The Evolution of the European Centre of Excellence for Countering Hybrid Threats: The “Do Tank” in Europe
I visited the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) in Helsinki in 2018.
It had been established in 2017 and was an ambitious experiment in international cooperation against emerging security challenges.
I decided to take a look at progress since that time and how the Centre has evolved, expanded, and adapted to meet the complex hybrid threat landscape of the 2020s.
Frankly, its evolution is quite amazing. What seemed like a boutique shop thinking about how to get serious efforts dealing with the hybrid threat challenge, it has evolved into a real capability for Europe in its direct defense efforts.
In 2018, the Centre operated as “a small secretariat whose role is to coordinate and ask the right questions, and organize the work” among 13 member states.
The vision was clear but the scope limited.
Fast-forward to 2025, and the transformation is remarkable.
The Centre now encompasses 36 participating states, representing universal participation from all European Union member states and NATO allies.
This expansion reached a symbolic milestone in June 2024 when Albania became the 36th participating state, completing what Director Teija Tiilikainen called “a great achievement” that “signals the willingness of the Euro-Atlantic community to counter hybrid threats in a strongly united manner.”
The evolution from the original 13 members to universal EU-NATO participation demonstrates not only the Centre’s growing relevance but also the increasing recognition of hybrid threats as a shared security challenge.
The Centre’s organizational development has been marked by strong institutional continuity.
Dr. Teija Tiilikainen, who assumed the directorship in 2019, was reappointed for a second five-year term from January 2025 to December 2029.
Her leadership has coincided with the Centre’s most significant period of growth and influence, building on her extensive background including previous roles as Director of the Finnish Institute of International Affairs and Secretary of State at Finland’s Ministry for Foreign Affairs.
Under Tiilikainen’s leadership, the Centre has evolved from the coordination-focused model observed in 2018 to what is now described as a “do tank” that actively conducts training courses and exercises, hosts workshops for policymakers and practitioners, and produces substantive white papers on hybrid threats.
This transformation reflects a maturation from a coordinating body to an operational institution with tangible outputs and measurable impact.
The Centre’s research output has expanded dramatically since 2018, developing a comprehensive publication strategy that addresses the full spectrum of hybrid threats. The publication portfolio now includes Research Reports, Working Papers, Trend Reports, and Hybrid CoE Papers, covering diverse topics from economic security and cyber threats to maritime vulnerabilities and Arctic region challenges.
Recent publications demonstrate the Centre’s responsiveness to evolving threats. Notable examples include research on China’s economic coercion and growing global footprint, Russia’s intensified hybrid threat activities targeting the Baltic Sea region, and innovative approaches such as analyzing the use of humor in online information warfare. This breadth of coverage reflects the Centre’s evolution from the three core networks identified in 2018 to a more comprehensive analytical framework.
One of the most significant developments has been the Centre’s focus on election security, producing reports on preventing election interference and countering hybrid threats to elections. This work addresses one of the most pressing contemporary challenges to democratic governance, providing practical guidance for protecting electoral processes.
Perhaps the most significant evolution since 2018 has been the formalization and expansion of the Centre’s Training and Exercises (T&E) function. This program now focuses on “building the practical competences of the Participating States, the EU and NATO in countering hybrid threats through scenario-based learning, wargaming, training, and operational preparedness.”
The Centre’s training programs have gained international recognition. The third iteration of “The Contribution of Cyber in Hybrid Conflict” course, held in November 2024, brought together 34 participants from 21 nations, including representatives from Ukraine and Japan. This global reach demonstrates how the Centre’s influence has extended beyond its original European focus to address hybrid threats as a worldwide challenge.
The Centre has also developed specialized training programs responding to current conflicts. Following Russia’s invasion of Ukraine, Hybrid CoE created courses specifically designed for Ukrainian professionals, training 23 professors from Ukrainian universities to design dilemma and matrix games for countering hybrid threats, with particular focus on vulnerabilities during Ukraine’s EU membership path.
The Centre’s work has gained particular relevance and urgency due to Russia’s ongoing hybrid campaigns and the war in Ukraine. In 2023, the Centre partnered with the Atlantic Council’s Digital Forensic Research Lab to interview two dozen Ukrainian officials and experts, resulting in the groundbreaking report “How Ukraine fights Russian disinformation: Beehive vs mammoth.”
This collaboration demonstrates the Centre’s ability to conduct real-time analysis of ongoing conflicts while extracting lessons applicable to broader defensive strategies.
The Centre’s research has also documented Russia’s intensified hybrid threat activities targeting the Baltic Sea region from mid-2023 to April 2024, detailing various forms of threats including disinformation, cyberattacks, instrumentalized migration, and sabotage designed to destabilize Estonia, Finland, Latvia, Lithuania, and Poland. This work provides critical intelligence for regional defense planning and demonstrates the Centre’s capacity for operational analysis.
One of the Centre’s most important achievements has been its role as a bridge between the European Union and NATO. The institution serves as “an important platform between the EU and NATO, providing a forum for strategic discussions and joint training and exercises.” This function has become increasingly vital as both organizations seek to coordinate their responses to hybrid threats while maintaining their distinct institutional identities.
The Centre’s network now encompasses over 1,200 practitioners and experts working with hybrid threat-related tasks across participating states, the EU, NATO, the private sector, and academia. This extensive network represents a significant expansion from the initial three Communities of Interest identified in 2018, creating a comprehensive ecosystem for hybrid threat analysis and response.
The Centre has developed particular expertise in the intersection of technology and hybrid threats. The sixth Cyber Power Symposium on Hybrid Conflict and Warfare, held in April 2024, focused specifically on the use of cyber-related technologies, including artificial intelligence, to achieve cognitive superiority. This focus on cognitive warfare represents an evolution of the information warfare concerns identified in 2018, adapting to new technological capabilities and threat vectors.
The Centre’s work on cognitive warfare emphasizes how “authoritarian states, revisionist powers, rogue states, and non-state networks leverage authoritarian strategic culture thinking” to exploit democratic vulnerabilities. This analysis builds directly on the foundational insights from 2018 about how non-liberal actors seek to exploit the openness of democratic societies.
As the Centre enters its second decade, it faces the challenge of maintaining relevance and effectiveness in an increasingly complex threat environment. The universal participation of EU and NATO members provides both opportunities and challenges, requiring coordination among diverse national approaches while maintaining operational effectiveness.
The Centre’s evolution from a small coordinating body to a comprehensive “do tank” demonstrates successful institutional adaptation.
However, the rapid pace of technological change and the evolving nature of hybrid threats will require continued innovation and strategic thinking.
The Centre’s focus on building practical competences through training and exercises, combined with its robust research portfolio, positions it well for these future challenges.
The transformation of the European Centre of Excellence for Countering Hybrid Threats since 2018 represents one of the most successful examples of international security cooperation in recent years.
From its modest beginnings with 13 member states and a small coordinating secretariat, the Centre has evolved into a comprehensive institution with universal EU-NATO participation, extensive research output, and operational training programs.
The Centre’s work has proven particularly prescient given the hybrid warfare dimensions of Russia’s aggression against Ukraine and the broader challenges posed by authoritarian actors seeking to exploit democratic vulnerabilities.
As hybrid threats continue to evolve, the Centre’s combination of analytical rigor, practical training, and international cooperation provides a model for addressing complex, multi-domain security challenges.
The institution’s journey from vision to reality demonstrates that international cooperation, when properly structured and sustained, can produce tangible results in addressing shared security challenges.
As my co-author and I focused upon in our 2020 book on the return of direct defence in Europe, the security dimension of today’s threat environment is of equal wait to an ability to succeed in kinetic operations,
Finding ways to do both, often with some of the same tools, is a key organizational skill set for the democracies to compete effectively in crisis management with the multi-polar authoritarian world.
See for example, the following:
“Hybrid CoE Trend Report 10: Threat potential in the economy: from vulnerabilities to China’s increased coercion,” European Centre of Excellence for Countering Hybrid Threats, June 21, 2023, https://www.hybridcoe.fi/publications/hybrid-coe-trend-report-10-threat-potential-in-the-economy-from-vulnerabilities-to-chinas-increased-coercion/
“Hybrid CoE Working Paper 32: Russia’s hybrid threat tactics against the Baltic Sea region: From disinformation to sabotage,” European Centre of Excellence for Countering Hybrid Threats, May 30, 2024, https://www.hybridcoe.fi/publications/hybrid-coe-working-paper-32-russias-hybrid-threat-tactics-against-the-baltic-sea-region-from-disinformation-to-sabotage/
“Hybrid CoE Working Paper 26: Humour in online information warfare: Case study on Russia’s war on Ukraine,” European Centre of Excellence for Countering Hybrid Threats, November 6, 2023, https://www.hybridcoe.fi/publications/hybrid-coe-working-paper-26-humour-in-online-information-warfare-case-study-on-russias-war-on-ukraine/
The news archive provided by the Centre on its web page provides the detail through which I could write this article. The featured image of the Centre’s staff as seen on their website.
The Emergence of the Multi-Polar Authoritarian World: Looking Back from 2024