Across Europe, we are seeing the increasing hybridisation of hostile state threats and extremist violence, presenting a growing challenge to national security. Ranging from harmful online influence operations to the fomenting of violent plots, such hybrid threats are constituting new and emerging pathways for mobilising notably younger target audiences towards dangerous activity, largely enabled through online networks.  

There are growing overlaps in the methodology of extremist organisations and hostile states, especially in the increasing targeting of young people for recruitment. Teenagers tend to be more susceptible to financial incentives, have a higher risk appetite, and are more easily accessible to ‘gig economy’ style hiring on platforms such as Telegram and Snapchat, recording content as proof they have completed the mission. This dynamic fits with terrorist trends globally: young people now make up a sharply increasing share of terrorism-related arrests. In the UK, minors aged 17 and under constituted nearly a fifth of terrorism-offence arrests in 2023–four times the proportion of a decade ago. Meanwhile, in the EU, over 29 percent of those arrested for terrorism offences in 2024 were minors. 

There is also considerable overlap in the focus of extremism and hybrid threats, with antisemitism, misogyny, anti-migrant hate and conspiracy theories at the heart of both phenomena. While extremists engage in such activity within a supremacist ideological framework, state actors can perpetuate these harms both as an end in themselves or to weaponise these divisive issues to facilitate the disruption of democratic societies. Across this spectrum, these activities increasingly converge in their harmful impacts on democracy, social cohesion and perceptions of community safety.  

There are also important distinctions between state-backed operations and violent extremism. Hybrid operations in Europe tend to leverage criminal networks for recruitment and sometimes perpetration. As recruits are generally untrained and ideologically uncommitted, their activities tend to be low risk, including surveillance, nighttime arson or vandalism. The core benefit of using proxy recruiters and attackers appears to be providing plausible deniability for the state involved, distinguishing this trend from extremist violence.  

This growing landscape of hybrid threats is directly impacting already stretched security responses. UK Counter Terrorism police are grappling with major increases in state threat cases, now accounting for more than 20 percent of casework, while MI5—the UK’s domestic security service—has seen more than 20 potentially lethal Iran-backed plots since 2022. Germany established a Joint Centre for the Defence Against Hybrid Threats in June 2026 to strengthen the country’s ability to monitor and respond to the growing numbers of hybrid attacks. Such policy approaches to hybrid warfare are moving increasingly from detection and disruption towards more proactive responses, paralleling the growing recognition over the past two decades of the significance of prevention in countering terrorism.  

With these threats growing and capacity limited, it is crucial that European governments learn lessons from the wealth of policy, practitioner and academic insights across these interrelated domains. This paper—which draws on a roundtable discussion with experts from the UK and Germany hosted by ISD and the Konrad Adenauer Stiftung’s UK and Ireland Office—begins to map out a practical framework for policy responses.  

It considers which parts of government are best placed to address these threats. It, additionally, examines the substantive legal distinctions guiding efforts to address state and non-state threats, and their implications for effective joined up responses. And, lastly, it explores how to build durable and flexible whole-of-society prevention approaches in the context of a fast-evolving threat.