Changes from report parliamentary committee draft to plenary report

Change 14

AddedEXPLANATORY STATEMENT

AddedA war that does not look like war

AddedThe European Union today is neither at peace nor in open armed conflict. Adversaries operate deliberately in the grey zone, below the threshold of an armed attack. Hybrid operations are not random incidents. They are combined, intelligence-led and coordinated acts, carried out by states — including through proxies, intermediaries and non-state actors — designed to appear as isolated events, while producing effects comparable to conventional aggression. Their ambiguity is by design: it makes attribution harder and slows our response. This report starts from a simple but consequential premise: hybrid acts can constitute a form of warfare regardless of whether conventional force is used. The security environment we face is not peace, but a kind of “zero-stage” warfare in which adversaries exploit the gap between our peacetime governance structures and the speed a real response demands.

AddedWho is behind it

AddedRussia — acting directly or through Belarus and other proxies — is the gravest hybrid threat facing the Union and its Member States. China, Iran and North Korea are also developing hybrid campaigns. Non-state actors — organised crime, kleptocratic networks, private military companies, faith networks and influence-for-hire operators — may conduct or enable them as well. The report therefore calls for a comprehensive approach that addresses Russian and Belarusian activity while recognising the growing role of China, Iran and North Korea.

AddedThe main battlegrounds

AddedInformation and cognitive warfare. Foreign information manipulation and interference (FIMI) is a core element of hybrid warfare, aimed at eroding trust in democratic institutions, deepening polarisation and undermining support for European defence — including support for Ukraine. These campaigns increasingly use sophisticated cognitive-psychological methods and are amplified by AI-generated content, deepfakes and automated networks. Our response remains too reactive; the report insists FIMI be treated as a serious security threat, with real-time detection, attribution and proactive response, and that societal resilience — media literacy, independent journalism, civic preparedness — be treated not as a secondary concern, but as a central pillar of security.

AddedCybersecurity. Cyberspace is now the fifth military domain and a central enabler of hybrid campaigns. The report stresses that full cyber protection does not exist, and that Europe must shift its mindset towards resilience — trained through frequent, realistic exercises and extended across the whole economic fabric. But it is equally clear that resilience and defence alone cannot deter hostile actors: it therefore calls for sovereign cyber capabilities — for detection, attribution and response, including offensive capabilities — and, in cooperation with NATO, for work on the prerequisites for proportionate, lawful cyber countermeasures to ensure credible deterrence. It warns that AI is now both a weapon and a target.

AddedCritical infrastructure. Energy, transport and communications are both critical enablers and strategic assets for the Union’s defence, resilience and civilian protection, and they are increasingly the target of hybrid attacks. This infrastructure forms an interconnected system that cannot be protected in isolation, and greater connectivity increases its vulnerability. The report condemns the hybrid attacks targeting it and calls for reduced reliance on high-risk suppliers, stronger investment screening and full implementation of existing resilience law (CER Directive, NIS2), and the protection of the space domain. It also calls on Member States to embed resilience by design as a standard requirement in all new and revised legislation.

AddedFrom fragmentation to a decisive response

AddedThe central argument of this report is that the Union must move from a reactive to a proactive posture, to be able not only to withstand hybrid attacks, but also to deter and respond to them. That starts with a shared threat picture: no single Member State can detect coordinated campaigns alone, which is why the report urges Member States to increase intelligence sharing through the EU’s Single Intelligence Analysis Capacity (SIAC), and calls for the EU’s role in aggregating cross-border data and coordinating common procedures for situational awareness and attribution to be formally recognised as EU coordination and support competences. On this basis, the report calls for a cross-domain action plan against hybrid warfare and a single point of coordination between the Commission and the EEAS — and insists that any violation of a Member State’s sovereignty be met with an effective, proportionate and coordinated response, including calibrated retaliatory options. It presses for every accountability tool to be used, including a dedicated horizontal sanctions framework for hybrid threats and action against the illicit financial flows that fund attacks on our democracies. And it urges advancing towards a genuine European Defence Union as a stronger European pillar of NATO, with the mutual defence clause (Article 42(7) TEU) operationalised for severe hybrid scenarios. It is equally clear about the limits: national security remains primarily a Member State responsibility, and a stronger EU role must respect exclusive competences and the protection of classified information.

AddedGeographical considerations

AddedHybrid threats affect the whole Union but take different forms across regions. The report condemns Russia’s drone incursions and provocations along the Eastern Flank and calls for dedicated funding to protect the EU’s external borders, while maintaining a 360-degree approach that recognises the distinct vulnerabilities of the Baltic, Nordic-Baltic, Black Sea, Mediterranean, south-eastern and Arctic regions. It strongly condemns the instrumentalisation of migration by third countries and hostile non-state actors to destabilise a Member State or put pressure on the Union, and notes the announced revision of the Frontex mandate as an opportunity to strengthen the EU’s response to hybrid threats. It stresses that funding should follow strategic exposure and demonstrated need, while ensuring support for all regions facing hybrid threats.

AddedWorking with allies and partners

AddedNATO remains the cornerstone of collective defence for its members, and the report calls for EU-NATO action that is complementary, mutually reinforcing and operationally coordinated. It supports deeper cooperation with Ukraine, Moldova, Armenia and the Western Balkans — front-line testing grounds for Russia’s tactics, and sources of learnt lessons — and with like-minded partners including the United Kingdom, Norway, Canada, Japan, Korea, Australia and Taiwan, . It highlights in particular Taiwan’s whole-of-society resilience model as one the EU can learn from.

AddedWhy this matters now

AddedThe credibility of deterrence rests not only on capabilities, but on political will, cohesion and a shared understanding of the threat — precisely the qualities Russia’s hybrid strategy is designed to erode before any military threshold is reached. Building public understanding of how close and how real this threat is itself a matter of preparedness and deterrence. This report is intended as a step towards that clarity — and towards a Union able to defend not only its territory, but the democratic foundations on which its security depends.