NATO conscripts industry to fight Russia’s hybrid aggression

NATO is moving to disrupt Russia's hybrid attacks before they land by bringing in private companies and military assets to counter everything from sabotage to drone incursions, a key strategist at the alliance told POLITICO.

“The aim of it is to stop playing whack-a-mole,” James Appathurai, NATO’s deputy assistant secretary general for innovation, hybrid and cyber, said in an interview.

“Russia’s hybrid campaign is substantial, growing and not going to stop, regardless of what happens in Ukraine,” he said.

Europe has for years faced cyberattacks, disinformation campaigns and acts of sabotage and disruption, in what Western security officials describe as a hybrid war coordinated by Moscow. Recent drone incursions on Europe's eastern border and GPS jamming incidents have pushed European governments to come up with a stronger response.

The alliance is rolling out a hybrid strategy adopted last year. It is setting up partnerships with private companies — from cyber firms to utility providers — to better feed militaries' monitoring of hybrid threats. The bulkier response to hybrid threats is likely to feature in discussions when leaders meet in Ankara next month for the annual NATO Summit.

Officials have warned that Russia is growing more brazen in how it targets Europe. Moscow is “willing to risk the lives of our citizens," Appathurai said, referring to a wiper attack in Poland in Dec. 2025 that targeted more than 30 wind and solar farms and a major heat and power plant serving nearly half a million people.

NATO jets recently brought down a drone that entered Latvian airspace. The alliance last month also set up partnerships with cybersecurity leaders Microsoft, Palo Alto Networks and ESET in May to help defend its networks against hackers. And last year, NATO sent warships and aircraft to the Baltic Sea after a string of suspected attacks on undersea cables, under the banner of operation "Baltic Sentry."

The alliance is also moving deeper into the energy sector, sharing threat intelligence with oil and gas companies as drone incursions around offshore energy infrastructure continue, said Appathurai. "We are already plugging their sensors into our military headquarters, we're exercising together ... and agreeing on long-term plans with regard to their security."

The same applies to data centers. NATO is working with major U.S. cloud providers to help protect critical digital infrastructure while building its own secure, air-gapped cloud network. The aim is simple: making sure NATO can keep operating even if a critical system goes down — or if support from the United States becomes harder to count on, Appathurai said.

"Even if push came to shove ... that for some reason support from the U.S. got degraded, you could design the system to have enough redundancy," he said.

Hybrid warfare encompasses a range of hostile activities that fall short of conventional military conflict. Security officials have pointed to cyberattacks, online influence campaigns, sabotage, disruptions to undersea cables, interference with navigation systems, vandalism aimed at stoking political tensions, and even the coordinated movement of migrants as examples of Russia's hybrid operations.

For years, Western governments' response to hybrid threats rested on deterrence. The thinking was that publicly attributing cyberattacks, imposing sanctions and strengthening collective resilience would dissuade adversaries from escalating. But repeated cyberattacks, infrastructure sabotage and influence campaigns linked to Russia have challenged that thinking, with governments increasingly pivoting to active defense measures.

Unlike traditional military operations on land, at sea or in the air, hybrid attacks often unfold in the shadows, making it far harder to prove who is behind them and what they intended to achieve. NATO has previously refrained from attributing these attacks to specific countries, instead voicing support when member countries linked disruptions to Russian and Chinese state-backed actors.

The alliance's hybrid strategy will help NATO and private partners piece together the full scope of hybrid activity across its territory instead of lurching from crisis to crisis, Appathurai said.

“If there’s one derailment of a train in the Netherlands or one arson attack at a factory, it might just be arson or derailment,” he said. “But if you see seven, all related to support to Ukraine, then you know who’s behind it.”