Are you addressing geopolitics and hybrid threats? You will!

Cyberspace can no longer be understood merely as the technical backbone of digital services. It has progressively evolved into a fully-fledged domain – a digital environment in which states pursue and project their geopolitical interests. Instead of traditional military operations, cyber instruments are increasingly employed to weaken adversaries without direct confrontation. This shift fundamentally transforms how security and conflict are conceptualized.

Alliances such as NATO now openly declare that a significant cyberattack may constitute grounds for invoking collective defense. This stance underscores the growing importance of cyberspace in strategic planning. At the same time, however, the issue of attribution remains a critical challenge, as identifying the true perpetrator is often both technically and politically complex.

Hybrid threats in practice

Hybrid threats represent a combination of multiple vectors and forms of influence that interact and reinforce one another. In this context, a cyberattack is not an isolated incident but part of a broader operation encompassing informational, technological, and psychological dimensions. The objective is not solely to disrupt technical systems, but primarily to shape perceptions of reality and influence decision-making – whether targeting individuals, specific groups, or segments of society.

A salient example is the Russo-Ukrainian War, where cyber operations are systematically integrated with disinformation campaigns. This approach enables the pursuit of strategic objectives without the need for full military dominance, often aiming instead at internal destabilization.

Disinformation as an instrument of influence

The information environment has become a critical arena in which the struggle for attention, trust, and the interpretation of reality unfolds. Social platforms such as Meta Platforms and X Corp. play a significant role in content dissemination, with their algorithms frequently prioritizing emotionally charged and polarizing material. This dynamic creates optimal conditions for disinformation campaigns.

Rather than attempting to persuade audiences of a single "truth," actors seek to saturate the information space with a multitude of conflicting narratives. The result is an erosion of trust in institutions, media, and even in objective facts themselves. Society becomes increasingly polarized and, consequently, more susceptible to further forms of manipulation.

Critical infrastructure under pressure

Critical infrastructure constitutes one of the most vulnerable targets of cyber operations. Energy grids, healthcare systems, transportation hubs, and financial institutions form the backbone of modern states, and their disruption can produce immediate and far-reaching consequences. Cyberattacks in this domain frequently target systems that were not originally designed with security as a primary consideration.

Their vulnerability is further amplified by their complexity and interconnectedness. An attack on a single segment can trigger cascading effects across multiple sectors. As a result, there is an increasing emphasis on coordinated protection and close cooperation between public and private stakeholders.

State or non-state actor?

Cyberspace is characterized by a diverse range of actors. In addition to states, these include cybercriminal groups, hacktivists, and various proxy organizations. The distinctions between them, however, are becoming increasingly blurred, as states often leverage non-state entities to conduct operations on their behalf.

Collectives such as Anonymous exemplify ideologically driven activities, whereas state-sponsored groups pursue strategic objectives. The convergence of these spheres complicates attribution and undermines the effectiveness of traditional security mechanisms. Identifying the true intent in the early stages of an attack is particularly challenging, as financially or otherwise motivated actors may significantly alter their behavior and target selection compared to prior patterns.

Artificial intelligence reshaping the landscape

The advancement of artificial intelligence is introducing profound changes to the field of cybersecurity. Adversaries can leverage AI to automate attacks, generate highly convincing disinformation, and identify vulnerabilities more efficiently. These technologies lower the barrier to entry and enable the execution of sophisticated operations at scale.

At the same time, AI enhances defensive capabilities. Modern security systems can more rapidly detect anomalies and respond to incidents. The result is a dynamic contest between attackers and defenders, in which technological superiority plays a decisive role. It is reasonable to anticipate a level of automation in both offensive and defensive operations at which human operators will no longer be able to effectively monitor or manage engagements in real time, shifting the burden almost entirely to automated processes.

Protecting democratic processes

Democratic processes – particularly elections – are increasingly frequent targets of hybrid operations. Adversaries focus not only on the technical manipulation of electoral systems, but primarily on shaping public opinion. The objective is to erode trust in the process itself, thereby undermining the legitimacy of its outcomes.

Even without direct interference in vote counting, the result can be destabilizing if public confidence in the fairness of the process collapses. This makes information operations an exceptionally potent instrument.

A key question remains whether societies possess sufficient capacity and expertise to recognize that information emerging suddenly and unexpectedly may be manipulated or deliberately tailored. Strengthening societal resilience requires greater emphasis on adopting tools capable of detecting disinformation. Such tools are likely to become an integral component of endpoint protection solutions – for example, as modules embedded within antivirus software.

The future of conflict in the digital era

Trends indicate that future conflicts will integrate both conventional and digital modes of warfare. Cyber operations may function as a precursor to physical conflict or as a force multiplier alongside it. At the same time, they may unfold independently – without escalating into open warfare – particularly when aimed at reshaping the cognitive and perceptual frameworks of a target society.

International organizations such as the United Nations are working to establish regulatory frameworks for cyberspace. However, the pace of technological advancement continues to outstrip legislative and diplomatic processes, creating a persistent governance gap.

Adversaries are increasingly deploying artificial intelligence without ethical constraints, underscoring the need for robust and adaptive response capabilities. Societies must be prepared to confront novel, unexpected, and potentially disruptive information operations, including those that may never be conclusively verified.

How do we proceed?

Geopolitics in cyberspace is fundamentally reshaping both the nature of security threats and the speed at which risks materialize. Hybrid operations demonstrate that modern conflicts are no longer confined to physical battlefields but extend deeply into digital and informational environments. The ability of states and societies to anticipate, withstand, and respond to these threats will be critical to their stability and security in the decades ahead.

Hybrid threats affect all of us. Effective preparedness requires strengthening critical thinking, increasing individual awareness of cybersecurity risks, and developing the capacity to work with artificial intelligence – leveraging it not only for detection of disinformation, but also as a tool for personal and collective resilience.