Digital
Front Lines

A sharpened focus on the risks of, and responses to, hybrid warfare

The war in Ukraine has brought hybrid warfare to the fore and coincided with a steady uptick in cyber operations, including illegal attacks against civilians and critical infrastructure. Meanwhile, the expanding use of artificial intelligence (AI) is shifting the balance of power between attackers and defenders in cyberspace, with far-reaching implications.

Recognizing the need to prepare for hybrid warfare, FP Analytics produced Digital Front Lines in 2023 with support from Microsoft. Part V of the series, launching alongside the 2025 Munich Security Conference, assesses the scope and influence of the growing global market for cyber mercenaries, who develop, provide, or support offensive or intrusive cyber capabilities for a fee. New research from FPA and commentaries from leading experts and decisionmakers identify the challenges of regulating cyber mercenaries and explore opportunities to mitigate its destructive impacts and strengthen international preparedness and response.

Hackers for Hire

Confronting the Growing Market for Cyber Mercenaries Read more

The Cyber Mercenary Market—A Broad and Evolving Array of Products and Participants

Regulating Cyber Mercenaries is a Challenge Requiring International, Cross-Sectoral Cooperation

Emerging Global Efforts to Reign-In Cyber Mercenaries are Promising but Need to Be Bolstered

Filling Gaps in the Global Response: Recommendations for the Public, Private, and Multilateral Sectors

An Inquiry on Spyware in the EU Revealed Abuses by Member States. Now What?

Without binding action from the European Commission, recommendations to safeguard the use of spyware and regulate its trade will be ignored—at Europe’s peril.

Sophie in 't Veld By Sophie in’t Veld, Rapporteur of the PEGA Report and Former Member of the European Parliament

Spyware’s Human Toll: Cyber Mercenaries Inflict ‘Enormous Harms’ on Their Targets

Q&As with CARINE KANIMBA, activist, and DR. RON DEIBERT, founder and director of The Citizen Lab

‘Ground-Game Diplomacy’ Key to Fighting Misuse of Commercial Spyware Globally

A Q&A with NATHANIEL FICK, former U.S. Ambassador for Cyber Diplomacy and Digital Policy

Digital Weapons for Sale: Countering the Growing Cyber Mercenary Market

Industry partners and governments must work hand-in-hand to protect citizens and critical infrastructure from malicious actors.

By Amy Hogan Burney, Vice President, Deputy General Counsel, Customer Security & Trust, Microsoft

Mercenary Spies and Private Eyes: New Cyber Threats Require New Partnerships

Cyberspace has no borders, and it is only by working with our international partners to uphold and strengthen the rule of law in cyberspace that we can ensure our security.

By Stephen Doughty, UK Minister of State for Europe, North America, and Overseas Territories

Hackers for Hire

Confronting the Growing Market for Cyber Mercenaries

By FP Analytics

2023 & 2024 REPORTS

Digital Front Lines is a multimedia report consisting of a series of issue briefs produced by FP Analytics with support from Microsoft and accompanied by expert contributions from leaders across government, multilateral institutions, civil society, academia, and industry. By 2023, it had become clear that the scale and scope of cyber operations related to the war in Ukraine were unparalleled and that they marked a new era of hybrid warfare presenting myriad challenges for the prevention and resolution of conflicts globally. Digital Front Lines seeks to deepen understanding of hybrid warfare and to foster coordinated, effective responses across government, industry, and civil society, through independent research and thought leadership.

Illustration by BRIAN STAUFFER

A note from BRAD SMITH, Vice Chair and President of Microsoft

PART I

Cyber Operations in Warfare – Ukraine and Beyond

Part I explores the impacts of cyber operations, in Ukraine and beyond, and the challenges they present to the international system, including attribution of, and response to, cyberattacks and the alignment of cyber and kinetic warfare strategies.

The Evolution of Cyber Operations in Armed Conflict

The digital domain is increasingly a battleground for state and nonstate actors who are leveraging capabilities in cyberspace to advance strategic geopolitical goals. Read more

Unpacking Cyber Operations in Armed Conflict

How Russia’s Sustained Cyber Campaign Laid the Groundwork for Hybrid Warfare

How Attribution Challenges of Cyberattacks Can Undermine Diplomatic Consensus and Decisive Response

Looking Ahead

Lessons from Ukraine in the Heat of an Ongoing Hybrid War

Ukraine has been building up its digital defense for the past decade—preparation that is now paying off.

By Mykhailo Fedorov, Vice Prime Minister, Innovation, Development of Education, Science and Technologies of Ukraine

Cyber Attribution Is Critical to Ensuring Accountability

As cyberattacks become increasingly common, calling out perpetrators is fundamental to imposing sanctions and taking countermeasures.

By Chris Inglis, Former U.S. National Cyber Director

Tech Companies Are Fighting for Ukraine. But Will They Help Save Lives in Other Global Conflicts?

Social networks and tech corporations have become significant actors in hybrid warfare, but much work is needed to determine how they can contribute to the broader efforts of preventing and resolving deadly conflicts.

By Dr. Comfort Ero, President and CEO of the International Crisis Group

The Face of Modern Hybrid Warfare

Russia has aligned its cyber, military, and information operations in an unprecedented campaign.

By Tom Burt, Corporate Vice President, Customer Security and Trust, Microsoft

Cyber Resilience Helps Democracies Prevail Against Authoritarian Disinformation Campaigns

The key is to mitigate attacks on communications systems and unmask attempts to corrupt the information environment.

By Annie Fixler, Director, Center on Cyber and Technology Innovation, FDD

The Evolution of Cyber Operations in Armed Conflict

The digital domain is increasingly a battleground for state and nonstate actors who are leveraging capabilities in cyberspace to advance strategic geopolitical goals.

By FP Analytics

PART II

Multistakeholder Responses in Ukraine and Lessons Learned

Part II distills the lessons learned from multistakeholder responses to the ongoing war in Ukraine, examining the implications of cyber operations for international humanitarian law and diplomacy and highlighting the role of the tech community to track and expose information operations.

Cross-Cutting Responses to Strengthen Ukraine’s Digital Resilience

How various international stakeholders have worked together to mitigate cyberattacks in the ongoing hybrid war Read more

In-Kind Contributions Have Strengthened Ukraine’s Cyber Resiliency

International Financial Support Has Buttressed Ukraine’s Cyber Defense

Diplomatic Actions Have Targeted Russia’s Cyber Capacity, While Bolstering Ukraine’s

Prosecution of ‘Cyber War Crimes’ Could Set Precedent for Future Conflicts

Preparing for the Next Hybrid War

Strategies for Reconciling International Humanitarian Law and Cyber Operations

A Q&A with DR. PETER MAURER, President of the Basel Institute on Governance

A Proactive Approach to the Cyber Domain Strengthens NATO’s Deterrence and Defense Posture

Responding to the growing threat of hostile cyber operations requires a mindset shift toward greater civilian–military cooperation as well as more engagement with the private sector.

By David van Weel, Assistant Secretary General for Emerging Security Challenges at NATO

Tracing Cyberattacks in Times of Conflict: The Hard Path to Cyber Peace

Transparency and rigorous data collection are essential to credibly tracking cyber operations during the Russia–Ukraine war— as are being neutral and facilitating redress for all victims.

By Stéphane Duguin, CEO of the CyberPeace Institute

Developers Collaborate to Secure Software Ecosystem Amid Digital Threats

The war in Ukraine has shown that the tech industry has a meaningful role to play in enabling developers to strengthen defenses from cyberattacks.

By Shelley McKinley, Chief Legal Officer of GitHub

Detect, Disrupt, Deter: The Multistakeholder Threat-Disruption Model

The tech industry was first to push back as cyber mercenaries launched influence operations, malware development, and espionage, but governments are catching up.

By David Agranovich, Director of Threat Disruption at Meta

Cross-Cutting Responses to Strengthen Ukraine’s Digital Resilience

How various international stakeholders have worked together to mitigate cyberattacks in the ongoing hybrid war.

By FP Analytics

PART III

Preparing for Future Hybrid Wars

Part III looks ahead to future hybrid wars and explores opportunities for partnership across government, industry, and civil society to secure cyberspace, safeguard nuclear and space assets from cyber threats, and ensure accountability for state and nonstate cyberattacks against civilians and critical infrastructure.

Strategies to Deter and Respond to Cyber Operations in Conflict

International cooperation is integral to solve key challenges and reduce socioeconomic and geopolitical risks. Read more

Protecting Civilians and Critical Infrastructure from Cyber Operations Through International Law

Mitigating Damage and Escalation with Clear Standards and Norms on Attribution

Collaborating Across Sectors: States, Industry, Civil Society, and Academia

Pursuing Cyber Peace and Preparing for Potential Cyber Conflict

A Multisector Approach to Tackling the Threats of Emerging Technologies on Defense Systems

A Q&A with AMBASSADOR BONNIE JENKINS, U.S. Under Secretary of State for Arms Control and International Security

U.N. Responsibilities in the Digital Age

A Q&A with IZUMI NAKAMITSU, U.N. Under-Secretary-General and High Representative for Disarmament Affairs

Technology Will Not Exceed Our Humanity

We must renew our efforts to ensure that justice is not outpaced by the changing character of war.

By Karim A.A. Khan KC, Prosecutor of the International Criminal Court

How Russia Makes Friends and Influences Audiences in Latin America

Russia’s success in establishing and maintaining a media foothold in Latin America highlights how important worldwide influence campaigns are to hybrid warfare.

By Clint Watts, General Manager of the Microsoft Threat Analysis Center

The Proliferation of Cyber Mercenaries Calls for New Definitions and Updated Laws

A Q&A with PETER MICEK, General Counsel and U.N. Policy Manager at Access Now

Keeping Civilians Off-Limits in Present and Future Wars

Civilians must be protected from—and should not participate in—military cyber operations.

By Dr. Cordula Droege, Chief Legal Officer of the International Committee of the Red Cross

Cybersecurity in Outer Space

A Q&A with AMBASSADOR SORIN DUCARU, Director of the European Union Satellite Centre (SatCen)

Lessons from Estonia’s Whole-of-Society Approach to Cyber Defense

A Q&A with HANNO PEVKUR, the Minister of Defense of Estonia

Strategies to Deter and Respond to Cyber Operations in Conflict

International cooperation is integral to solve key challenges and reduce socioeconomic and geopolitical risks.

By FP Analytics

PART IV

Deterring Cyber Warfare

Part IV examines the challenge of cyber deterrence in an era of advanced artificial intelligence and presents cross-sectoral recommendations to mitigate risks, including robust and resilient digital defenses, AI-enhanced attribution techniques, and credible, proportional response measures to dissuade would-be attackers.

Defend, Attribute, Punish: Deterring Cyber Warfare in the Age of AI

Secure design, coordinated attribution, and credible punishments are imperative to deter evolving cyber threats.
Read more

In Cyberspace, Deterrence Strategies Require Collective and Consistent Action

Coordinated Consequences for Cyberattacks Are Critical to Avoid Escalation

The Role of International Justice in Cyber Defense and Deterrence

Cyber Deterrence: A Technological and Geopolitical Challenge

The Role of International Justice in Cyber Defense and Deterrence

Holding perpetrators accountable for international crimes, including those committed through cyber-enabled means, is a critical element of an effective global response to cyber threats.

By Lindsay Freeman, Director of Technology, Law, and Policy, Human Rights Center, UC Berkeley School of Law

In Cyberspace, Deterrence Strategies Require Collective and Consistent Action

In a dynamic threat environment, establishing consequences will be key to protecting critical infrastructure and stabilizing cyberspace.

By Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technologies, United States

Cyber Deterrence: A Technological and Geopolitical Challenge

Industry and governments are stepping up as more is needed to meet the moment.

By Tom Burt, Corporate Vice President, Customer Security and Trust, Microsoft

Coordinated Consequences for Cyberattacks Are Critical to Avoid Escalation

“Ambiguity undermines deterrence and encourages aggressors to test the limits of what they can get away with. The cyber domain is no different. Unless bad actors fear consequences for their malign conduct, they will be emboldened.”

By James Paterson, Senator and Shadow Minister for Cyber Security, Australia

Closing thoughts from BRAD SMITH, Vice Chair and President of Microsoft

“I am especially optimistic about the potential for industry to now leverage artificial intelligence as a game-changing technology for security.”

CONTRIBUTORS

Expert Insights

In the age of hybrid warfare, the impacts of cyber operations are felt across civil and military domains, and beyond. Experts from private industry, government, NGOs, multilateral institutions and more share their perspectives on a range of cybersecurity issues, identifying challenges to international peace and security, and opportunities for collaboration.