Gray Zone Warfare · Part 3
Gray zone warfare part 3: Attack vectors
Gray-zone campaigns combine instruments whose effects reinforce one another. Analysts miss the campaign when they assess each vector in isolation.
Originally published in 2024 · Substantially revised in 2026
Recurring vectors
The campaign crosses instruments.
Information and influence
Exploit existing disputes, erode trust, and shape how audiences interpret events.
Economic pressure
Use market access, capital, licensing, trade dependence, and supplier concentration to constrain choices.
Technology acquisition
Obtain technology through cyber theft, recruitment, investment, partnerships, research, mergers, licensing, and suppliers.
Cyber operations
Support espionage, persistent access, technology theft, influence, and disruption.
Institutional subversion
Shape rules, relationships, or access through standards bodies, universities, legal processes, and commercial institutions.
Proxy operations
Use intermediaries to obscure responsibility and complicate escalation.
Analytical unit
Assess the campaign, not isolated vectors.
No single incident necessarily reveals coordination. The analytical unit is the campaign: actions linked by actors, timing, shared infrastructure, beneficiaries, or effects.
An intrusion, acquisition attempt, standards dispute, research partnership, and influence effort often appear in separate systems. Compare who benefits, what capabilities shift, and whether one action enables another.
Vector intersection
Look for corroborating links.
- Do multiple events share actors, infrastructure, timing, targets, or strategic objectives?
- Does activity in one vector make activity in another more consequential?
- Are apparently independent actions converging on the same capability, institution, technology, or decision?
- What alternative explanations fit the same evidence?
- Which relationships are observed, and which are inferred?
A shared beneficiary does not prove coordination. Look for common infrastructure, timing, or enabling effects.
Composable analysis
Replace tools without breaking evidence lineage.
Use explicit interfaces between graph analytics, language models, anomaly detection, entity resolution, geospatial tools, rules, expert workflows, external sources, and specialized models.
Trace every material claim
- which observations support a claim;
- where each observation came from;
- how entities were resolved;
- which connections were generated by a model;
- which were asserted by a human;
- what confidence attaches to each step;
- which contradictory evidence exists.
Model-level explanations do not show where an unsupported link entered the evidence chain.
Economic pressure restricts available choices. Influence operations alter the political cost of those choices. Cyber activity exposes plans or disrupts suppliers. Their effects change as these actions interact; a component shortage loses leverage once an alternate supplier qualifies. Assess the dependencies and timing, not merely the number of incidents.
Organizational attack surface
Data access and meaning are part of the threat surface.
A model cannot analyze records it cannot access, and identical terms may mean different things across systems. Agencies, firms, universities, and foreign partners need governed exchange that preserves provenance and decision rights.