Changes from plenary report to adopted text

V. whereas national defence spending would benefit from increased coordination and pooling between Member States or further investment in European collaborative projects; whereas significant increases in Member States’ defence spending, in combination with the EU’s defence initiatives such as SAFE and other measures under the Defence Readiness 2030 framework, are beginning to address long-standing capability shortfalls, but a faster translation into concrete operational capabilities is needed to better protect the EU, its Member States and their citizens against hybrid threats; whereas in this area further potential remains for dual-use technologies; whereas further response is equally required in the area of internal security;

W. whereas responsibility for national security remains primarily with the Member States and any measures and initiatives coordinated or proposed at EU level must be framed and implemented in full respect of Member States’ exclusive competences and aligned with the EU Hybrid, FIMI and Cyber Diplomacy Toolboxes;

X. whereas the EU’s dependence on foreign actors and foreign-made technologies in critical infrastructure and supply chains, including the sourcing of raw materials from third countries, is one of the EU’s most significant vulnerabilities and a key challenge for European security and strategic autonomy;

Y. whereas the current security environment confronting the EU is characterised by neither peace nor open armed conflict, but phase zero warfare in which adversaries deploy hybrid instruments to exploit the gap between the EU’s peacetime governance structures and the decisiveness required to deter and respond; whereas existing EU foreign and security policy frameworks, calibrated for consensus-based deliberation, generate structural latency that adversaries actively exploit; whereas this in-between state demands a fundamental reassessment of EU decision-making architecture in the security and defence domain;

Z. whereas the credibility of deterrence rests not only on the material capabilities and technological edge of the European and allied forces, but decisively on political will, strategic cohesion and a common understanding of the threat; whereas Russia’s hybrid strategy is calibrated to erode precisely these qualities – through ambiguity, division and sub-threshold pressure – in order to degrade the credibility of collective defence commitments before any kinetic threshold is reached;

Hybrid warfare: between war and peace

1. Stresses that hybrid operations are deliberate, combined, intelligence-led and coordinated acts by states – including through non-state actors, intermediaries and proxies – spanning multiple domains simultaneously; stresses that they are designed to appear as isolated incidents and remain below the threshold of armed conflict, while having the potential to produce effects comparable to conventional aggression, thus making attribution and an effective response significantly harder; calls therefore on the EU and the Member States to recognise that hybrid acts can constitute a form of warfare regardless of whether conventional force is employed;

2. Underlines that the primary objective of hybrid warfare is to destabilise, divide and undermine the EU and its Member States by exploiting systemic vulnerabilities, and weakening their security, resilience and democratic foundations, and their defence readiness by disrupting the EU’s defence industrial base and critical infrastructure undermining public and political support for EU defence, and by strengthening political forces favourable to the perpetrators through systematic interference in democratic processes;

3. Affirms that Russia, acting directly or via multiple proxies such as Belarus, is the gravest hybrid-threat state actor targeting the EU and its Member States; notes that China, Iran, North Korea and others have been implementing hybrid campaigns aimed at undermining European democracies and eroding the EU’s security interests; underlines that the EU must adopt a comprehensive approach to hybrid threats that addresses not only Russian and Belarusian activities but also the growing strategic role of China, Iran and North Korea in enabling and amplifying hostile actions against European interests and security; notes with concern that non-state actors – including terrorist groups, organised crime networks, oligarchic and kleptocratic networks, religious institutions and faith networks, private military companies, extremist movements and influence-for-hire operators – may also conduct or enable hybrid campaigns against European democracies;

4. Calls on the Commission and the Council to assess the adequacy of existing EU legal frameworks for addressing hybrid threats, close identified gaps, and treat sub-threshold hybrid operations that cannot be addressed through law enforcement alone as collective security matters, requiring a combined civil-military response;

Information warfare, cognitive security and societal resilience

5. Underlines that information warfare is one of the core elements of hybrid warfare; expresses concern at the growing scale of cognitive warfare together with FIMI, which aims to erode societal trust in democratic institutions, increase polarisation, undermine democratic decision-making and public support for European security and defence, including support for Ukraine;

6. Highlights that the above-mentioned objectives (see paragraph 5) are predominantly being pursued through sophisticated and coordinated operations spanning multiple domains of social life and employing strategic cognitive and psychological techniques designed to shape decision-making processes, individual and collective perceptions, identity formation, cultural norms, historical memory, moral frameworks and religious belief systems, while exploiting technological infrastructure, media ecosystems and economic and political vulnerabilities; notes with concern that FIMI operations employ sophisticated cognitive-psychological methods, including reflexive control, which are difficult to detect, attribute or counter through conventional responses; stresses therefore that the EU FIMI toolkit must explicitly integrate countermeasures against such advanced influence techniques in order to safeguard the integrity of EU decision-making;

7. Warns that individual kinetic incidents may either trigger or be deliberately engineered to provide cover for immediate, synchronised and orchestrated FIMI operations, with hostile actors exploiting the gap before official statements are issued to shape public perception; calls for this information gap to be duly addressed through enhanced European coordination, in particular by improving public-private coordination in the information domain; stresses the need to develop common tools such as communication playbooks enabling faster, coordinated and accurate communication before hostile narratives saturate the information space;

8. Expresses concern about Russia’s use of historical revisionism, in particular regarding the Second World War and the Soviet legacy, FIMI, and the selective reinterpretation of historical events as tools of hybrid warfare aimed at polarising public opinion, undermining societal cohesion and democratic resilience, and delegitimising the territorial integrity of sovereign states;

9. Underlines that FIMI extends beyond traditional media into educational, cultural and religious domains; highlights the strategic use of religious institutions and faith networks, including the instrumentalisation of the Russian Orthodox Church, to project moral authority, disseminate state-sponsored narratives, and gradually undermine societal resilience and democratic cohesion; calls furthermore on the EU to detect hybrid threats exploiting religious channels, and train EU officials in interfaith engagement and religious literacy, and in the identification of financial influence, organisational capture and information manipulation that undermine democratic values and social cohesion;

10. Condemns the use of online platforms by hostile actors for hybrid activities; calls for stronger enforcement of existing EU rules on the transparency of recommendation systems, political advertising, coordinated inauthentic behaviour and the rapid dissemination of manipulated or AI-generated content linked to hostile foreign interference;

11. Underlines that hostile actors employ increasingly sophisticated and adaptive hybrid techniques; highlights that AI tools – deepfakes, algorithmic amplification and automated account networks – make influence operations faster, cheaper and harder to detect; considers that the EU response to AI-enabled FIMI must treat AI as both a threat vector and as a critical defence capability;

12. Notes that the EU’s response to FIMI remains reactive, lacking real-time monitoring, attribution and proactive response capabilities; insists that FIMI must be treated as a serious security threat requiring an operational approach, better coordination and cooperation between Member States at all levels, including early detection, adequate response options and stronger protection of democratic processes, particularly during electoral periods;

13. Welcomes the EEAS’s work in monitoring, detecting and responding to FIMI and underlines the relevance of the EU’s Rapid Alert System (RAS) for coordinated joint responses to disinformation; invites the Commission and the Member States to assess and build on the recommendations of the Special Committee on the European Democracy Shield (EUDS); calls for the RAS to be further strengthened to address information manipulation in real time with clear operational responsibilities; calls for standardised pre-bunking and rapid-response mechanisms across the EU and with partner countries, including structured early-warning communication channels; encourages the development of proactive strategic communication tools capable of warning populations in advance about anticipated disinformation tactics, narrative patterns and fabricated content ahead of critical events such as elections, energy negotiations or security crises;

14. Calls, furthermore, on the Commission, the High Representative and the Member States to fully operationalise and make consistent and coordinated use of the FIMI Toolbox and to apply the FIMI Deterrence Playbook, including through coordinated public attribution and, where appropriate, the use of restrictive measures, targeting not only individual incidents but the illicit financial flows, technical infrastructure, and intermediary and proxy networks that sustain FIMI operations;

15. Stresses that European public opinion remains a primary target of Russian hybrid operations; recalls that decades of peace have created conditions of strategic complacency that adversary influence operations exploit and deepen; considers that governments and EU institutions share responsibility to build public understanding of the nature and proximity of the hybrid threat, and that the failure to do so undermines preparedness and deterrence from within;

16. Calls on the Member States to adopt whole-of-government and whole-of-society approaches, prioritising resilience and preparedness as emphasised in the Niinistö report; recalls that hybrid threats target society as a whole, as hostile actors exploit vulnerabilities across interconnected domains, services, communities and information spaces; believes that trust and social cohesion are fundamental to societal resilience; underlines, therefore, that resilience against hybrid threats must extend beyond military, technical and institutional measures by bringing together public authorities, the private sector, civil society – including local communities and constituencies that are hard to reach – academia and independent media to strengthen democratic trust, public awareness and societal preparedness, thereby fostering a new European security culture;

17. Stresses the need to strengthen public resilience to FIMI through civic education, media literacy, strategic communications, support to independent media including investigative journalism, fact-checking networks such as the European Digital Media Observatory, and AI-enabled tools to detect and analyse disinformation campaigns at scale; calls for stronger cooperation with media and audiovisual actors in detecting, attributing and responding to FIMI; calls for incentivising, including through public-private initiatives, the detection, analysis and attribution of FIMI, secure data-sharing mechanisms and interoperable early-warning systems;

18. Expresses concern over continuous reports of foreign interference in European elections, including through cyberattacks and AI-enabled disinformation; recalls that the integrity and resilience of electoral processes are central to the EU’s democratic foundations and a key target of hybrid operations; underlines that FIMI tends to intensify before elections and that continued vigilance and coordination are therefore essential to safeguard electoral integrity and democratic stability across the EU and in partner countries, including candidate and potential candidate countries; welcomes the Joint Communication ‘European Democracy Shield: Empowering Strong and Resilient Democracies’ and the establishment of the European Centre for Democratic Resilience and calls for a clear definition of its tasks to avoid duplication with existing initiatives;

19. Calls for recognising and addressing cognitive vulnerabilities in the context of hybrid warfare in the upcoming EU security strategy and for the Commission to take further steps by providing cognitive vulnerability mapping and resilience benchmarks;

Cybersecurity

20. Stresses that cyberattacks have become a central element of hybrid campaigns, exploiting the increasing digitalisation of critical sectors such as healthcare, finance and energy, causing cascading disruptions with potentially severe economic and societal consequences;

21. Notes that cyberspace has become established as the fifth military domain and as a central enabler of hybrid threats; underlines that the growing dependence of military platforms, critical infrastructure and command, control, communications and intelligence systems on digital technologies makes cybersecurity essential to operational superiority and resilience across all domains; stresses, therefore, the need for sovereign cyber capabilities for detection, attribution, response and intelligence, including offensive capabilities to neutralise threats and ensure credible deterrence;

22. Underlines the convergence between FIMI and cybersecurity, noting that cyberattacks often occur at the early stages of FIMI campaigns; calls for counter-FIMI mechanisms to be systematically connected with cybersecurity capabilities in order to detect, attribute and disrupt coordinated manipulation infrastructure at an early stage;

23. Warns of the risks posed by convergent cyber operations, in which state-aligned actors actively adopt the operational profiles, methodologies and personas of independent hacktivists or commercially motivated cybercriminals to conceal attribution and align cyber activity with geopolitical events, elections or kinetic operations; stresses that responses to hybrid cyber threats must clearly distinguish between legitimate forms of political expression or civil dissent and financially motivated cybercrime and state-sponsored operations, so as to protect fundamental freedoms while improving attribution, accountability and deterrence;

24. Warns that the expansion of the Internet of Things increases the risk that cyberattacks generate physical effects in critical infrastructure and essential services, and calls for security-by-design obligations to ensure connected devices do not become entry points for hybrid operations with real-world consequences;

25. Warns that full cyber protection does not exist and that a shift in mindset towards cyber resilience is needed; stresses that Europe’s cyber resilience must be built up through frequent and realistic cyber exercises; underlines that cyber resilience not only concerns systems, but also data protection, which is both a target and an enabler of hybrid threats; underlines further the need to strengthen cyber resilience across the European economic fabric, including small and medium-size enterprises (SMEs) and providers of essential digital services;

27. Calls for greater harmonisation of incident-reporting obligations and key legal concepts across EU cybersecurity and resilience frameworks, to reduce fragmentation, improve interoperability and ensure that rapid restoration of essential services remains a central priority in hybrid crisis scenarios;

28. Recognises the EU Cybersecurity Reserve, managed by the European Union Agency for Cybersecurity (ENISA) under the Cyber Solidarity Act, as a strategic EU cyber rapid-response capacity; calls for its funding to be adapted to operational demand and highlights its first deployment in Moldova as an important step in strengthening the EU’s operational cyber resilience and support to partner countries; calls on Member States’ cybersecurity authorities to foster structured cooperation with the Reserve’s trusted providers to make full use of available incident response capabilities when hybrid threats materialise through significant or large-scale cyber incidents;

29. Reaffirms the importance and calls for adequate EU resourcing of the PESCO Cyber Rapid Response Teams as a standing cyber defence capability, deployable upon request from Member States, partner countries and common security and defence policy (CSDP) missions facing cyber attacks with implications for security and defence;

30. Reiterates the importance of making full use of the Cyber Diplomacy Toolbox to prevent, deter and respond to cyber threats and malicious cyber activities; takes note of the launch in March 2026 of the first permanent UN Global Mechanism on cybersecurity, and believes that the EU should focus on areas where there is clear European added value while further strengthening European cyber diplomacy;

32. Warns in this regard that AI is not only a tool used in hybrid cyber activities, but is also a critical technology that can itself be targeted, manipulated or compromised through prompt injection, training data poisoning and supply-chain attacks; stresses that, given the growing reliance on commercial and dual-use AI systems in civilian, security and defence contexts, the EU must develop a clear position on the cybersecurity, resilience and governance of dual-use AI, including safeguards for model integrity, trusted supply chains and oversight at the boundary between civilian, defence and national security applications;

33. Stresses the need for increased protection of critical public digital infrastructure and sensitive state-managed data registers, including electoral infrastructure, as they form potential targets of hybrid threats, given their role in digital identity, public administration, data governance, secure communications, access to essential services and the integrity of democratic processes;

Critical infrastructure

34. Condemns the hybrid attacks targeting the EU’s critical infrastructure – in particular energy, transport, communications and satellite infrastructure, including that for military mobility – both critical enablers and strategic assets for the EU’s collective defence, resilience and civilian protection; highlights that this critical infrastructure performs as an interconnected system that cannot be protected in isolation, and that greater digital connectivity increases vulnerability; welcomes the focus on the protection and resilience of energy and military mobility infrastructure in the Commission proposal for a regulation on military mobility (COM(2025)0847) and the Commission proposal for guidelines for trans-European energy infrastructure (COM(2025)1006); calls on the Commission and the Member States to take all necessary measures to ensure its protection;

35. Underlines that the space domain has become an increasingly important arena for hybrid warfare, with hostile actors targeting satellite-based communications, navigation and observation systems through cyber operations, physical attacks, jamming and spoofing or the exploitation of strategic dependencies; stresses that disruption of space assets can have significant consequences for the EU’s civil security, critical infrastructure, military mobility and crisis-response capabilities; calls, therefore, for stronger resilience of EU space systems, including increased space situational awareness, protection of ground infrastructure, cybersecurity requirements, supply-chain security, regular exercises and alternative or backup positioning, navigation and timing (PNT) capabilities; calls further for the integration of the space domain into the EU’s broader framework for countering hybrid threats;

36. Notes that hostile actors, mainly Russia, are increasingly weaponising energy infrastructure, energy markets and energy dependencies to exert political pressure; emphasises the strategic importance of critical energy infrastructure for both defence and civil needs; urges the Commission and the EU Member States to establish an EU legal and financial framework under the next multiannual financial framework 2028-2034 that would ensure sufficient protection and resilience of critical energy infrastructure, prioritising Commission proposals for guidelines for trans-European energy infrastructure (COM(2025)1006) and the Connecting Europe Facility (COM(2025)0547);

37. Condemns Russia’s shadow fleet activities that increase the risk of maritime accidents, conceal state-linked sabotage, and jeopardise critical infrastructure such as undersea cables, offshore energy installations and port facilities; calls for enhanced monitoring, inspection and enforcement measures in European waters and for the EU to step up its response to hybrid threats in maritime zones; encourages the Commission to explore – drawing on the Proliferation Security Initiative as a model – legal and operational frameworks to enable the boarding of vessels linked to shadow fleets, and calls on the Financial Action Task Force to further examine the role of opaque ownership structures, flag registries and associated financial networks in facilitating the circumvention of sanctions and illicit financial flows;

42. Expresses concern over foreign ownership of critical infrastructure in the EU, in particular by Russia and China, which greatly increases the risk of espionage and interference and strategic dependence; welcomes the political agreement reached between Parliament and the Council on a strengthened EU foreign direct investment (FDI) screening mechanism; calls on the Member States to rapidly implement this regulation, complemented by a ‘Buy European’ approach, where possible, for critical infrastructure and defence equipment with a view to strengthening the EU’s strategic autonomy;

43. Recognises that a significant share of critical infrastructure linked to essential public services and military capabilities is privately owned or operated; calls for permanent and structured public-private cooperation frameworks, including for information sharing, contingency planning and coordinated crisis response; stresses that, where private infrastructure supports essential services and sensitive data, public authorities must ensure effective regulatory and operational control; calls for defence requirements to be systematically integrated into civilian infrastructure planning, design and funding; insists that EU-funded infrastructure must comply with defence-relevant resilience standards as a condition for EU support; calls furthermore for defence technology developers and security providers to be systematically involved in the early phases of critical infrastructure threat assessment and contingency planning, ensuring that available technological capabilities are reflected in national and EU resilience frameworks; recognises the contribution of SMEs, start-ups and innovative technology providers to the resilience and protection of critical infrastructure and calls for their increased participation in relevant EU programmes, procurement schemes and public-private partnerships;

44. Calls on the Member States to conduct regular preparedness and resilience exercises for critical infrastructure, including joint exercises, and urgently deliver the priority capabilities identified in the White Paper for European Defence, in particular air and missile defence, drones and counter-drone systems, military mobility, cyber, and electronic warfare and maritime capabilities;

45. Is concerned about the EU’s structural dependence on high-risk non-EU countries, particularly China, for the supply of network-connected hardware and software assets, such as solar inverters, wind turbines, connected vehicles, and consumer digital devices, that can access, transmit or control systems remotely and therefore form a significant vulnerability; calls on the Commission to extend supply chain security assessments systematically, across all critical infrastructure sectors, and to accelerate efforts to reduce strategic dependencies; calls on the Member States to follow up on these assessments, diversify supply chains and prioritise European and like-minded suppliers in strategic sectors whenever security considerations so require; welcomes the fact that the proposed revision of the Cybersecurity Act aims to provide a framework to ban network-connected components from high-risk suppliers, and that the Strategic Roadmap for Digitalisation and AI in the Energy Sector – as part of the European Technological Sovereignty Package – provides for a review of the energy security-of-supply framework; calls for these measures to be adopted swiftly;

46. Stresses the importance of diversifying supply routes through secure and resilient transport networks with trusted partners in order to reduce strategic dependencies and strengthen the EU’s economic security and supply chain resilience;

47. Stresses that critical and emerging technologies – including AI, cloud infrastructure, advanced semiconductors, quantum technologies, cyber, space, autonomous systems and secure communications – are part of the EU’s critical security infrastructure given their essential role in defence readiness, economic resilience and operational continuity; considers a resilient, competitive EU digital infrastructure – including secure local data centres, sovereign EU cloud, edge computing, and gigabit networks – an important pillar of European security; stresses that the EU’s ability to detect, withstand and respond to hybrid campaigns depends on its capacity to develop, secure and scale these technologies within a resilient European industrial and technological base supported by sufficient EU investment, including investment in secure, interoperable and resilient information-sharing systems and local data centres not subject to extraterritorial legislation;

Situational awareness

48. Stresses that effective countering of hybrid threats requires prevention, early threat anticipation, and continuous monitoring of strategic vulnerabilities to neutralise hostile actions before they have systemic effects and a shared threat picture, as targeted sectors cannot respond effectively on the basis of isolated incident reports; highlights in this regard the EU’s potential unique added value in aggregating cross-border data to detect patterns of coordinated hybrid campaigns that no Member State can identify on its own, as well as in coordinating the development of procedures for joint situational awareness and attribution, common frameworks, methodologies, taxonomies and interoperability protocols between EU and national relevant bodies and structures that would support operational cooperation between the Member States; calls for these functions to be formally recognised as EU coordination and support competences;

49. Notes that the EU Hybrid Fusion Cell within the Single Intelligence Analysis Capacity (SIAC) remains the EU’s central body of exclusive expertise on all-sources analysis of hybrid threats providing intelligence-based situational awareness; reiterates that SIAC should be the single hub for intelligence in the EU institutions and underlines its special status within the EU security architecture; endorses the Hybrid Trend Analysis as a key tool for analysing hybrid threats and detecting patterns, and its proper involvement in the policymaking processes;

50. Recalls the lack of progress in fulfilling the goal set out in the Strategic Compass and the Joint Paper by the High Representative and the Member States on Strengthening the EU Single Intelligence Analysis Capacity (EEAS(2024)2014), to strengthen SIAC by providing additional resources to compile, analyse and integrate relevant information in order to produce and facilitate efficient provision of intelligence in the areas of cyber and hybrid threats posed to the EU; calls on the Commission, the High Representative and the Member States to make a firm commitment to the effective strengthening of SIAC;