Can a European Security Council help the EU fight Russia’s hybrid attacks?
Sabotage, arson, cyberattacks, disinformation, and drones in restricted airspace. Russia’s hybrid campaign against Europe no longer looks like isolated incidents. The EU is now rethinking its response. In...
Sabotage, arson, cyberattacks, disinformation, and drones in restricted airspace. Russia’s hybrid campaign against Europe no longer looks like isolated incidents. The EU is now rethinking its response.
In September, European Commission President Ursula von der Leyen said the hybrid threats facing Europe are “less and less hybrid and less and less threats”. Her State of the Union address introduced a new idea, the European Security Council.
From resilience to deterrence
For Ionela Ciolan, a research officer at the Wilfried Martens Centre for European Studies, the challenge is clear. Russian hybrid warfare today, she says, means the “weaponisation of everything,” from attacks on critical infrastructure and election interference to targeted arson and the instrumentalisation of energy.
The EU’s response has so far leaned on resilience and coordination. Its Hybrid Toolbox, activated in June 2024, bundles cyber, sanctions, diplomatic, and support measures. It created a dedicated Russia hybrid sanctions regime, with first listings in December 2024, and rapid response teams, first deployed in Moldova in 2025.
Analysts now see a shift. Faster public attribution to Russia, more talk of imposing costs on Moscow, and viewing incidents as parts of one campaign. Parliament adopted a report in September calling for a more proactive approach by 470 votes to 129.
Gaps remain, sanctions need unanimity, intelligence is fragmented between capitals, and there is no consensus on when sabotage merits a collective military response.
What is on the table
The proposal has three linked parts: a standing leaders’ forum, an Emergency Security Protocol, and a funding instrument for shared capabilities such as air defence. The protocol is the most relevant for hybrid threats. Von der Leyen described it as Europe’s answer to NATO’s Article 4, letting any member state convene all 27 governments when it feels its security is threatened.
The Commission is reportedly considering inviting partners such as the UK, Norway, Ukraine, and Canada. No formal legislative proposal has been tabled, and no legal basis, voting system, budget, or launch date has been agreed.
Luigi Scazzieri, a senior policy analyst at the EU Institute for Security Studies, is blunt about what it would be. In von der Leyen’s version, the Council is essentially a dedicated European Council meeting with invited partners. “This is not a decision-making body per se,” he says.
That means it cannot cut through the disagreements that slow EU responses. Scazzieri argues its worth lies elsewhere: “The key value […] is not necessarily speed, but it’s more the cross-policy coherence.” He says it would help the EU think more strategically about its toolbox, from sanctions to spending, while NATO keeps collective defence.
Critics, he acknowledges, will say Europe already has plenty of forums, including the European Political Community.
The threshold problem
The harder question is when a hybrid attack becomes graver. Ciolan points to the EU’s mutual assistance clause, Article 42.7, and the debate over operationalising it for hybrid attacks.
“A cyberattack that shuts down hospitals or sabotage that disables a power grid could have consequences comparable to a conventional military attack,” she says. Moscow, she adds, thrives on the grey area: “Russia exploits ambiguity to complicate attribution and delay a collective response.”
Her conclusion is that Europe needs common rules: “Europeans therefore need a shared framework for assessing these attacks, and must be able to respond to hostile actions even when they remain below the threshold of armed aggression.”
In her view, a Security Council and an Emergency Security Protocol could help member states “move more quickly from national reactions to a common European response, bringing together military and non-military instruments.” The decision to invoke Article 42.7 would stay with the state under attack.
A hedge against Washington?
Steven Blockmans, deputy director at the International Centre for Defence and Security in Tallinn, says the idea was revived by doubts about US commitment to NATO’s Article 5. The concept dates back to a 2018 proposal by Angela Merkel and Emmanuel Macron. He sees a Council as a fallback if the North Atlantic Council were blocked, whether by Washington or another ally. He links its new momentum to the Greenland crisis and says Defence Commissioner Andrius Kubilius has pushed the idea for more than a year.
Blockmans argues the body would need teeth to be credible. “It would boost the legitimacy of a European Security Council if its governance had decision-making procedures,” he says, giving national parliaments a democratic backstop and linking it to NATO-compatible command structures and a dedicated budget.
That, he says, is an ideal that would take years of treaty drafting. But if the situation demands it, “an informal construct could well be created tomorrow, if push comes to shove.”
So is the European Security Council a tool against hybrid attacks? From what we know so far, only partly. As proposed, it would improve coordination and give leaders a regular space to discuss security with partners. The Emergency Security Protocol could provide an earlier political entry point for incidents below the armed attack threshold. But experts agree that the underlying obstacles lie in national politics.
