Lesson Overview
Lesson 01 set out how to read an operating environment whole. Lesson 02 located the small state within it. This lesson turns to the threats that environment contains, and it opens by correcting a habit of thought that quietly defeats small states: treating security as a switch with two settings, peace and war, with nothing for the Army to do until the switch is thrown. That picture is wrong. An officer who carries it will be surprised by every challenge that does not arrive as an army.
Security is a continuum. It runs from settled peace, through tension and competition, into crisis, and only at its far end into open war. Almost all of the pressure a small state faces sits below the threshold of war, in a zone where an aggressor can gain ground while denying any clear target for a lawful response. You will learn to see that continuum, to sort the kinds of threat that occupy it, and to recognise the modern hybrid threat: the deliberate weaving of military and non-military means into one coercive effort designed to stay ambiguous and win without ever declaring itself. We treat all of this analytically and defensively, for recognition and resilience. Nothing here teaches how to do any of it; the purpose is to know the shape of the pressure so the Principality can be made hard to coerce and can answer lawfully when it is.
By the end you will be able to describe the spectrum of conflict from stable peace to open war and explain why most challenges to a small state sit below the threshold; distinguish conventional, irregular, and hybrid threats; define a hybrid threat and name the strands it weaves together; explain the grey zone and why coercion there appeals to an aggressor; define lawfare; say why small states are especially exposed; and set out the four-part defensive response of recognition, resilience, lawful attribution and proportionate answer, and unity of effort.
Key Terms
- Spectrum of conflict: the continuous range of security conditions, from stable peace through tension, competition, and crisis to open armed conflict, with no clean line dividing one state from the next.
- Threshold of war: the level of hostile action unambiguous enough that a state, and the watching world, would recognise it as armed conflict and accept a forceful response as lawful and proportionate.
- Conventional threat: coercion or attack by organised, identifiable armed force, fought broadly within the recognised laws and customs of war.
- Irregular threat: coercion through insurgency, terrorism, organised criminal disorder, or other violence by actors who avoid open battle and hide among the population.
- Hybrid threat: the deliberate, coordinated blending of military and non-military means (economic, informational, cyber, political, and proxy) to achieve an aim while remaining ambiguous and below the level that would provoke a clear response.
- Grey zone: the contested space below the threshold of war, where hostile action is real but kept deniable, so that it gains ground while denying the target a clear basis for lawful force.
- Lawfare: the misuse of law, through manufactured claims, bad-faith appeals to process, or vexatious litigation, as a weapon to constrain, delay, or delegitimise an opponent's lawful action.
- Proxy: an actor (irregular fighters, a criminal network, a deniable maritime fleet, an online persona) used by a sponsor to act on its behalf while preserving the sponsor's deniability.
- Attribution: establishing, to a usable standard of confidence, who is responsible for a hostile action; the precondition of any lawful and proportionate response.
- Resilience: the capacity of a society and its institutions to absorb a shock, keep functioning, and recover, so that pressure short of war fails to achieve its aim.
Security as a continuum, not a switch
Discard the two-box model. It is comfortable because it is simple, and dangerous for the same reason. A state's security shifts by degrees, and the most consequential movements happen long before anyone would say a war has begun. Hold the idea as a band running from the most settled condition to the most violent.
STABLE TENSION COMPETITION CRISIS OPEN
PEACE WAR
|-------------|------------|--------------|------------|--------|
routine rival aims coercion acute declared
cooperation; stated short of confront- armed
trade, openly; force; ation; conflict;
exchange, friction pressure brinkmanship the law of
open but no applied and near the armed
borders force denied threshold conflict
applies
|<------------------ GREY ZONE ------------------>|
| hostile action kept deniable and ambiguous, |
| designed to win below the threshold of war | THRESHOLD
| | OF WAR --->
Read from the left. Stable peace is routine cooperation: trade, exchange, disagreements handled through ordinary diplomacy. Tension arrives when rival aims are stated openly and friction sets in, but no one reaches for force. Competition is sharper: pressure is applied deliberately, but in deniable forms that fall short of anything the target can name as an attack. Crisis is acute confrontation, brinkmanship close to the threshold, where a single miscalculation could tip the situation over. Only at the far right is open war, declared or undeniable armed conflict, the domain governed by the law of armed conflict and studied in The Law of Armed Conflict for Soldiers (PME 201).
Three things follow, and each matters more to a small state than to a large one. First, the movements that decide outcomes are the quiet ones in the middle of the band, not the loud one at its end: a state can be steadily disadvantaged, its options narrowed, its public divided, its infrastructure made unreliable, without a shot being fired. Second, no bright line announces itself; the threshold of war is a zone of judgement, not a fence, and an adversary's whole effort may be devoted to operating just to the left of it. Third, the Army's relevance does not begin at the threshold. It contributes across the whole band, mostly through presence, readiness, resilience, and disciplined reporting rather than combat. An officer who believes the job starts only when the war does has misread the map.
The broad kinds of threat
Within that band, threats come in three broad kinds. The distinction is not academic; it tells you what you are looking at and therefore what response is even appropriate.
A conventional threat is coercion or attack by organised, identifiable armed force: recognisable units, uniforms, equipment, a chain of command, fought broadly within the laws and customs of war. This is the threat the two-box model imagines, and the one a small state is least likely to face in isolation, precisely because it is the most visible and the most likely to draw a clear, lawful response, including from partners. A conventional attack announces its author and its character. That clarity is exactly what a calculating aggressor prefers to avoid.
An irregular threat is coercion through violence that hides rather than declares itself: insurgency, terrorism, organised criminal disorder, intimidation by armed groups who avoid open battle and shelter among the population. It blurs the line between combatant and civilian, which makes it hard to counter lawfully and makes restraint and discrimination demanding. For the small state it is studied mainly through public order and support to the civil authority, the subject of Aid to the Civil Power and Public Order (HCR 210), because at home an irregular threat is most often a policing problem the Army may lawfully support, not a war to be fought.
A hybrid threat is the third kind, and the one this lesson exists to teach, because it is the kind a small state is most likely to meet and least likely to recognise in time. It is not a fourth weapon added to the other two; it is a method of combining all of them, and much else, into a single coordinated effort. To understand it, look at how the strands are woven together.
What a hybrid threat is
A hybrid threat is the deliberate, coordinated blending of military and non-military means to achieve an aim while staying ambiguous and below the level that would provoke a clear response. The word that matters is coordinated. Any state at any time faces economic pressure, the odd cyber intrusion, hostile rumours, and rival diplomacy; this is the background noise of international life. What makes a threat hybrid is that these strands are pulled together by a single hand toward a single objective, timed so that each reinforces the others and none, alone, is clearly an act of war.
Picture the strands as separate threads twisted into one cord, because the danger lies in the twisting, not in any single thread.
STRAND twisted into ...
----------------------
Military signalling \
(exercises, probes, \
deniable incidents) \
\
Economic pressure \
(coercion, dependency, \________________________
selective sanction) / \
/ \
Information and / H Y B R I D > a single
disinformation / T H R E A T / coercive
(narratives, doubt) / (one hand, / effect,
/ one aim) / kept below
Cyber disruption / / the threshold
(outages, intrusion)/____________________________/ of war
\ /
Political subversion \ /
(division, capture, \ /
funded discord) \ /
\ /
Proxies \ /
(deniable actors \________________/
acting for a sponsor) no single strand,
alone, is clearly war
Take the strands one at a time; an officer must recognise each in isolation before seeing them combine.
Military means appear not as open attack but as signalling and pressure: an exercise timed to a sensitive moment, repeated probing of borders or waters, a deniable incident that may or may not have been deliberate. Force is cast as a shadow over decisions without being committed.
Economic pressure exploits dependency. A small state that relies on a narrow range of trade, fuel, finance, or a single export market is exposed through that channel, whether by selective sanction, sudden withdrawal of a contract, or quiet pressure on a key supplier. Economic strands are attractive because they are easily disguised as ordinary commercial decisions.
Information and disinformation are the connective tissue of the hybrid threat. Narratives are placed and amplified to sow doubt, divide a public from its institutions, and degrade trust, so that even a lawful, competent response is disbelieved. This strand is so central to modern pressure on small states that Lesson 04, on information, disinformation, and the cognitive domain, is devoted to it.
Cyber disruption ranges from intrusion and theft to disabling services a society depends on. An outage at a port, a payment system, or a utility imposes real cost while remaining hard to attribute and easy to deny. Cyber and information strands increasingly run together, an outage made worse by a rumour; Lesson 05, on cyber, infrastructure, and critical dependencies, takes up that pairing.
Political subversion works on institutions and cohesion: funding discord, cultivating influence, deepening divisions, or capturing a point of leverage in public life. Its aim is to make the state act against its own interest, or to leave it unable to act at all.
Proxies thread through all of the above. A proxy acts on a sponsor's behalf while preserving the sponsor's deniability: irregular fighters, a criminal network, a maritime fleet that may be civilian or may not, an online persona real or manufactured. The proxy lets the sponsor reach across the threshold with its own hand hidden.
The point of weaving the strands together is not greater force but greater ambiguity. Each, alone, sits below the threshold and can be explained away. Combined, they can narrow a state's choices, erode its will, and seize an advantage, all without the clear, attributable act that would justify and rally a forceful response. That ambiguity is the weapon, and the grey zone is where it is wielded.
The grey zone and lawfare
The contested space below the threshold of war is the grey zone: neither the white of settled peace nor the black of open war, and kept deliberately unclear. Hostile action there is real, imposes cost, and pursues an aim, but it is kept deniable, so that it advances while denying the target a clear basis for lawful force.
Why does the grey zone appeal to an aggressor? Because it offers the gains of coercion without the costs of war. Set out the calculation plainly, so it can be recognised and not copied. Open war against even a small state is expensive, legally exposed, and likely to unite the target's public and summon its partners; it is the option of last resort. Grey-zone pressure inverts every term. It is cheap: information operations, cyber intrusion, and proxies cost a fraction of mobilised force. It is deniable: no single act is unambiguously an attack. It is gradual: no one moment is dramatic enough to trigger a response, yet the cumulative effect is large, the position shifting decisively by steps each too minor to fight over. And it denies the target a target in return: against whom would force be used, on what evidence, and would the world accept it as proportionate? The aim is to gain ground while the defender is still arguing about whether anything has happened.
One grey-zone tool deserves naming because it weaponises the small state's own commitments: lawfare, the misuse of law as a weapon. It manufactures legal claims, appeals to process in bad faith, or uses vexatious litigation and procedural delay to constrain, delay, or delegitimise lawful action. A state that genuinely binds itself to the law, as the Principality does and should, is in one sense more exposed, because an adversary can turn that commitment into a lever: tie up a lawful action in spurious dispute, dress aggression in the language of grievance and rights, or generate a false legal record to cite later. The defence is not to loosen one's commitment to the law, which would surrender the very asset that makes a small state credible. It is to be so genuinely lawful, so well documented, and so clearly proportionate that manufactured claims find nothing real to fasten onto. As Lesson 02 and this College argue throughout, lawful conduct is not a constraint on a small state's strength but a source of it. Lawfare is the attempt to turn that strength into a vulnerability, and disciplined, documented lawfulness defeats the attempt.
Why small states are especially exposed
Everything above bears more heavily on a small state, and the reasons shape the defence.
The first is limited resilience. A small state has fewer redundancies: a handful of ports rather than dozens, a thin power grid, a narrow economic base, a small public, a lean set of institutions. A shock a large state would absorb without notice can disable a critical function of a small one. The aggressor aims at the thin points, because the same disruptive effort buys far more leverage against a small target. Resilience is therefore not a comfortable extra but the centre of a small state's defence, and the subject of Lesson 06, on comprehensive security and whole-of-society defence, and of Emergency Preparedness and Civil Resilience (HCR 220).
The second is the difficulty of attribution. Deniability is engineered into every grey-zone tool, so attribution is hard for any state. A small state, with thinner intelligence and forensic capacity, finds it harder still to say who turned off the port, who placed the rumour, whose fishing fleet that really was. Without confident attribution there can be no lawful and proportionate response, because force without a known author is neither lawful nor wise. The whole architecture of the grey zone is built to keep the defender below the line of confident attribution.
The third is the temptation it creates in a stronger actor. A larger power weighing how to pressure a small state finds open war unattractive for the reasons given: costly, exposed, likely to summon the small state's partners. Grey-zone coercion offers it the same ends without those costs or the consequences of naked aggression. The small state is thus an especially tempting object: weak enough to be coerced, valuable enough to be worth coercing, and able to be coerced deniably. The asymmetry that makes open war unlikely is the very thing that makes hybrid pressure likely.
Put the three together and the picture is plain. The most probable threat to a small principality is not an armoured column crossing a frontier. It is sustained, deniable, ambiguous pressure across several strands at once, aimed at its thinnest points, calibrated to stay below the threshold, and designed to win before the small state can establish that it is under attack. Knowing the true shape of the danger is the necessary first step of any defence.
The defensive response in outline
Because this is an analytical and defensive course, it teaches the response only in outline; the detail belongs to the lessons and courses that follow. But leave this lesson holding the four pillars by which a small state answers hybrid and grey-zone pressure.
The first pillar is recognition and early warning. The grey zone works by ambiguity, so the first defence is to see clearly: to recognise that ambiguous incidents may not be accidents, that a cluster of small pressures may be one coordinated effort, and to report disciplined observation so the pattern can be assembled before it matures. The Basic Training Manual insists that the likely first sign of pressure is not a column but a rumour, an outage, a probing incident, which is why disciplined reporting is named the first defence. An officer's contribution begins here, with the trained habit of noticing and reporting accurately, separating what was observed from what is inferred.
The second pillar is resilience across society. Because hybrid pressure targets the whole society, not just its army, the defence must be whole-of-society. Hardened infrastructure, redundancy in critical systems, a public informed enough to be hard to deceive, and institutions that keep working under stress all blunt the grey-zone tool by denying it the easy effect it seeks. The Army is one contributor to this among many, not its whole.
The third pillar is clear attribution and a lawful, proportionate response. When pressure can be confidently attributed, the State can answer, and the answer must be lawful and proportionate to be effective as well as right. It need not be military and rarely is at this level; it may be diplomatic, economic, legal, or simply the public exposure of a deniable act, which strips the aggressor of its ambiguity. The College's standard applies here too: the response that holds is the one that can be defended afterwards, because a small state cannot recover lost legitimacy through any later success.
The fourth pillar is unity of effort. Because the threat is woven across military and non-military strands, the defence cannot be the Army's alone. It must join the Army, the civil authorities, the Organs of State, partners abroad, and the public into one coherent effort, so the strands of the threat meet a corresponding unity rather than a fragmented patchwork an aggressor can play off against itself. The Army's place is the disciplined, lawful, supporting one this College has taught from the first module.
None of the four pillars is a method of attack. The defence of a small state against hybrid pressure is built from clarity, resilience, lawfulness, and unity, not from mirroring the aggressor's methods.
In Practice: A Quiet Week in the Port District
Consider a generic small coastal state and an unremarkable week in its main port district. No war has begun. Nothing in the week, taken alone, would reach the threshold of armed conflict or even raise much alarm. That is the point.
Monday: the port's cargo-handling system suffers an outage. The operator assumes a technical fault; service is degraded for a day and partly restored. Tuesday: a story circulates online claiming the outage spoiled refrigerated medical stock and that the authorities are concealing it. The claim is false, but it spreads faster than the correction, amplified by accounts no one can quite identify. Wednesday: a fishing fleet lingers just outside the harbour approaches, neither clearly inside forbidden waters nor clearly doing anything that can be named; harbour staff are unsettled but have nothing to act on. Thursday: a foreign buyer abruptly suspends a long-standing contract with a major local exporter, citing ordinary business reasons. Friday: a complaint is lodged through an international body alleging the port authority acted unlawfully toward foreign vessels, framed in careful legal language, unsupported by fact, but now on the record to be cited later.
Each event is deniable on its own: an IT fault, an internet rumour, lawful-looking fishing, a commercial decision, a legal complaint. Not one crosses the threshold, and a state that reads security as a switch sees five unrelated nuisances and waits for a war that does not come. Sort the events onto the strands, though, and the pattern stands out: cyber disruption, disinformation, deniable military signalling by proxy, economic pressure, and lawfare, five threads twisted into one cord inside a single week, each reinforcing the others. The outage bites harder through the rumour; the rumour gains weight from the fishing fleet; the complaint lays ground for a later claim that the small state is the aggressor.
Now apply the pillars. Recognition is the hinge: the officer or official who notices that five small things in one week may be one large thing, and reports the pattern rather than dismissing each piece, performs the most valuable act of the week. Resilience decides the cost: a port with redundancy recovers quickly, an informed public denies the rumour its purchase, an exporter with more than one market shrugs off the lost contract. Attribution and lawful response is the patient work of establishing who stood behind the deniable strands and answering proportionately, most powerfully here by exposing the coordination publicly and destroying the ambiguity that gave it power, while keeping the port authority's conduct so lawful and documented that Friday's complaint finds nothing to grip. Unity of effort makes any of this possible: port operator, civil authorities, Organs of State, and the Army's reporting and presence must be joined, because no one of them, looking only at its own strand, would see the cord at all.
The week ends with no war and, if the state read it correctly, no real gain for the actor behind it. But it could have gone otherwise. A state that saw five accidents, had no redundancy, believed its own rumours, answered unlawfully out of frustration, or whose institutions never compared notes would have been quietly weakened without ever being attacked in any sense it was prepared to recognise. The grey zone is won and lost in exactly such weeks.
Check Your Understanding
- Explain why security is better understood as a continuum than as a switch, and say where on it most challenges to a small state actually sit. Why does the threshold of war function as a zone of judgement rather than a clear line, and why does an aggressor want to operate just to the left of it?
- Distinguish a conventional, an irregular, and a hybrid threat. Then define a hybrid threat precisely and name at least four of the strands it weaves together, explaining why the coordination matters more than any single strand.
- What is the grey zone, and give three reasons it appeals to an aggressor weighing it against open war. Define lawfare and explain why a small state's genuine commitment to the law can be exploited through it, and why the right defence is to deepen that commitment rather than weaken it.
Reflection (write a short paragraph): The vignette turns on a single week in which five deniable events, each harmless-looking on its own, formed one coordinated hybrid effort, and on whether anyone recognised the cord rather than the separate threads. Consider why recognition is harder than it sounds: the pull to read each event as an isolated accident, the absence of any dramatic moment to react to, the institutional habit of each office watching only its own strand. Describe what makes an officer or an Organ of State able to see the pattern in time, what is lost if no one does, and why disciplined, accurate reporting that separates the observed from the inferred is the first and most important contribution an officer can make to a small state's defence below the threshold of war.
Summary
- Security is a continuum, not a switch, running from stable peace through tension, competition, and crisis to open war. Almost all of a small state's challenges sit below the threshold, where movements are quiet but decisive.
- Threats come in three broad kinds: conventional (organised, identifiable armed force), irregular (insurgency, terrorism, and criminal disorder that hide among the population), and hybrid (these and much else combined into one coordinated effort).
- A hybrid threat twists military signalling, economic pressure, information and disinformation, cyber disruption, political subversion, and proxies into one cord, to achieve an aim while staying ambiguous. The coordination is the weapon, because each strand alone can be denied.
- The grey zone is the deniable space below the threshold, attractive because it is cheap, deniable, and gradual, and because it gains ground while denying the target a clear basis for lawful force. Lawfare turns a state's own commitment to the law against it; the answer is to be so lawful and well documented that manufactured claims find nothing to grip.
- Small states are especially exposed: limited resilience, harder attribution, and a tempting asymmetry for a stronger actor. The defensive response rests on four pillars, recognition and early warning, resilience across society, clear attribution with a lawful and proportionate answer, and unity of effort. None is a method of attack; the defence is built from clarity, resilience, lawfulness, and unity.
Crown Copyright © 2026 | Published by Authority of H.R.H. The Prince of Kaharagia