EU hybrid defense plan tests NATO role on Russia threats

EU defense ministers will debate an EU hybrid defense plan Monday, using NATO’s nine Article 4 consultations as a model for threats below war.

The European Commission proposal would create an Emergency Security Protocol for attacks that fall short of NATO’s Article 5 mutual defense threshold. The aim is to coordinate responses when member states face sabotage, arson, cyber operations or other destabilizing acts blamed on Russia.

Brussels tests a protocol

Defense ministers are due to examine the plan in Brussels as governments weigh whether existing tools have deterred Moscow’s lower-level pressure campaign. The protocol would be triggered after an affected country reports an incident and seeks a coordinated response from partners.

Andrius Kubilius, the EU’s defense commissioner, framed the issue as a mismatch between the type of threat and the type of response. “If we are facing hybrid warfare, we need to have hybrid defence,” Kubilius said, adding that governments must define the tools they are prepared to use.

Article 4 shadows the plan

The proposal draws on NATO’s Article 4 consultations, which allow an ally to call talks when it believes its security is threatened. Article 4 has been invoked nine times in NATO’s history, including twice in the year before the current debate, according to officials discussing the plan.

That model has also created concern. European diplomats briefed on the discussions said some governments are wary of building an EU process that overlaps with NATO procedures and slows decisions by adding another forum.

One diplomat questioned whether additional coordination would change Russian calculations, saying: “I’m not sure that anyone thinks the way to fight back against the Russians is to hold more meetings.” The comment reflected a broader tension between governments seeking unity and those pressing for faster punitive tools.

Sabotage cases drive pressure

European countries have blamed Moscow for a series of incidents, including cyber attacks, an attempted armed drone attack on Leipzig/Halle airport, the destruction of a rail track in Poland and arson attacks on warehouses and factories. Russia has routinely denied accusations of covert action against European states.

The incidents have produced public anger but no clear collective punishment mechanism. That gap matters because Article 5 is reserved for an armed attack, while many sabotage cases are designed to sit below that threshold and complicate attribution.

Kubilius argued that responses should impose comparable costs without necessarily copying Russia’s methods. “Very simply, if we are facing painful hybrid threats or actions, our answer should be painful in a similar way,” he said. “Not similar means [necessarily], but pain should be at the same level.”

Three paths for the protocol

If ministers back a narrow protocol, the EU could improve information sharing and joint messaging while leaving sanctions, cyber measures and security deployments to existing channels. That would reduce the risk of conflict with NATO, but it may leave individual governments carrying the main burden after each incident.

If governments approve a stronger mechanism, Brussels could help coordinate penalties after sabotage cases, linking evidence, diplomatic action and sector-specific restrictions more quickly. That path would affect Russia’s operating costs, but it would require member states to agree on attribution standards before acting.

If divisions hold, the response will remain mostly national, with NATO consultations and EU sanctions used case by case. For the broader economy, repeated disruptions to transport, logistics or energy sites would add security costs for companies and deepen pressure on Europe’s defense and infrastructure sectors.

The main open question is whether ministers can define a trigger that is credible, fast and legally separate from NATO’s Article 5. Without that line, the EU risks creating a process that signals concern but does not change the incentives behind hybrid attacks.