Aerospace & Defense research

Gray zone warfare

Gray-zone competition is an unusually demanding information-processing problem. The campaign becomes visible only when distributed signals are composed.

Originally published in 2024 · Substantially revised in 2026

The problem

Strategic effects emerge across domains.

Gray zone warfare describes competition conducted below the threshold of conventional armed conflict. States and non-state actors combine cyber operations, economic coercion, information operations, industrial espionage, proxies, legal pressure, supply-chain leverage, and other instruments while preserving ambiguity and limiting the target's ability to respond.

Relevant reality is distributed across cyber activity, capital flows, supply chains, industrial behavior, influence operations, legal actions, intelligence reporting, commercial systems, and geopolitical events. Individual signals often look ordinary. The campaign becomes visible only when the relationships among them are composed.

Why it is structurally difficult

Institutions divide reality so they can govern it.

Cybersecurity teams monitor networks. Intelligence organizations track adversaries. Financial regulators watch capital. Law enforcement investigates crimes. Military commands monitor operational threats. Companies protect intellectual property and supply chains.

That decomposition is necessary. Gray-zone campaigns exploit its consequence.

An activity can be too small to trigger concern inside one domain while becoming strategically meaningful when combined with activity elsewhere. The analytical object may be the pattern formed by a legitimate investment, an unusual research relationship, a cyber intrusion, shipping behavior, and an influence campaign.

The central challenge is recomposition: reconstruct the minimum sufficient picture of reality without collapsing every domain into one giant system.

The series

Five angles on one systemic problem.

Part 1 — What is gray zone warfare?

The structure of competition below the threshold of war.

Part 2 — Vulnerabilities and solutions

Why fragmented institutions and uneven resilience create exploitable seams.

Part 3 — Attack vectors

How separate instruments combine into campaigns.

Part 4 — Deterrence

Why detection, attribution, denial, and credible response must work as one system.

Part 5 — Detection and attribution

The information-engineering challenge at the center of the problem.

AI's role

Capability first. Architecture second.

Modern AI can expand the volume of information organizations inspect, find weak relationships across heterogeneous data, summarize evidence, surface anomalies, and support analysts working across multiple information streams.

But a capable model does not solve the institutional problem automatically. Detection still depends on access, semantic compatibility, provenance, permissions, evaluation, expertise, authority, escalation logic, and the ability to connect evidence to decisions.

The required capability is cross-domain sensing, composition, attribution, and action under uncertainty. AI may be indispensable to parts of that capability. The architecture should follow the information problem and operational constraints rather than begin with a predetermined AI product.