Belgium warns of the risks of hybrid warfare: The role of cyber, disinformation, and AI

Hybrid warfare, particularly in the cyber and information domains, is posing increasingly complex challenges to national and international security.

These were among the key messages of a virtual Fireside Chat organized by IWI Project Europe, featuring Major-General Pierre Ciparisse, Commander of the Belgian Cyber Force and head of the Belgian Cyber Command within the Belgian Military Intelligence Services.

Appointed to the post in September, General Ciparisse emphasized that hybrid threats are primarily characterized by ambiguity and asymmetry. According to him, attributing hybrid attacks requires time and in-depth analysis, often leaving a degree of uncertainty. This, in turn, forces defending states to invest substantial resources to maintain an effective defensive posture against a wide spectrum of threats.

Reflecting on whether hybrid threats are truly new or simply “old wine in new bottles,” Ciparisse acknowledged the existence of historical precedents, such as SOE operations during the Second World War. However, he stressed that cyberspace has fundamentally changed the scale and impact of such activities. In his view, cyberspace must be understood across three layers: physical, logical, and cognitive, which together significantly expand the potential for hybrid operations.

Technology—particularly artificial intelligence (AI)—is serving as a force multiplier for hostile actors, especially in information warfare and cybercrime. AI enables the rapid production of highly persuasive content and more sophisticated phishing campaigns. At the same time, Ciparisse noted that AI also holds great promise for defense. The main challenge, however, remains the rapid pace of technological development, which requires continuous investment in skilled personnel and analytical capabilities.

The general distinguished between the evolution of attack techniques and the actors behind them. As tools and malware are easily recycled and adapted, the number of attacks has increased significantly, leading to an acceleration of both cyber-attacks and disinformation campaigns.

Russia was mentioned as a major actor, but not the only one. Belgium, he said, regularly experiences DDoS attacks following public statements of support for Ukraine, while China is primarily associated with cyber espionage.

Despite these trends, Ciparisse remained cautiously optimistic, noting that so far most attacks have not caused systemic damage. However, he warned that coordinated, multi-dimensional attacks, particularly against critical infrastructure, could have catastrophic consequences.

Belgium’s approach to cybersecurity

In Belgium, responsibilities for countering hybrid threats are shared among several actors:

The Centre for Cybersecurity Belgium, responsible for the national cybersecurity strategy;

The State Security Service, focused on internal threats;

The Cyber Command within Military Intelligence, addressing external threats.

When risks exceed a certain threshold, the Crisis Centre is activated to ensure broader coordination. The media and strategic communication also play a crucial role in exposing and countering disinformation.

General Ciparisse emphasized the importance of a whole-of-society approach, enhancing citizens’ critical awareness in their use of AI and consumption of information. He highlighted the role of major industrial players in strengthening cyber resilience, stressing that “it takes a network to defeat a network.” In Belgium, this philosophy is reflected in Agoria’s “Cyber Made in Belgium” initiative.

Finally, the discussion focused on the role of cyber forces in military campaigns, particularly below the threshold of armed conflict. Referring to the war in Ukraine, Ciparisse identified three phases:

Destabilizing operations below the threshold of war;

A short phase at the onset of the invasion with closer synchronization between cyber and kinetic operations;

The ongoing use of cyber capabilities to support military targeting processes.

In conclusion, he stressed that while the cyber domain is essential, it is insufficient on its own to determine the outcome of modern wars.