Gjon Culaj, Associate Fellow at the “Octopus” Institute
The contemporary security landscape is experiencing significant changes, as traditional forms of conflict are increasingly giving way to more complex, sophisticated, and difficult-to-identify forms of hostile activity. Within this evolving strategic environment, hybrid threats have become one of the most significant challenges confronting democratic states. By combining military and non-military instruments, conventional and unconventional methods, as well as political, economic, informational, and cyber means, these threats seek to weaken state institutions, disrupt democratic processes, and undermine public confidence in governance. According to NATO, hybrid threats involve the coordinated use of military and non-military, overt and covert instruments, including disinformation campaigns, cyber operations, economic coercion, and political interference, with the aim of destabilizing societies and undermining democratic institutions (NATO, 2026).
This concept was developed to explain new forms of conflict that extend beyond the use of armed force. According to Frank G. Hoffman (2007), “hybrid wars incorporate a full range of different modes of warfare, including conventional capabilities, irregular tactics and formations, terrorist acts including indiscriminate violence and coercion, and criminal disorder” (Hoffman, 2007, p. 8). In today’s complex security environment, state and non-state actors increasingly rely on a wide range of political, economic, informational, and technological tools to influence public opinion, create instability, and weaken the effectiveness of state institutions. In his work Mastering the Gray Zone: Understanding a Changing Era of Conflict, Michael J. Mazarr highlights one of the defining characteristics of hybrid threats: the so-called “gray zone,” a strategic space situated between peace and open conflict where the traditional boundaries between these conditions become increasingly unclear. Within this environment, state and non-state actors utilize a combination of political, economic, informational, cyber, and military instruments to advance their interests without crossing the threshold that would trigger a direct military response. Although such activities are often gradual and difficult to identify as direct aggression, their consequences can be profound, weakening state institutions, eroding public trust in government, and undermining the stability of democratic order (Mazarr, 2015:55-56).
Hybrid Threats as a Challenge to Democracy
Modern democracies constitute attractive targets for hybrid threats due to their political openness, media pluralism, and strong protection of freedom of expression. According to Tanja Ellingsen (2024), hybrid actors seek to exploit precisely these democratic characteristics in order to foster political polarization, undermine confidence in public institutions, and weaken democratic processes (Ellingsen, 2024:46). Chodak, Krassowski, and Wierzchowski (2021) argue that hybrid threats rely primarily on non-military instruments and psychological influence over society. They emphasize that civilian populations simultaneously constitute a source of societal vulnerabilities and a direct target of disinformation and information manipulation campaigns. In this regard, civil society is not merely the object of hybrid activities but becomes the primary arena in which competition for influence, trust, and public perception takes place (Chodak et al., 2021:92-93).
Another crucial dimension of hybrid threats is information warfare and disinformation. State and non-state actors increasingly utilize social media platforms and digital communication channels to disseminate false narratives, shape public opinion, and intensify political polarization. According to Rühle and Roberts (2021), such campaigns are designed to undermine public trust in democratic institutions and create “alternative realities” in which truth and propaganda become increasingly difficult to distinguish (Rühle & Roberts, 2021:25). Consequently, democratic processes such as elections and public debate become more vulnerable to manipulation.
A further significant dimension concerns the vulnerability of democratic institutions to cyberattacks. Critical national infrastructure, electoral systems, and communication networks may become direct targets of hybrid operations. Such attacks aim not only to cause technical disruption but also to generate uncertainty and weaken public confidence in the state’s ability to ensure normal functioning. According to NATO’s cybersecurity framework, resilience against such attacks requires not only technical protection but also the capacity for rapid institutional and societal recovery (NATO, 2024). Hybrid threats also contribute to social polarization and the erosion of democratic cohesion. By exploiting existing political, ethnic, and social divisions, external actors can intensify internal conflicts and weaken democratic consensus. According to Ellingsen (2024), the primary objective of such interventions is not necessarily regime change but rather the creation of an unstable environment in which institutions lose legitimacy and citizens lose confidence in the democratic system (Ellingsen, 2024:45).
In this context, strengthening democratic resilience constitutes a fundamental pillar in safeguarding contemporary political systems. Resilience refers to the capacity of a political and social system to anticipate, withstand, and recover from hybrid disruptions while maintaining its core functions and institutional stability. This capability encompasses not only crisis response but also the ability to adapt and sustain democratic governance under conditions of both internal and external pressure (NATO, 2025). According to NATO’s resilience framework, strengthening the robustness of democratic societies requires a comprehensive institutional approach that includes the development of cybersecurity capabilities, the promotion of transparency and good governance, and the enhancement of media literacy among citizens. These measures aim to increase society’s ability to withstand hybrid threats and disinformation campaigns (NATO, 2024). A well-informed society supported by stable, transparent, and effective institutions represents one of the most important safeguards against hybrid threats. High levels of public awareness and media literacy make it more difficult for malicious actors to manipulate public perceptions and disseminate disinformation, while resilient institutions enhance the state’s capacity to prevent, withstand, and recover from various forms of hybrid pressure.
Resilience as a Strategic Concept for Kosovo’s Defence Against Hybrid Threats
In contemporary security literature, resilience is defined as the ability of a system to absorb shocks, adapt, and recover from crises while maintaining its essential functions (Jermalavičius & Pernik, 2017:3). Within the context of hybrid threats, this implies that states should focus not only on preventing attacks but also on developing capacities that make society more resistant to manipulation, destabilization, and external interference. According to modern security concepts, resilience has evolved from a reactive approach into a proactive strategic framework. Hartmann (2017) argues that hybrid threats target not only physical infrastructure but also political decision-making processes and institutional trust, making resilience an indispensable component of national security and defence (Hartmann, 2017:4).
In this regard, Kosovo should embrace resilience not as an additional element of security policy but as the central architecture of national defence. The development of strategic resilience in Kosovo should be based on several interconnected pillars that together create an integrated system of protection against hybrid threats. Institutional resilience constitutes the foundation of strategic resilience. Strong, transparent, and effective institutions are essential prerequisites for political stability and resistance to external interference. According to Kalniete and Pildegovičs (2021), institutional fragility significantly increases exposure to hybrid actors’ influence on political processes and contributes to the gradual erosion of public trust in democratic institutions (Kalniete & Pildegovičs, 2021). Reliable institutions remain the most effective defence against disinformation and manipulation, as they provide citizens with a credible reference point for distinguishing factual information from deceptive narratives.
In the digital era, cyberspace has become a central arena of hybrid conflict. Cyberattacks against state systems are intended not only to cause technical disruption but also to create institutional uncertainty and diminish public confidence (NATO, 2024). In Kosovo’s case, protection against hybrid threats should not be understood solely as strengthening military or law-enforcement capabilities, but rather as building a resilient state and society capable of withstanding destabilizing operations. The very nature of hybrid threats is to exploit internal vulnerabilities across political, informational, economic, social, and cyber domains. Consequently, resilience should be positioned at the core of Kosovo’s national security concept.
Within Kosovo’s security context, one of the principal sources of hybrid threats is linked to political, informational, cyber, and diplomatic activities originating from Serbia as a regional state actor. These challenges do not manifest themselves through open military confrontation but rather through a combination of non-conventional instruments designed to influence Kosovo’s institutional stability, its international standing, and its internal social cohesion (KCSS, 2025:2). Kosovo therefore requires a conceptual shift in its security approach. Instead of relying primarily on a reactive threat-response model, it should adopt a resilience-based framework in which the state, society, and international partners operate as interconnected components of an integrated protective system. Only such a comprehensive approach can enhance Kosovo’s ability to withstand hybrid threats and preserve stability, security, and democratic governance in an increasingly complex strategic environment.
In response to these challenges, Kosovo’s National Security Strategy should adopt a more advanced approach centred on national resilience. Threats arising from disinformation, political influence operations, cyber activities, and the instrumentalization of ethnic tensions by Serbia should be addressed as national security concerns on an equal basis with conventional security threats. Future revisions of Kosovo’s National Security Strategy should therefore place democratic resilience at the centre of the national security architecture. In addition to strengthening its security and defence capabilities, Kosovo should establish specialized mechanisms for monitoring disinformation, safeguarding critical infrastructure, improving inter-institutional coordination, and enhancing media literacy among citizens. Only through such a comprehensive, whole-of-society approach can Kosovo reinforce its resilience against hybrid threats and ensure the effective functioning of its democratic institutions.