The battle for the mind: How Europe can stay safe in the cognitive threat era

Borders, airspace and the information sphere are not the only battlefields Europeans face. Those wanting to weaken Europe have another option: the public’s minds. Using a mix of propaganda, disinformation, physical and cyber threats, cognitive warfare seeks to alter perceptions, emotions and behaviour, and ultimately, sow chaos. Yet Europe’s defence architecture is built for a different era—one of clear enemies, distinct timelines and identifiable campaigns. This makes it vulnerable.

Russia and China, among others, are now operating in a world where it is increasingly easy to weaponise information. Criminal networks, proxy media outlets with commercial incentives, and digital media platforms that reward outrage over accuracy all amplify manipulative content. The combined effect is a strain on public trust—as seen in Russia’s information warfare on Baltic democracies to its coordinated drone incursions. The impact varies with local politics, language and culture, which is precisely what makes it difficult to understand, prepare for and respond to through any single institution or framework.

Several trends are accelerating cognitive warfare. Generative AI has slashed the cost of producing and localising manipulative content at scale. The attention economy, meanwhile, provides a ready market for it, rewarding engagement over accuracy across platforms that have little regard for where content originates or who is behind it. This content then becomes part of the data that train AI systems, further compromising their integrity.

These are not conditions that tighter regulation or better attribution alone will fix. The EU and its member states need to bring their coordination up to the task in three key ways:

1. React quickly

Cognitive warfare is effective partly because it exploits time. Even when disruptions are detected early, official EU or member state interpretation is held back until incidents are formally classified or attributed. However, the window for shaping how the public understands an event is short and many actors are competing to fill it. By the time official statements arrive, perception has already settled.

This can be seen in Russia’s recent airspace disruptions across Europe. Analysis of drone-related incidents in Poland, Denmark and Germany during autumn 2025 found a pattern: within 15 to 45 minutes of drone sightings and airspace closures, coordinated Russian-aligned narratives were already circulating through proxy outlets and messaging apps like Telegram. The physical disruption and narrative distortion worked together, framing events, assigning blame and questioning institutional competence well before authorities issued verified statements. When the official response arrived, these early narratives had already established the baseline from which everything else was judged.

Without mechanisms to interpret disruptions as part of a broader campaign in near real time, European institutions are repeatedly forced to decide after narratives have already hardened. The graphic below shows how coordinated narrative operations unfold. In each phase, actors exploit the gap between event and official response by entrenching contested versions of what occurred.

European institutions need to change when and how they interpret what is happening to them. Rather than treating hostile influence as something to be analysed after the fact, the response needs to be rapid. It also needs to look beyond individual incidents to recognise patterns and escalation as they unfold by using structured frameworks like DISARM. This currently classifies the tactics and techniques used in influence operations but should be broadened to include the cognitive domain. With this, Europeans can better understand and connect the true breadth of these multifaceted attacks and react more effectively. And, as institutions like NATO and the EU come to recognise cognitive warfare as a threat, they should also focus on understanding how influence infrastructure is maintained, adapted and reactivated across events and regions. This could sit within existing structures such as the EU’s External Action Service or be standalone.

2. Develop a coordination framework

Once recognised, these institutions need to respond. Authority to act on hybrid and cognitive threats is currently spread across governments, private companies and regulatory bodies, each operating under their own rules, mandates and concerns. These constraints shape when and how action can be taken—which attackers can use to their advantage.

On top of this, the same commercial dynamics that amplify the impacts of cognitive warfare also make private actors less willing to respond. Between 2022 and 2025, major platforms reduced their commitments to the EU’s Code of Practice on Disinformation by nearly a third, with fact-checking commitments falling by over 60%. In Romania’s 2024 presidential election, for example, TikTok’s measures against coordinated manipulation were only strengthened after the election was annulled and a European Commission investigation was launched. An effective response therefore requires not just early coordination but also frameworks that make this an easy choice for companies and public authorities.

The EU has a precedent for this. In the financial sector, the Systemic Cyber Incident Coordination Framework establishes protocols between public authorities and firms for cross-border cyber-attacks. It has designated contact points and established coordination procedures. Broader financial architecture follows a similar logic: national supervisory bodies monitor local conditions and have a structure for escalating concerns up to European Central Bank- and European Systemic Risk Board-level coordination. That same logic—local detection feeding into centralised decision-making via protocols—will work for responding to cognitive threats too.

In practice, this means three things. First, a shared threat picture allows frequently targeted sectors (such as energy, aviation and digital platforms) make faster decisions based on a common understanding of what is happening rather than isolated incident reports. Second, pre-agreed response procedures between public authorities and critical infrastructure operators mean that coordination is rehearsed, not improvised. Finally, an institution with this shared picture can make more informed, timely and independent decisions.

3. Streamline the response

European coordination mechanisms are organised along institutional, sectoral or thematic lines. While each is valid in isolation, they rarely feed into a shared picture that accounts for the regional variation that cognitive warfare exploits. For example, those Russian drone incidents affected aviation security, online platform governance and critical infrastructure prompted national and local responses across different countries—all of which were disconnected.

Matters are complicated further as Europe faces not one adversary but several. Russian-linked operations are the most documented. China, meanwhile, operates through economic leverage, diaspora influence, transnational repression and cyber operations that increasingly overlap with Russian activity. National agencies and law enforcement across Europe are beginning to recognise and respond to these threats within their own jurisdictions. What is missing is the coordination architecture that connects detection and response across the continent into one picture that can then feed into decision making at EU- and NATO-level.

The Hybrid Centre of Excellence in Helsinki provides an example of connecting the EU and NATO, but only for the threat dynamics on Europe’s eastern flank. The Mediterranean also presents distinct pressures: migration-linked narrative weaponisation, energy and maritime infrastructure vulnerability, the expansion of Russian-directed military operations across north and west Africa and Kremlin-aligned proxy activity across media in Spanish, French and Arabic. The Helsinki model addresses the Russian threat in the east, but Europe’s current resilience leaves these southern vulnerabilities largely underexamined.

Southeast Europe and the Western Balkans are another hotspot. There, Russian economic coercion, energy dependencies and coordinated information manipulation target EU enlargement and democratic consolidation. The recent experiences of Moldova and Romania, where foreign interference in electoral processes prompted unprecedented institutional responses, revealed how far cognitive threats had progressed before governments took action—and the consequences for European democratic integrity.

With local dynamics in mind, these regions should be viewed together to create a common operating picture of cognitive threats. Building on the Helsinki model, this would allow the EU and NATO to identify how global campaigns are built from local efforts and track tactics as they migrate across regions. Europe’s geographic and linguistic diversity does not have to be a vulnerability. If used correctly, it can become a source of resilience against cognitive warfare.

How Europe can tell its own story

None of this requires new regulation, just mechanisms to coordinate how threats are interpreted and addressed. There is a strong case for doing so. The war in Ukraine has exposed a dual dynamic: a conventional conflict where gains are measured in kilometres and one played out in the information space. If Russia can convince Europeans that its victory is inevitable, it can push for better terms in negotiations, fracture European solidarity and blame failure on others. The same logic applies below the threshold of armed conflict—in the drone incidents, the sabotage campaigns and electoral interference. When Europe cannot interpret events, connect the dots and respond quickly, it does not just fail operationally but cedes the narrative space entirely.

Now that America is not the ally it once was, Europeans should learn how to be self-sufficient in responding to cognitive warfare. Europe’s distributed power is not a weakness: its leaders can use the EU for economic leverage, NATO for deterrence, national agencies for local interpretation and civil society for resilience. This architecture needs only to be connected. The three mechanisms outlined here are not just institutional reforms. They are the precondition for Europe’s ability to tell its own story before the terms of that story are set for it.