Europe has spent much of the past five years debating how much it should spend on defence.<\/p>\n
Ursula von der Leyen\u2019s speech in Strasbourg<\/a> this week raised a different question.<\/p>\n What happens when Europe is attacked, but not quite attacked enough?<\/p>\n A drone appears over a military base. An undersea cable is damaged. Airports are disrupted by GPS interference. A cyberattack hits critical infrastructure.<\/p>\n None necessarily amounts to an act of war.<\/p>\n But taken together, they are becoming a serious security problem.<\/p>\n Von der Leyen used her State of the Union speech to propose a new European security strategy<\/a>, including a European Security Council and what she called a \u201ccounter-hybrid playbook\u201d<\/strong>.<\/p>\n The idea sounds bureaucratic. The problem it is trying to solve is not.<\/p>\n Europe increasingly needs to respond to hostile activity that sits somewhere between peace and conventional war.<\/p>\n NATO already has mechanisms for dealing with threats to its members, including Article 4 consultations<\/a><\/span> and Article 5<\/a><\/span> collective defence.<\/p>\n The difficulty is everything that happens below that level<\/strong>.<\/p>\n Sabotage, cyberattacks, drone incursions and interference with critical infrastructure can be disruptive without necessarily being serious enough to trigger a military response.<\/p>\n That gives an adversary room to operate.<\/p>\n One damaged cable can be an accident. One unidentified drone can be an isolated incident. One cyberattack can be difficult to attribute.<\/p>\n A pattern of them is harder to dismiss. Von der Leyen put it rather well: Europe\u2019s hybrid threats are becoming \u201cless and less hybrid and less and less threats\u201d. The grey zone, in other words, is becoming less grey. But identifying the problem is easier than deciding what to do about it.<\/p>\n If Europe concludes that a hostile state is behind repeated acts of sabotage or disruption, what happens next?<\/p>\n When does an incident become serious enough to require a collective response? Who decides? And what does that response actually look like?<\/strong><\/p>\n Those are not really questions about institutions. They are questions about deterrence.<\/strong><\/p>\n But there is another reason the proposal is interesting. A European system for dealing with hybrid threats may be easier to build than a fully integrated European military capability<\/strong>. Much of it depends on technology: surveillance, intelligence-sharing, cyber defence, communications and the ability to connect national authorities quickly when something happens.<\/p>\n That makes it relatively \u201clight\u201d compared with building new armies, weapons programmes or large military formations. But it could still force European countries to develop something much more important: the command-and-control architecture needed to identify a threat, share information, make decisions and coordinate a response.<\/p>\n In that sense, countering hybrid warfare <\/a><\/span>could become a practical testing ground for deeper European defence integration. Europe does not necessarily have to begin by building a European army. It can begin by learning how to see the same threat, make a decision together and respond to it.<\/p>\n And that matters because Europe\u2019s wider defence project is already running into a familiar problem.<\/strong><\/p>\n ReArm Europe<\/a><\/span> – now increasingly framed through Readiness 2030 – was launched in March 2025 with the ambition of mobilising up to \u20ac800 billion in additional defence investment. Its \u20ac150 billion SAFE<\/a><\/span> instrument is already financing joint procurement.<\/p>\n But money alone does not create a common European defence<\/strong>. The harder task is turning national spending, national industries and national militaries into capabilities that can actually work together.<\/p>\n