Policing the Grey Zone

Introduction

This publication explores the phenomena of grey zone and hybrid threats that confront many states and societies today. While definitions vary, the ‘grey zone’ is defined here based on the understandings of NATO and Western security actors as a form of political warfare (Irdi 2025), comprising activities that fall below the threshold of conventional armed conflict, yet which aim to exploit features of the targeted state and society in a manner that undermines their security and cohesion. Grey zone threats to Western states involve attempts to exploit and damage their open societies, economies, and public perceptions of safety, security, and the legitimacy of governance systems and political authority. Critical infrastructure, legal systems, electoral systems, markets, information and public opinion are frequent targets of such attacks. NATO identifies hybrid threats, or hybrid methods of warfare, as activities undertaken by both state and non-state actors to ‘target political institutions, influence public opinion and undermine the security of NATO citizens’ (NATO 2024). Activities may occur within or across diverse domains — political, economic, societal– and are ‘facilitated by rapid technological change and global interconnectivity’ (NATO 2024). Similarly, the European Centre of Excellence on Countering Hybrid Threats defines hybrid threats as ‘coordinated and synchronised action that deliberately targets democratic states’ and institutions’ systemic vulnerabilities through a wide range of means’ (ECoE n.d.). Hybrid threats encompass a diverse range of activities, including propaganda and disinformation campaigns, deception, election interference, economic sabotage and coercion, and critical infrastructure attacks. These share the common objective of exacerbating divisions within democratic societies and eroding their institutions and social cohesion over time (Irdi 2025).