Cyber operations
States use cyber operations for espionage, theft, disruption, reconnaissance, influence, and access for later operations.
Gray Zone Warfare · Part 1
What is gray zone warfare?
Gray-zone warfare is state competition conducted below the threshold of open armed conflict.
Originally published in 2024 · Substantially revised in 2026
The definition
Competition hides inside ordinary channels.
States use cyber operations, economic pressure, influence, covert acquisition, proxies, and legal maneuvering to gain advantage while obscuring responsibility or limiting the risk of military response.
These methods move through legitimate institutions and markets. Analysts identify a campaign by linking actors, targets, timing, and effects across events; a single transaction or intrusion rarely establishes intent.
Governments divide commerce, intelligence, defense, and law enforcement into separate responsibilities. Gray-zone competition works across those divisions. An investment, intrusion, or research relationship looks different within each mandate even when the activities serve a common strategic purpose.
Why it is hard to see
Ambiguity delays response.
Uncertain attribution and intent force officials to choose between acting on incomplete evidence and waiting while pressure accumulates. Fragmented authority makes a coordinated response harder.
The consequential object is distributed across domains, institutions, records, and jurisdictions. Each local observation may be plausible on its own. The pattern appears only when the fragments are composed.
Common forms
Gray-zone campaigns move across different instruments at once.
Information and influence operations
Influence operations exploit social divisions, amplify narratives, erode confidence in institutions, and shape how audiences interpret events.
Economic pressure
States apply economic pressure through trade restrictions, investment leverage, supply-chain dependence, sanctions evasion, market manipulation, and commercial relationships.
Technology acquisition
States pursue strategic technology through cyber theft, industrial espionage, investment, partnerships, talent programs, and research relationships. These routes range from lawful access to illegal acquisition.
Proxy activity
By acting through intermediaries, states obscure their role and complicate attribution.
Legal and institutional maneuvering
Litigation, regulation, standards, contracts, and institutional rules alter who may trade, operate, or set technical requirements.
Open exchange
Legitimate channels can also carry strategic pressure.
Research, investment, trade, talent, and information exchange move knowledge and capital across borders. States exploit these relationships to acquire technology, build influence, gain access, or create dependencies.
An investment or research partnership alone establishes little. Assess who benefits, what access changes hands, and how the activity connects to other transactions.
Institutional fragmentation
Mandates divide evidence and authority.
Government agencies and companies assign cybersecurity, counterintelligence, financial oversight, export control, law enforcement, procurement, and corporate security to separate offices. Each office controls different records and actions.
Cybersecurity records an intrusion; procurement flags an unusual supplier; counterintelligence tracks suspicious contact. Each observation has a plausible alternative explanation. When systems do not share identities, timelines, and relevant records, the institution cannot test whether the events form a coordinated campaign.
Additional sensors only add observations. The institution also needs shared identifiers and an authority charged with comparing evidence and deciding whether to act.
Three conditions
Detection and response fail for structural reasons.
Evidence is distributed.
Agencies, firms, and data systems hold different parts of the record.
Attribution develops over time.
Analysts test alternatives and revise confidence as evidence accumulates.
Response authority is divided.
Each institution sets its own evidentiary threshold and controls different actions.
Analysts must connect records, document uncertainty, and deliver findings to the authority responsible for a decision.
AI's role
AI supports analysis. Institutions retain judgment.
With reliable identifiers, AI surfaces shared names, organizations, transactions, and timelines for analyst review.
Analysts verify each match against its source and test competing explanations before assessing attribution or referring findings to officials with authority to act.
Set the evidence threshold and decision authority first. Choose analytics, integration, and human review to support those requirements. Anomaly detection without an evidence standard or decision owner produces alerts, not action.
Related Talbot West work
The same structural problem appears outside security.
A Theory of Enterprise CoherenceHow organizations divide reality into functions, systems, and responsibilities, and what disappears when those pieces no longer compose.Industrial Base CoherenceHow dependencies, incentives, authority, and production conditions interact across independent organizations.Defense Industrial Base initiativeCross-boundary research into constraints and dependencies that individual industrial participants do not see in full.