Experts Train to Disrupt Hybrid Cyber Warfare Tactics
A new five-day course formalizes strategies to counter combined physical and digital attacks on infrastructure.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you worry that common home internet devices pose a security risk to your household?
In early October 2026, the Hybrid CoE, the European Security and Defence College, and the European Defence Agency convened a five-day training course on responding to hybrid cyber threats. The curriculum centered on analyzing international cyber conflict data and response strategies, specifically drawing from experiences in Ukraine.
Why it matters
The training reflects a strategic pivot by the European External Action Service (EEAS) toward a disruptive posture that targets the weak points of hostile infrastructure. This shift aims to move beyond defensive resilience by actively deterring actors involved in combined cyber and physical attacks.
Official records indicate 3,100 cyber incidents in Ukraine throughout the first half of 2026. The scope of these attacks includes AI-driven recruitment campaigns, deepfakes, and combined strikes against logistics hubs like Nova Post terminals.
The players
Hybrid CoE
The Helsinki-based center of excellence that focuses on research and training related to hybrid threats.
European External Action Service
The European Union's diplomatic service that manages the FIMI Toolbox to counter foreign manipulation and interference.
The details
The course utilized multiday wargaming sessions to simulate defensive maneuvers and counter-offensive responses. Participants practiced applying the EEAS FIMI Toolbox, a framework designed to combat foreign information manipulation and interference. This strategy mandates a five-pillar approach: improving situational awareness, building societal resilience, disrupting hostile actions, implementing regulation, and coordinating external counter-actions.
Timeline
Over 3,100 cyber incidents were recorded in Ukraine during the first half of 2026.
The Hybrid CoE course on hybrid conflict occurred over five days in early October 2026.
The Tech Race
This training initiative follows the operational framework established by the EEAS FIMI Toolbox strategy. It marks a transition from purely defensive cyber resilience to a more assertive stance that targets the infrastructure vulnerabilities of hostile actors.
The training establishes new tactical protocols for logistics and infrastructure providers facing integrated physical and cyber threats. Organizations operating in high-risk zones can expect to see these disruptive response strategies reflected in future regional security and risk-management mandates.
The takeaway
The move toward disruptive counter-measures represents a permanent shift in how international entities manage hybrid state-level threats. Observers should track subsequent updates to the EEAS FIMI Toolbox framework for future benchmarks in cyber deterrence.
Further reading
For broader analysis on current defense trends, visit the /tech/cybersecurity/ section.
Source note: This article includes information reported by Hybrid CoE - The European Centre of Excellence for Countering Hybrid Threats.
Live Poll
Do you worry that common home internet devices pose a security risk to your household?
