Since 2014, NATO has increasingly experienced the consequences of hybrid aggression. One of the newest tools in this arsenal has been the use of drones. However, the traditional framework of collective defence, based on Article 5, does not clearly specify when an airspace violation or what type of attack meets the threshold of an armed attack. NATO emphasizes that hybrid activities may indeed reach the level of an armed attack, but at the same time many such activities remain below, or on the edge of, the escalation threshold. The key question is therefore how the Alliance should respond to the growing wave of grey-zone attacks. This article analyses that challenge and proposes the development of a doctrine of collective resilience, combining deterrence, active defence, and enhanced civil-defence readiness as a complement to Article 5.
The concept of hybrid warfare and hybrid threats has functioned in NATO’s official terminology essentially since 2016, while the turning point that made this need evident was Russia’s attack on Ukraine and the annexation of Crimea in 2014. Since the 2016 Warsaw Summit, NATO has included hybrid attacks among the circumstances that may lead to the invocation of Article 5, while also stressing that the primary responsibility for responding to such an attack rests with the state under attack.
Following Russia’s unprecedented hybrid attack against NATO’s eastern-flank countries in 2025, including drone incursions into the airspace of Poland, Romania, and Turkey, NATO launched Eastern Sentry, modelled in part on Baltic Sentry. The initiative strengthens deterrence and defence by adding, among other things, additional air-defence systems, fighter aircraft, and other military capabilities. In May 2026, NATO also tested its first layered counter-drone defences in Romania as part of the Layered Counter-Uncrewed Aerial System (UAS) Initiative Crucible, examining more than 200 types of military equipment.
At the Bucharest Summit of the B9 and Nordic countries in May 2026, leaders explicitly stated that repeated airspace violations on the eastern flank underline the urgent need to further strengthen NATO’s air and missile defence, including against threats posed by UAS. NATO is therefore already linking drones, resilience, and deterrence. However, it still tends to do so reactively rather than on the basis of a mature, Alliance-wide doctrine for operating below the threshold of war.
The continuously growing number of hybrid attacks raises questions that have not yet been fully resolved, particularly the question of the economics of hybrid deterrence. Cheap, technologically unsophisticated equipment used as a tool of hybrid attack creates a disproportionate burden when the response requires expensive fighter aircraft and missiles, as the Polish case in 2025 demonstrated. Finland’s Traficom reported that by 30 April 2024 it had received approximately 1,200 reports of GPS interference in aviation. The costs of response and mitigation, as well as the broader implications of such incidents, have triggered debate over how adversaries can burden defence systems without relying on classic kinetic strikes and without imposing significant costs themselves.
NATO has begun to respond to this challenge, but more through a mosaic of initiatives than through a single doctrine. Following the incidents of 2025, NATO member states undertook a series of measures aimed at supporting deterrence and defence, ranging from drone identification and counter-drone systems such as MEROPS, already operating in countries including Poland, to the appointment of a Special Coordinator for Hybrid Threats, the creation of Eastern Sentry, and the launch of a broader package of counter-UAS measures. Yet these remain individual tools created in response to the Alliance’s immediate needs and then stitched together into a broader doctrinal framework.
Despite this progress, the main gap remains doctrinal. NATO itself states that the primary responsibility for responding to hybrid threats lies with the targeted state. This has significant operational implications: the first assessment of an incident, the first public communication, the first legal decisions, and the first use of response measures remain decentralized. The maritime track, the C-UAS track, the hybrid-threat track, and the civil-regulatory track are developing in parallel, rather than as one integrated doctrine.
This is precisely where the concept of collective resilience becomes the missing link between Article 3, Article 4, and Article 5. The Alliance still lacks a common, publicly understandable escalation ladder connecting these three levels to the realities of the grey zone. Four gaps follow from this. First, rules on the use of force against drones and other objects differ between capitals. Second, the evidentiary process remains dispersed among military services, police forces, aviation regulators, infrastructure operators, and private companies. Third, national caveats limit the use of some forces and sensors in allied operations. Fourth, NATO has many possible courses of action, but fewer common decision-making templates.
From a doctrinal perspective, NATO should move from a reactive mosaic of initiatives toward a more coherent model for assessing and responding to hybrid threats. The foundation of such a model could be a NATO “cumulative-threshold matrix.” Its purpose would be to move away from analysing incidents in isolation and instead assess entire sequences of events. Such a matrix would reduce the adversary’s key advantage in the grey zone: the ability to fragment aggression into actions that are each too small, on their own, to cross the traditional threshold of war. In this context, Eastern Sentry should be transformed from a flexible response activity into a permanent architecture for air and counter-drone defence on the eastern flank. This architecture should include short-range radars, electronic-warfare systems, passive sensors, low-cost effectors, interceptor drones, and integrated command and control, so that NATO does not respond to the adversary’s low-cost tools with disproportionately expensive missiles or fighter aircraft.
At the same time, the Alliance should harmonize rules on the use of force and legal procedures through a common catalogue of incidents and response options for drone incursions, GPS interference and infrastructure sabotage. Such a framework should define, among other things, which authority decides on the neutralization of an object, what criteria determine whether it constitutes a military threat, how debris and data should be secured, how attribution mechanisms should operate, under what conditions allied consultations should be triggered, and how evidence may be partially disclosed to the public. This architecture should be complemented by the establishment of a permanent NATO–EU cell for attribution and hybrid resilience, because NATO primarily possesses military, intelligence and planning advantages, while the European Union has regulatory, industrial, infrastructural, and civilian instruments.
Only by combining these competences can the Allies move from a fragmented response to individual incidents toward a coherent deterrence policy.
The upcoming NATO Summit, which will be held on 7–8 July 2026 in Ankara, will test whether NATO once again remains within the realm of “expressing Alliance unity,” or whether it takes real steps toward a coherent, organized, and carefully designed doctrine of deterrence and response to hybrid threats. Drones, spoofing, jamming, cyberattacks, and limited acts of sabotage are effective precisely because they prolong decision-making, increase the costs of response, and leave room for political disagreement over whether Article 5 should be recognized as applicable. This should not lead to the conclusion that the importance of Article 5 ought to be weakened. Rather, it shows that NATO must finally build a bridge leading toward it earlier: through resilience, consultations, a shared situational picture, and a rapid multidomain response.
.svg.avif){kind=small}
