Striking back through the fog: A more muscular approach to sub-threshold threats
The Memorandum | No. 31.2025
The problem of ‘hybrid’ or ‘sub-threshold’ warfare (defined as hostile state activity that sits below the threshold of conventional armed conflict) has garnered considerable attention in recent years in the context of struggles between free and open nations and their authoritarian adversaries. While the hybrid challenge from nations such as the People’s Republic of China (PRC) and Iran is acknowledged, the principal sub-threshold threat to the United Kingdom (UK) – from Russia – is examined here.
As one of the leading European powers in the North Atlantic Treaty Organisation (NATO), and a staunch ally of Ukraine, Britain is under particularly acute hybrid attack from Russia. Even before the full-scale invasion of Ukraine began in February 2022, the UK had suffered some of the most blatant and damaging attacks from Russian sub-threshold operations, not least the 2018 deployment of the nerve agent Novichok in Salisbury.
Much of the debate over how to tackle Russian hybrid threats has been fundamentally defensive in nature, related to Britain’s resilience against Russian sub-threshold operations such as sabotage, cyber attack, assassination, information operations and so on. This is exemplified by the recent Defence Select Committee report Defence in the Grey Zone, which, while providing coherent recommendations, was almost entirely absent of the more proactive aspects of deterrence against hybrid threats.
This is not to say that defensive measures are not vital; they are. Strengthening the nation’s ability to resist multifaceted hybrid attack is critical.
However, it is not enough just to be resilient against attack. If the UK considers itself to be in strategic confrontation with Russia, as the June 2025 National Security Strategy (NSS) states, then taking a passive role and merely fending off blows is insufficient deterrence. Britain should regain the initiative and take the fight to Russia in the sub-threshold arena.
This is not to say that defensive measures are not vital; they are. Strengthening the nation’s ability to resist multifaceted hybrid attack is critical. The fact that a single substation failure led to the closing of the UK’s primary airport is indicative of the poor resilience of British critical national infrastructure, while Module 1 of the Covid-19 Inquiry lays bare the failures of the state’s response to major civil emergency. The 2025 Resilience Action Plan goes some way to addressing these faults, but more should be done. Significant investment should be placed in shoring up the UK’s resilience, perhaps most especially the public understanding of the risk and information sharing on how to act in, and react to, crises.
Nevertheless, a passive approach will not deter further attacks from happening. Russia will continue to probe for weaknesses as long as it believes there will be little serious blowback. This cannot continue. Bullies are deterred by active resistance, not passivity. The NSS appears to acknowledge this in writing – noting the requirement to move out of a ‘defensive crouch’ and adopt a ‘campaigning approach’ – but again offers little detail other than defensive and monitoring measures. This suggests that His Majesty’s (HM) Government is still not entirely willing to take the more proactive approach necessary for effective deterrence.
The first stage in such an approach would be to identify and recognise incidents swiftly as hybrid attacks in the first place. This should then be followed by rapid attribution and condemnation. Where the balance of probability from initial intelligence suggests that the cause of an issue is malignant state activity, it should be publicly called out quickly and resolutely, both domestically and on the international stage. Much of the strategic advantage of hybrid attacks comes from their ‘plausible deniability’. This advantage must be negated; with the declassification and public release of select intelligence if required.
Identification and attribution should then be followed by retribution – the return punch. The adversary should be punished for attacking Britain at the sub-threshold level, and be made aware of the clear red lines which the UK will not allow them to cross. If Russia conducts a hybrid attack on Britain, it should be swiftly followed by a British – or NATO – hybrid counterattack on Russian interests.
In most cases, the UK will not want to undertake the same tactics as adversaries. Russia especially conducts activity which is often nihilistic, unethical and callously dangerous to civilians, breaching the norms of International Humanitarian Law. Britain would not, for instance, want to conduct cyber attacks on Russian power grids which feed electricity to hospitals, both due to the potential harm to civilians and for the ease into which it would feed Russian narratives of ‘whataboutism’ and ‘Western hypocrisy’.
Long periods of deliberation – followed by impotent official condemnation weeks or months later – cannot continue to be the modus operandi. Decisive and tangible action should be emphasised – it is not enough simply to track Russian hybrid activities and name them as such.
However, both the Strategic Defence Review and NSS call for the UK to achieve an ‘asymmetric advantage’. Indeed, asymmetry in a sub-threshold fight is preferable, especially where Britain can make use of its expertise in finance and maritime, cyber and special operations.
For example, a Russian cyber attack on the UK might be countered by the Royal Navy quickly apprehending a known Russian vessel in the nation’s ‘shadow fleet’, or collaborating with an ally to disrupt Russian proxies and illicit financial flows abroad through well-targeted sanctions and law enforcement action. This should then be publicised to prove to both domestic populations and the adversary that Britain is willing to fight back.
As suggested by the NSS, enabling this sort of response will likely require legal and policy changes to allow swift, flexible and decisive action from HM Government. Long periods of deliberation – followed by impotent official condemnation weeks or months later – cannot continue to be the modus operandi. Decisive and tangible action should be emphasised – it is not enough simply to track Russian hybrid activities and name them as such.
Of course, the UK conducts hybrid activities through multiple means against adversaries in secret. However, from the author’s experience, the risk appetite throughout much of HM Government for carrying out even the most basic of offensive sub-threshold activity against state threats is extremely low, to the point of impotence. While understandable, the fear of escalation cannot be allowed to hobble British responses to very direct and blatant hybrid attacks. A well-established framework should be set and understood to allow decisive responses while managing escalatory concerns.
Furthermore, the centrality of public attribution and an openly acknowledged retaliation should be emphasised. The strategic messaging on hybrid activity is often as important as the activity itself. While acknowledging the sensitivity of some operations, keeping all such activity entirely in the shadows fails to support the desired narrative that the UK is a capable actor willing to fight back against adversaries.
Finally, Britain should be proactive in taking the hybrid fight abroad, and support allies and partners in their sub-threshold contest. The UK’s adversaries, especially Russia, actively push their narratives and inflict instability in many regions of the world, including Southeastern Europe, Africa, the Middle East and Southeast Asia. In these scenarios, while hard power assets such as special forces operations, forward military deployments and economic sanctions have their place, soft power tools are most useful in the long term for countering adversarial influence and hybrid threats. Heavily investing in good governance programmes, free and open journalism and British soft power through the BBC World Service, the British Council and cultural exports will be primary tools for countering adversary hybrid activities and strengthening the UK’s global influence.
One of the British military’s key principles of defensive operations is ‘retaining offensive spirit’. This attitude should be taken forwards by HM Government when it comes to sub-threshold operations. Competition, and strategic advantage, will not be won by defensive measures alone. Proactive and proportional but more muscular responses are required if the UK and its allies and partners are to contest and deter adversaries effectively at the sub-threshold level.
Matthew Palmer is a former British Army Officer, the Sir John Moore Adjunct Fellow at the Council of Geostrategy and a Richmond Fellow of the Royal Navy Strategic Studies Centre. He also writes in a personal capacity at Cracking Defence. His views are his own and do not necessarily represent those of the Ministry of Defence or HM Government.
This article is part of the Council on Geostrategy’s Strategic Advantage Cell.
To stay up to date with Britain’s World, please subscribe or pledge your support!
What do you think about this Memorandum? Why not leave a comment below?
Preaching to my choir. Offensive as well as defensive actions are needed.
Although I don’t like the “hybrid” label that seems to imply it isn’t a form of warfare. Which excuses inaction.
Hybrid warfare is Russia attacking a country; Russia denying it is attacking a country; and the West pretending to believe Russia’s denial.