State of Hybrid Conflict: Fall 2025

An intrusion into infrastructure can matter before it causes an outage. Access may support espionage, provide an option for later disruption, or simply reflect an attacker exploiting an available weakness. Establishing which explanation fits requires more than finding the intrusion.

This fall 2025 assessment examines that problem across autonomy, cyber access, economic pressure, and information operations. It is a framework for connecting observations while keeping attribution and intent open to investigation.

Autonomy changes the decision process

AI-assisted systems can support sensing, planning, and some forms of coordination. The operational effect depends on which function is automated and how a person can review or interrupt it.

Drone activity in conflict provides a reason to examine production, communications, electronic warfare, and command arrangements together. It does not justify assuming that every coordinated attack uses an autonomous swarm or a language model.

Initiatives such as the U.S. Replicator effort express an interest in fielding attritable autonomous systems at scale. Program ambitions, procurement, delivery, and demonstrated performance are different milestones. An assessment should identify which one its evidence supports.

The important command question is whether the speed of a process leaves enough time to detect an error and respond. Automation may shorten a task without resolving uncertainty about its inputs.

Investigate persistent cyber access

Pre-positioning describes access retained for possible future use. It is a significant concern where a compromised system supports power, communications, logistics, or other essential functions.

The presence of access does not reveal the future action by itself. Examine account use, reconnaissance, persistence, and the functions the attacker could reach. Preserve the distinction between observed behavior and an assessment of purpose.

Undersea cables and other shared infrastructure deserve attention for similar reasons. An interruption can have consequences across borders, but damage may result from accidents or technical faults. Restoration and attribution are related tasks with different evidence requirements.

Connect economic pressure to an objective

Semiconductors, critical materials, and transport corridors can become sources of political leverage. Their importance comes from the time and cost required to replace them.

Assess restrictions and dependencies individually. Identify what changed, who was affected, and whether a political demand accompanied the measure. Ordinary commercial competition and deliberate coercion can overlap, but they should not be treated as interchangeable.

The operational implication is to map substitution options before a crisis. A supplier list is incomplete if every supplier depends on the same upstream component.

Separate content production from influence

Generative tools can help produce plausible text, audio, and imagery. Distribution networks can then repeat the material across platforms. Neither output volume nor repetition establishes that the intended audience changed its behavior.

Investigate the source, timing, amplification, and observable consequences. A narrative may exploit an actual incident, distort an authentic recording, or invent an event. Those mechanisms require different checks.

Reliable crisis communications help by giving people a source they can inspect and revisit. Publish corrections visibly and explain changes in the assessment.

Examine intermediaries without assuming control

Private military organizations, hired cyber operators, and politically aligned groups can complicate attribution. Their relationships with governments differ in funding, direction, dependence, and autonomy.

Shared rhetoric may justify a lead for investigation. Claims of state control need additional support. Keep criminal activity, ideological participation, and directed operations distinguishable even when they use the same platforms or services.

Turn the assessment into a working plan

Pressure	Question to investigate	Preparation
Machine autonomy	Which decisions are automated, and how are errors detected?	Test oversight and failure procedures
Persistent cyber access	What can the intruder reach, and what activity is observed?	Improve evidence collection and containment plans
Economic dependency	How long would replacement take?	Test suppliers and substitution options
Information manipulation	What is the source, reach, and demonstrated effect?	Maintain verifiable public communications
Proxy activity	What supports a claim of direction or sponsorship?	Coordinate evidence and attribution work

Exercise a scenario involving an infrastructure interruption and misleading public reports. Include service operators, technical responders, communications staff, and the people authorized to make consequential decisions.

Hybrid conflict creates a reason to connect evidence across domains. It also creates a risk of seeing coordination everywhere. A useful assessment preserves both the possible relationship and the observations that could disprove it.