Summary
- European institutions face overlapping cyber, physical and information threats.
- Denmark raised its assessment of destructive cyberattack threats in September 2026.
- EU deterrence mechanisms and critical infrastructure resilience remain central to the response.
Europe's critical infrastructure is increasingly exposed to hostile activity that combines cyberattacks with physical sabotage, unmanned aircraft and information operations, according to a new European Parliament briefing examining the resilience of European defences.
The European Parliamentary Research Service published its assessment of hybrid warfare on 26 October 2026. It examines how hostile activities conducted below the threshold of conventional armed conflict can impose economic costs, disrupt essential services and test the ability of European states to coordinate their responses.
Although hybrid threats are not new, the research describes a more complicated security environment following Russia's full-scale invasion of Ukraine in 2022. Cyber operations form part of a wider pattern that includes suspected sabotage, interference with communications, information manipulation and activity around strategically important infrastructure.
The briefing identifies Denmark as an example of a changing threat environment. In September 2026, Danish authorities raised their assessment of the threat of destructive cyberattacks from medium to high, citing intelligence concerning preparations for sabotage. That judgement does not prove that every subsequent disruption was a coordinated foreign operation.
The assessment also refers to an earlier cyberattack affecting Danish water infrastructure that temporarily interrupted supplies to approximately 450 households. Even comparatively small infrastructure providers can suffer material consequences when cyber operations intersect with systems that deliver essential services.
Local utilities, public authorities and private suppliers can therefore become exposed to activity shaped by wider geopolitical objectives, even if they are not themselves conventional military targets. Disruption can spread through dependent organisations when services such as communications, energy or transport are interrupted.
The parliamentary research also considers drone activity near sensitive sites, including infrastructure, military facilities and transport locations. Such incidents complicate operational decisions because an operator may need to distinguish surveillance, harassment and a credible physical threat while continuing to provide normal services.
Cyber incidents and suspected physical interference do not necessarily share an attacker or an operational objective. However, investigating them through entirely separate organisational processes can make it harder to recognise a coordinated incident when the evidence supports that conclusion.
European responses span instruments beyond conventional cybersecurity regulation. The EU cyber diplomacy toolbox provides a framework for coordinated diplomatic action, while the Union's cyber defence policy places cyber capabilities alongside strategic defence technologies and international cooperation.
These initiatives operate alongside sector-specific resilience obligations. NIS2 addresses cybersecurity risk management and reporting among essential and important entities. Other European legislation governs the resilience of critical infrastructure, financial-sector operational risks and security requirements for connected products.
Regulatory obligations can improve preparedness, but they do not automatically settle responsibility where an incident involves cyber activity, physical interference and suspected foreign direction. Intelligence sharing, attribution, criminal investigation, operational recovery and possible diplomatic responses may fall to different bodies with different evidential thresholds.
Distinguishing a technical failure from hostile action is especially important. A service interruption might initially resemble an equipment fault before evidence of malicious interference emerges. Equally, suspicious behaviour should not be attributed to a government merely because it occurs during a period of heightened tension.
A relatively limited operation can also impose costs beyond the immediate technical impact through precautionary closures, extra monitoring, security measures and interruptions to business activity. Those indirect effects may outlast the original incident, even if full technical attribution remains unresolved.
European governments have consequently been examining how civil protection, intelligence, defence planning, infrastructure security and cyber response can operate more closely together. The briefing describes a need for coordinated national and European action without treating every reported incident as part of a single campaign.
The document does not introduce new binding legislation, nor does it establish responsibility for particular suspected acts of sabotage. It records the increasing burden placed on institutions expected to maintain essential services while assessing uncertain, cross-domain threats.
