Europe has spent much of the past five years debating how much it should spend on defence.
Ursula von der Leyen’s speech in Strasbourg this week raised a different question.
What happens when Europe is attacked, but not quite attacked enough?
A drone appears over a military base. An undersea cable is damaged. Airports are disrupted by GPS interference. A cyberattack hits critical infrastructure.
None necessarily amounts to an act of war.
But taken together, they are becoming a serious security problem.
Von der Leyen used her State of the Union speech to propose a new European security strategy, including a European Security Council and what she called a “counter-hybrid playbook”.
The idea sounds bureaucratic. The problem it is trying to solve is not.
Europe increasingly needs to respond to hostile activity that sits somewhere between peace and conventional war.
NATO already has mechanisms for dealing with threats to its members, including Article 4 consultations and Article 5 collective defence.
The difficulty is everything that happens below that level.
Sabotage, cyberattacks, drone incursions and interference with critical infrastructure can be disruptive without necessarily being serious enough to trigger a military response.
That gives an adversary room to operate.
One damaged cable can be an accident. One unidentified drone can be an isolated incident. One cyberattack can be difficult to attribute.
A pattern of them is harder to dismiss. Von der Leyen put it rather well: Europe’s hybrid threats are becoming “less and less hybrid and less and less threats”. The grey zone, in other words, is becoming less grey. But identifying the problem is easier than deciding what to do about it.
If Europe concludes that a hostile state is behind repeated acts of sabotage or disruption, what happens next?
When does an incident become serious enough to require a collective response? Who decides? And what does that response actually look like?
Those are not really questions about institutions. They are questions about deterrence.
But there is another reason the proposal is interesting. A European system for dealing with hybrid threats may be easier to build than a fully integrated European military capability. Much of it depends on technology: surveillance, intelligence-sharing, cyber defence, communications and the ability to connect national authorities quickly when something happens.
That makes it relatively “light” compared with building new armies, weapons programmes or large military formations. But it could still force European countries to develop something much more important: the command-and-control architecture needed to identify a threat, share information, make decisions and coordinate a response.
In that sense, countering hybrid warfare could become a practical testing ground for deeper European defence integration. Europe does not necessarily have to begin by building a European army. It can begin by learning how to see the same threat, make a decision together and respond to it.
And that matters because Europe’s wider defence project is already running into a familiar problem.
ReArm Europe – now increasingly framed through Readiness 2030 – was launched in March 2025 with the ambition of mobilising up to €800 billion in additional defence investment. Its €150 billion SAFE instrument is already financing joint procurement.
But money alone does not create a common European defence. The harder task is turning national spending, national industries and national militaries into capabilities that can actually work together.
There is a political problem too. Large military programmes are expensive, slow and often difficult to sell domestically. That becomes harder as several major European countries move towards important elections in 2027, when defence spending will compete with domestic priorities for both money and political attention.
A “lighter” security project built around technology, intelligence, cyber defence and command and control may therefore be easier to advance than another grand attempt to build European defence from the top down.
And it sits alongside another shift running through von der Leyen’s speech.
Europe is also trying to reduce the military dependencies that limit its ability to act.
Take missile defence.
The EU has approved financing for Patriot missiles for Ukraine because Kyiv needs ballistic-missile interceptors now.
At the same time, Europe is backing Freyja, the Ukrainian-led effort to develop a cheaper, modular ballistic-missile defence system using Ukrainian and European technology.
The logic is fairly simple.
Buy Patriot now. Try to build the alternative for later.
Von der Leyen also singled out air and missile defence, strategic transport, air-to-air refuelling, space and cyber as capabilities Europe needs to develop collectively.
These are not the glamorous parts of rearmament.
But they are what allow militaries to see threats, move forces, sustain operations, and defend territory.
For years, the European defence debate has largely been about money: who spends enough, who does not, and whether Europe can reach its NATO targets.
Spending is now rising.
The harder part comes next.
Europe has to turn that money into weapons, production capacity and military capability.
But it also has to build the structures that connect those capabilities. Von der Leyen’s hybrid-warfare proposal may look considerably less ambitious than another grand European rearmament plan. That may be precisely why it matters.
If European countries can learn to detect threats together, share information quickly and agree on how to respond, they begin building the machinery of common defence before they have agreed on what common defence should ultimately become.
And they need to decide what they will do when an adversary deliberately stops just short of war.
English version by the Translation Service of Withub
