UK officials urge stronger deterrence against hybrid threats

Senior Ministry of Defence officials have underscored the importance of attribution, integration and whole-of-government coordination to counter the growing spectrum of hybrid threats facing the UK and its NATO allies.

The discussion came during a Defence Committee evidence session on 25 March 2025, focused on “defence in the grey zone”—the contested space below the threshold of conventional warfare.

Paul Wyatt, Director General of Security Policy at the MoD, made clear that while “an Article 5 response is a political decision”, the range of potential responses—military or otherwise—remains deliberately ambiguous.

He noted that adversaries are “seeking to do us harm… in a manner they judge is below the Article 5 threshold,” referencing cyberattacks and disinformation campaigns. Still, he highlighted that NATO has explicitly warned certain cyber operations could trigger Article 5, depending on scale and impact.

Wyatt also pointed out that the only time NATO has invoked Article 5 was after the 9/11 attacks—“a terrorist attack, but one with a connection to a degree of state sponsorship”—highlighting how even hybrid or non-traditional threats can be met with collective defence action.

Air Commodore Matt Bressani expanded on how defence contributes to deterrence through the “five Cs”: “credibility, capability, comprehension, communications,” and now, “competition.” He stressed that “we need to be as well prepared as we can be,” even if not every hybrid threat can be intercepted in advance.

The issue of attribution—identifying the source of malign activity—was central to the session. Committee member Mr Bailey cited examples ranging from antisemitic graffiti campaigns attributed to the Russian FSB, to Russian-linked Telegram networks inciting violence in the UK. He asked how the UK ensures accurate attribution without unnecessarily escalating tensions.

In response, Armed Forces Minister Luke Pollard pointed to previous successful examples of attribution, such as declassified defence intelligence ahead of Russia’s 2022 invasion of Ukraine. “That’s a really clear example of how using the assessment tools we have… we’re able to call that out,” Pollard said, also referencing the UK’s attribution of Chinese state-sponsored cyberattacks.

Pollard acknowledged the challenge of moving from internal assessment to public attribution: “It’s a confidence piece about building the credibility of our intelligence systems, as well as directly countering the misinformation and the malign activities of our adversaries.” He stressed the need for deeper integration of government systems, particularly at the intersection of intelligence, cyber and sub-threshold threats.

Calling for better cross-government collaboration, Pollard emphasised the value of the Cabinet Office in “bringing together intelligence across government to have a full picture.” The MoD, he said, would like to see “greater joining up of our systems… especially in the hybrid space and the nexus of cyber-intelligence.”