Wars are no longer declared. They unfold. They arrive through screens, leaks, algorithms and economic pressure, often without a single shot being fired. In recent years, governments and international organisations have increasingly turned to the term “hybrid war” to describe this shift — a form of conflict that operates in the grey zone between peace and open hostilities. While the vocabulary may be new, the methods are not. What has changed is the environment in which they operate, and the scale at which they can destabilise democratic systems. Understanding what hybrid war is — and what it is not — has become essential to interpreting contemporary political crises, from global power competition to domestic information shocks.
What hybrid war is
Hybrid war describes a strategy that blends military and non-military tools to pursue political or strategic objectives without crossing the threshold of declared war. It is not a single action but a coordinated pattern of pressure: cyber operations, disinformation, economic leverage, legal manoeuvring, diplomatic signalling and the use of proxies all working in parallel to destabilise institutions and erode public trust.
A defining feature is ambiguity. Each action may appear lawful or isolated. Together, they form sustained pressure that is difficult to attribute and even harder to counter.
How institutions define the threat
Security institutions increasingly use the language of “hybrid threats” rather than hybrid war. NATO defines hybrid threats as the coordinated use of military and civilian instruments designed to blur the line between peace and conflict. The European Union describes them as actions that undermine democratic institutions, information ecosystems and critical infrastructure while exploiting legal, political and economic openness.
In both cases, the emphasis lies on coordination, deniability and societal impact, not traditional battlefield confrontation.
Old practice, new term
The tactics associated with hybrid war are as old as statecraft itself. Propaganda, subversion, economic pressure and proxy actors were tools of empires long before the digital age. What is new is the terminology and the strategic framework used to describe them.
From the early 2010s onwards, NATO and the EU adopted “hybrid” as a way to conceptualise how familiar methods were being amplified by digital platforms, cyber tools, financial interdependence and legal complexity. Hybrid war does not describe a new kind of conflict; it names a new operating environment in which influence travels faster, farther and more anonymously than ever before.
Why hybrid war matters more today
Hybrid strategies thrive in societies that are open, connected and fast-moving. Information circulates instantly, while verification and attribution lag behind. Reputational damage is immediate; institutional responses are necessarily slower. Elections, media, courts and markets become primary targets.
The objective is rarely decisive victory. It is friction: delaying decisions, polarising debate, exhausting public trust and testing institutional resilience.
Hybrid war in practice: recent patterns
In recent years, international reporting and security assessments point to recurring hybrid patterns:
- Disinformation and influence campaigns coordinated across platforms
- Cyber pressure against public services, media or infrastructure
- Economic or energy leverage timed to political moments
- Legal pressure (“lawfare”) to intimidate or distract
- Proxy amplification through anonymous accounts or intermediaries
Each element alone may be ambiguous. It is the pattern and coordination that define hybrid activity.
The Cyprus question: was VIDEOGATE hybrid war?
The anonymous release of videos on X alleging corruption involving former officials in Cyprus triggered institutional and political shockwaves. The analytical question is not whether the content is accurate, but whether the operation itself meets the criteria of hybrid activity.
To characterise an episode as hybrid, analysts typically look for the following parameters:
- Strategic intent - evidence of an aim to destabilise institutions or influence policy
- Timing and coordination - release aligned with politically sensitive moments
- Attribution ambiguity - anonymous or obscured sources enabling deniability
- Information manipulation - selective editing or contextual distortion
- Amplification networks - coordinated dissemination beyond organic spread
- Multi-domain coupling - linkage to legal, diplomatic, cyber or economic pressure
- External nexus - credible connections to external actors or proxy ecosystems
- Societal impact - measurable erosion of institutional trust
Based on publicly available information, the episode appears to satisfy some hybrid-style characteristics, particularly anonymity, amplification and institutional impact. However, critical thresholds remain unproven, notably coordinated multi-domain action, external direction and demonstrable strategic intent. Without these, it is more accurate to describe the incident as a potential hybrid-style information operation, rather than confirmed hybrid war.
Why precision matters
Hybrid war is a pattern, not a label of convenience. Overusing the term risks diluting its meaning and undermining democratic accountability. Underusing it leaves societies exposed to manipulation they fail to recognise.
For small, open democracies, resilience lies in institutional transparency, verification, and proportional response — not reflexive escalation. Naming threats accurately is not semantics. It is the first line of defence.