NATO Signals Its Response To Russian Hybrid Attacks May Happen Out Of Public View
NATO Says Some Responses To Russian Hybrid Attacks Will Remain Secret
NATO’s Invisible Response To Russian Hybrid Attacks
Mark Rutte says NATO has public, private, symmetric and asymmetric options as Russia’s pressure campaign tests the line between sabotage, cyber operations and open military conflict.
NATO Secretary General Mark Rutte has delivered a deliberately ambiguous warning to Moscow: if Russia carries out hybrid attacks against the alliance, the response may not be visible to the public.
Rutte said NATO has “all the response options” it needs and that the alliance can decide how to react “at a time of our choosing” and in the manner likely to have the greatest effect. Some responses, he said, may be public. Others may be asymmetric or invisible.
That matters because hybrid warfare is built around uncertainty. Sabotage, cyberattacks, covert interference, drone incursions, pressure against critical infrastructure and operations carried out through proxies can all create damage without looking like a conventional military attack.
The central NATO message is therefore not that every incident will produce a public retaliation. It is that Moscow should not assume silence means nothing happened.
NATO Is Making Deliberate Ambiguity Part Of Its Deterrence
Conventional deterrence is often visible. Troops are deployed. Aircraft are moved. Exercises are announced. Governments issue warnings so an adversary understands the cost of crossing a line.
Hybrid deterrence is harder.
If an operation is covert, deniable or ambiguous, publicly announcing the exact response in advance can give the attacker a map of NATO’s thresholds and methods. Rutte’s comments indicate the alliance wants to preserve uncertainty instead.
He has repeatedly said this month that NATO’s reaction does not have to be “tit for tat”. A cyber operation would not necessarily be answered by another cyber operation. A suspected act of sabotage would not automatically produce the same type of action in return.
That gives NATO political and strategic room to choose among diplomatic, economic, intelligence, cyber, military, law-enforcement and resilience measures, depending on the incident and the evidence available.
It also means the public may not always know whether an apparent period of restraint is actually restraint.
That approach fits the wider logic of NATO’s collective-defence system, which intentionally leaves some thresholds open to political judgement rather than reducing every possible attack to a fixed automatic formula.
Hybrid Warfare Is Designed To Live Below The Threshold Of War
The term “hybrid” covers a wide range of hostile activity.
It can include cyberattacks, sabotage, disinformation, covert influence, interference with infrastructure, the use of proxies and military pressure that stops short of an obvious armed attack.
That ambiguity is the point.
A missile deliberately striking a NATO military base would create a comparatively clear security crisis. A fire at a warehouse, a severed cable, a compromised computer network or a drone near critical infrastructure raises more questions.
Who carried it out?
Was a state directly responsible?
Was the objective destruction, intimidation, espionage or disruption?
How confident is the attribution?
What level of response is proportionate?
Those questions can slow decisions and create disagreement between allies. They can also make it harder to explain a response publicly without revealing intelligence sources or operational methods.
Taylor Tailored recently examined that problem in Denmark’s warning that Russia could intensify hybrid pressure on NATO and the West.
Denmark’s Defence Intelligence Service said on 24 September that it expects Russia to escalate its hybrid war against NATO and the West over the coming months. It also assessed a low but rising risk of limited Russian military action against a NATO country, while continuing to judge a full-scale invasion as unlikely.
That distinction is important.
The immediate concern is not necessarily a conventional invasion of NATO territory. It is the possibility that pressure below that threshold becomes more frequent, damaging or difficult to attribute.
Baltic Sentry Shows What A Visible Response Can Look Like
Rutte has repeatedly pointed to Baltic Sentry as an example of how NATO can respond without simply mirroring the original threat.
The alliance launched Baltic Sentry in January 2025 after damage to critical undersea infrastructure in the Baltic Sea. The activity increased NATO’s maritime presence and surveillance, using frigates, maritime patrol aircraft and newer technologies including naval drones.
Its purpose was broader than investigating one incident.
NATO wanted to make future interference with cables and other critical infrastructure harder, improve detection and raise the cost of destabilising activity in the Baltic.
That is the type of response Rutte means when he talks about imposing “strategic dilemmas”.
Instead of answering an act of suspected sabotage with an equivalent act, NATO can strengthen surveillance, change military posture, increase law-enforcement pressure or restrict an adversary’s freedom of action in another area.
The alliance has also linked Baltic security to Russia’s so-called shadow fleet, the network of ageing tankers used to transport Russian oil outside traditional Western shipping structures and sanctions controls.
Rutte has argued that tighter allied activity in the Baltic is making operations more difficult for those vessels.
Whether every element of NATO’s response is publicly known is precisely the ambiguity he now appears determined to preserve.
Article 5 Still Sits Behind The Grey Zone
Hybrid activity does not automatically trigger NATO’s Article 5 collective-defence clause.
But NATO’s own position is that significant cyberattacks and other hybrid attacks could, in some circumstances, amount to an armed attack.
That decision would be made case by case.
This matters because one of the central strategic problems in hybrid warfare is determining where sustained pressure ends and an armed attack begins.
The alliance does not publish a checklist saying that a particular cyber outage, sabotage incident or infrastructure attack automatically crosses the threshold.
There is a reason for that.
A rigid public threshold could become a playbook for an adversary seeking to inflict the maximum possible damage while staying just below it.
The uncertainty therefore cuts both ways.
Russia may try to create ambiguity over attribution and intent. NATO can answer by maintaining ambiguity over the point at which an attack produces a collective response and what that response would look like.
That logic is also visible in regional warnings about possible deception operations. Eastern NATO states have been preparing for the possibility of false-flag drone incidents, where the strategic objective could be confusion as much as physical destruction.
NATO Is Also Linking Hybrid Attacks To Support For Ukraine
Rutte has added another element to the deterrence message.
He argues that Russian hybrid pressure should lead to more support for Ukraine rather than less.
The reasoning is straightforward. If the purpose of sabotage, cyber operations or intimidation is partly to raise the domestic cost of backing Kyiv and weaken political unity inside NATO countries, reducing support for Ukraine after such incidents could create the incentive for more pressure.
Rutte has therefore presented additional assistance to Ukraine as one of the alliance’s possible strategic responses.
That does not mean every hybrid incident will produce a specific military package for Kyiv. It means NATO is trying to deny Russia the political effect it believes Moscow is seeking.
The wider history of the war helps explain why NATO and Russia now operate inside such a tense space. Russia’s confrontation with Ukraine and NATO developed over decades, long before the full-scale invasion of February 2022 turned European security into a prolonged military crisis.
Hybrid activity sits inside that larger confrontation because it allows pressure to spread beyond Ukraine without automatically creating a declared war between Russia and NATO.
The Real Contest Is Over Predictability
Rutte’s warning is significant because it changes the deterrence equation.
Hybrid attackers benefit when they believe they understand the limits of the target’s response. If they can calculate that a particular type of sabotage will produce only condemnation, or that an unattributed cyberattack will generate no meaningful cost, the operation becomes easier to price into strategy.
NATO is trying to make that calculation harder.
The alliance wants Moscow to know that consequences may follow even when they are not announced, and that those consequences may arrive in a different domain from the original attack.
That does not remove the danger of escalation.
An invisible response can still be misread. Attribution can still be disputed. Allies can disagree over proportionality. Covert action can create its own cycle of retaliation.
But the policy now being described by NATO is clear enough in principle.
The alliance does not intend to publish a menu of responses to every form of Russian hybrid pressure.
Some measures will be seen. Some will not.
And in a contest built around ambiguity, NATO appears increasingly willing to use ambiguity itself as part of deterrence.
Sources
NATO — Keynote Speech By Secretary General Mark Rutte, 24 September 2026 — Rutte’s statements on public, non-public, symmetric and asymmetric responses to hybrid attacks.
Danish Defence Intelligence Service — Assessment Of The Threat From Russia, 24 September 2026 — Assessment that Russia is expected to intensify hybrid warfare against NATO and the West, with a low but rising risk of limited military action.
NATO — Collective Defence And Article 5 — NATO’s explanation that significant cyber and other hybrid attacks may, case by case, amount to an armed attack.
Next Reads
Denmark Warns Russia Could Escalate Hybrid War Against NATO And The West — Explains why the grey zone between hostile activity and open warfare is becoming more dangerous.
NATO Explained: How Article 5 Works And Why The Alliance Still Matters — A deeper guide to the collective-defence clause behind NATO’s deterrence strategy.
Russia’s Neighbours Fear Putin Could Use A Ukrainian Drone To Set A Trap For NATO — Examines how attribution and deception can turn drones into tools of hybrid pressure.
