From a False Sense of Security to Demonstrable Resilience

A New Reality for European Organizations

Since 2022, Europe has been in a sustained phase of hybrid pressure. What began as incidents on the continent’s fringes has evolved into a pattern affecting almost every NATO country, from the Norwegian fjords to the Polish border and German airports. In 2024, the North Atlantic Council formally determined that Russia is held responsible for hybrid attacks, including sabotage, cyber operations, and disinformation, against countries such as the Czech Republic, Estonia, Germany, Latvia, Lithuania, Poland, and the United Kingdom (NATO statements, May and December 2024). This is not an isolated incident; it is a strategy, and its execution is deliberately indirect: not through recognizable military units, but through local criminal networks, recruited civilians, and shipping that is difficult to trace back to a state (Newsmax/The Telegraph, August 2026; PBS News). This very ambiguity makes a strong counter-response difficult, which is precisely the goal.

The U.S. Congressional Research Service confirms this picture with concrete cases: a cyberattack on a Norwegian dam in April 2025 and attacks on thirty Polish energy facilities in December 2025, in addition to repeated airspace violations and physical sabotage against critical installations (CRS, August 2026). Harvard’s Belfer Center interprets this as a deliberate gray-zone strategy against NATO’s eastern flank: actions that remain just below the threshold of Article 5, designed never to provoke a formal military response, but to continuously cause pressure, costs, and uncertainty (Belfer Center, February 2026).

The Pattern Behind the Incidents

When comparing the sources, three recurring lines emerge, and a fourth that hits closer to home than often assumed.

First, the physical layer. In Denmark, intelligence services reported the recruitment of civilians for sabotage against defense companies, and drones with explosives were observed near Leipzig Airport (PBS News). At the Estonian defense contractor Milrem Robotics, suspected arson via local criminal networks is under investigation (Newsmax/The Telegraph, August 2026). These are not remote technical attacks, but operations requiring physical access to sites, buildings, and installations, carried out by individuals posing as couriers, subcontractors, or visitors—precisely the role that regular access control and closing rounds are supposed to intercept.

Second, the maritime and infrastructural layer. Since 2022, there have been repeated sabotage incidents involving telecom cables and gas pipelines on the Baltic seabed, carried out by vessels identified as spy ships (Deccan Herald, December 2024). NATO has since developed an AI tool to detect suspicious vessels, indicating how structurally significant this risk is now considered (Euronews dossier). This category of infrastructure, subsea cables and pipelines, does not stop at the Baltic Sea: the same type of connection runs throughout Northwest Europe, with the Netherlands being one of the densest landing zones.

Third, the economic impact. S&P Global Market Intelligence estimates the damage from alleged Russian-orchestrated sabotage between 2022 and 2025 at hundreds of millions of euros, with a further increase expected in 2026 (S&P Global, November 2025). Sabotage is no longer a theoretical risk; it is a cost, and that cost is growing.

And that brings the fourth line closer than many organizations realize. The Netherlands is not an observer on the sidelines of this playing field but is in the midst of the same infrastructure chain that is being attacked above. Rotterdam is Europe’s largest port and a hub for energy and goods flows to the entire continent. The Dutch North Sea coast is one of Europe’s densest landing zones for subsea telecom cables and pipelines, and the country hosts Joint Force Command Brunssum, one of the most important NATO headquarters on the continent. None of the sources in this document report a verified incident on Dutch soil, and that is precisely the point: the absence of an incident so far is not proof of resilience; it could just as easily mean that the next link in the chain is yet to come. Anyone who sees the pattern from Oslo to Tallinn and compares it with their own infrastructure will not see a distant problem, but a matter of when, not if.

Important to note: these are journalistic and policy analytical sources, based on Western intelligence services. Russia denies the accusations. Nevertheless, the threat perception is now widely shared among governments, NATO, and businesses, and organizations, including those in the Netherlands, would be wise to focus on their resilience now, not after the first incident occurs here.

The Real Problem: A False Sense of Security

The reflex of many organizations is to expand measures: more cameras, more access control, more procedures. But the core of the problem is not the absence of measures—most organizations have them. The core lies in whether they actually work when someone deliberately tries to circumvent them.

This is the difference between an audit and validation. An audit determines whether a measure is in place and whether policies are followed, based on documents and interviews. Validation tests whether that measure holds up in practice against a realistic scenario. “There is a camera” is not an answer. “The camera detects anomalous behavior and demonstrably leads to the correct action” is. Without this test, a false sense of security arises: the feeling of being secure, without the proof. The question is not whether an organization has security measures. The question is whether they function when someone actually tests them.

Given the nature of the threats described above, focused on physical access, closing rounds, human action under pressure, and alarm follow-up, this is precisely the domain where a false sense of security poses the greatest risk.

The Security Chain as a Framework for Assessment

Resilience against hybrid threats breaks down into a chain of eight links, each of which must be sound individually. If one link fails, the chain fails.

1. Intelligence Knowing which threat actors and modus operandi are relevant to one’s sector and location, tailored to real-world cases as described above, not in general terms.
2. Preparation Translating that knowledge into scenarios, protocols, and assigned responsibilities before an incident occurs.
3. Physical Access The first hard test: do fences, locks, and access control withstand a determined attempt, even outside office hours.
4. Detection Is anomalous behavior actually seen by cameras, sensors, or surveillance, instead of images going unnoticed.
5. Assessment The human link: is a signal correctly interpreted as a threat, or does it get lost in the noise.
6. Response Is the correct action initiated within a realistic timeframe by the right people.
7. Escalation Does an incident reach the appropriate organizational level or authorities in a timely manner.
8. Continuity Recovery and learning: does the organization continue to function, and is the chain demonstrably stronger after an incident.

The Role of Cocoon

The threats in this document combine cyber and physical, but access to a dam, a power plant, or a defense company ultimately occurs via a fence, a lock, or a person who is granted entry. Cocoon no longer positions itself solely as a provider of awareness, but as a partner for physical security validation: testing, improving, securing. This directly aligns with the chain above. Instead of assuming that intelligence, detection, or response work, Cocoon independently tests each link against realistic scenarios, based on current threat developments in Europe. Where an audit offers a snapshot, Cocoon provides proof that a measure holds up under pressure, and where it does not, the concrete improvement that follows.

In doing so, Cocoon precisely prevents the risk highlighted by the sources in this document: organizations that believe they are resilient to sabotage, recruitment practices, or physical intrusion, but have never tested it. Security validation reveals whether security measures are actually effective in practice against realistic threats, and then ensures that improvements are sustained.

We don’t deliver reports. We build resilience.

TESTING · IMPROVING · SECURING For organizations serious about building resilience against the threats described in this document, a no-obligation consultation with Cocoon is the logical next step. We map out the eight links of your own security chain, test them against realistic scenarios, and show you in black and white where you stand and what is needed to move from a false sense of security to demonstrable resilience.