key milestones include defining rules of engagement for airspace violations, scaling counter-UAS deployment across the eastern flank, and building joint EU-NATO attribution practices that balance speed with rigor. Industrial capacity for rapid infrastructure repair, legal frameworks for cross-border evidence-sharing, and integration of private-sector operators into resilience planning will determine whether "proactive" becomes operational reality or rhetorical aspiration.

Grynkewich's remarks reflect a sober recognition: hybrid threats will not abate, and resilience alone invites escalation through incrementalism. The question is whether NATO's consensus culture can move fast enough to impose meaningful costs without losing its defensive legitimacy. The answer will shape the security architecture of Europe's next decade.