The key facts

  • In September, von der Leyen proposed a European Security Council: a leaders' forum, an emergency security protocol, and funding for shared capabilities such as air defense
  • There is no formal legislative proposal yet: legal basis, voting, budget, and launch date have not been agreed
  • Experts see value in coordination rather than speed of decisions; the main obstacles are national politics

A new initiative amid escalating hybrid threats

Sabotage, arson, cyberattacks, disinformation, and drones in restricted airspace — Russia's hybrid campaign against Europe, as assessed by Euronews, no longer looks like a set of isolated incidents, and the EU is revising its response measures. In September, European Commission President Ursula von der Leyen stated that hybrid threats are becoming 'less and less hybrid and less and less threatening,' and in her State of the Union address put forward the idea of creating a European Security Council.

The EU's current toolkit and its limitations

Ionela Ciolan, a research fellow at the Wilfried Martens Centre for European Studies, characterizes modern Russian hybrid warfare as 'turning everything into a weapon' — from attacks on critical infrastructure and election interference to targeted arson and the use of energy. The EU's response so far has relied on resilience and coordination: the 'hybrid toolbox,' activated in June 2024, combines cyber, sanctions, diplomatic, and support measures; a dedicated sanctions regime against Russia has been created (first listings in December 2024), and rapid reaction teams were deployed for the first time in Moldova in 2025. Analysts note a shift: faster public attribution of responsibility to Russia, more talk of 'imposing costs' on Moscow, and treating incidents as parts of a single campaign. In September, the European Parliament adopted a report calling for a more proactive approach — by 470 votes to 129. Gaps nevertheless remain: sanctions require unanimity, intelligence is fragmented among capitals, and there is no consensus on when sabotage justifies a collective military response.

What is being proposed

The concept consists of three interlinked parts: a permanent leaders' forum, an Emergency Security Protocol, and an instrument for funding shared capabilities, such as air defense. The Protocol is most relevant to hybrid threats: von der Leyen called it Europe's answer to NATO's Article 4, allowing any member state to convene all 27 governments when it considers its security under threat. According to reports, the Commission is considering inviting partners, including the United Kingdom, Norway, Ukraine, and Canada. There is no official legislative proposal: the legal basis, voting system, budget, and launch date have not been agreed.

Expert assessments: coordination instead of decision-making

Luigi Scazzeri, a senior policy analyst at the EU Institute for Security Studies, notes that in von der Leyen's version the Council is essentially a specialized meeting of the European Council with invited partners: 'It is not a decision-making body as such.' This means it will not overcome the disagreements that slow the EU's response. In his view, 'the key value [...] is not necessarily speed, but rather coherence among policymakers': the body would help the EU think strategically about its toolkit — from sanctions to spending — while NATO retains collective defense. Critics, he acknowledges, will point out that Europe already has numerous forums, including the European Political Community.

The problem of the response threshold

A more difficult question is when a hybrid attack becomes truly serious. Ciolan points to Article 42.7 on mutual assistance and the debate about applying it to hybrid attacks: 'A cyberattack that paralyzes hospitals, or sabotage that disables a power grid, can have consequences comparable to those of a conventional military attack.' According to her, Moscow exploits the 'gray zone': 'Russia exploits uncertainty to make it difficult to establish culpability and delay a collective response.' Her conclusion: Europe needs a unified mechanism for assessing attacks and the ability to respond to hostile actions that fall below the threshold of armed aggression. The Security Council and the Protocol, in her view, would help 'move faster from national-level measures to a Europe-wide response,' while the decision to invoke Article 42.7 would remain with the attacked state.

A 'safety net' in case of doubts about the US

Steven Blockmans, deputy director of the International Centre for Defence and Security in Tallinn, links the revival of the idea to doubts about the US's readiness to honor Article 5 of the North Atlantic Treaty. The concept dates back to a 2018 proposal by Angela Merkel and Emmanuel Macron; Blockmans sees the Council as a fallback in case the North Atlantic Council is blocked by Washington or another ally, and links the new impetus to the 'Greenland crisis,' adding that EU defense commissioner Andrius Kubilius has been promoting the idea for over a year. For credibility, he believes, the body needs real powers: 'The legitimacy of the European Security Council would be significantly enhanced if its governance structure provided for decision-making procedures' — with democratic oversight by national parliaments, compatibility with NATO command structures, and a separate budget. This is the ideal scenario, requiring years of treaty work, but 'in case of extreme necessity, an informal structure could be created tomorrow.' Euronews' overall assessment: as a tool against hybrid attacks, the Security Council is only partially suitable — it would improve coordination and provide a venue for discussions, and the Protocol could enable earlier political responses to incidents below the threshold of armed attack, but experts agree that the main obstacles lie in the domestic politics of individual states.