Hybrid Security Threats
to European Organisations
We bring together senior practitioners across Security, Resilience & Defence into an exclusive, dedicated instance of our Joint Tactical Operations Centre, a digital environment where, with real-time, peer to peer collaboration and alternative perspectives, members can transform fragmented open-source information into shared awareness and decision advantage at the speed of AI.
No single organisation sees the whole picture.
Each of us holds part of it. Together, we're better prepared.
European hybrid security threats involve coordinated, non-military or sub-threshold activities by state and non-state actors, principally Russia, Belarus and Iran, designed to destabilise European democracies and infrastructure.
Core Hybrid Tactics
Critical Infrastructure Sabotage
Physical and cyber attacks targeting energy grids, undersea communication cables, railways, and military equipment factories (notably in Poland, Germany, and the UK).
Airspace Violations & Drones
Unauthorised drone overflights and explosive-laden drones near major civil and military hubs, such as Leipzig Airport in Germany and UK military installations.
Foreign Information Manipulation & Interference (FIMI)
Disinformation campaigns, cyber-intrusions, and covert political manoeuvring aimed at dividing societies and interfering in elections.
Border Pressure & Weaponised Migration
Orchestrated migration flows and coercive diplomacy used to strain national borders and asylum systems.
Within the network, stakeholders are invited to share, synthesise and discuss open source data relating to sabotage, drone incursions, infrastructure disruption, cyber attacks, executive protection, disinformation and civil unrest, and their effects on sites, staff, supply chains and travel.
This Network is running initially as a pilot. Places are limited.
The Osinto Network Charter
By accepting your invitation, you agree to the following.
- 01
Purpose
The Network brings together senior practitioners across Security, Resilience and Defence to share knowledge of hybrid security threats to European organisations.
- 02
Membership
Membership is by invitation only and numbers are limited. The invitation is personal to you and cannot be transferred. Osinto, as convenor, decides who joins and may end a membership that breaks this charter.
- 03
Visibility
The network is established within a specific instance of the Osinto Joint Tactical Operations Centre (JTOC). Members can see each other's names inside the JTOC. Who is a member is not shared outside it.
- 04
What to share
Observations, incidents, assessments, open-source reporting and questions. Do not share classified material, information you are not authorised to share, client-confidential information, or personal data about individuals beyond what the point requires.
- 05
Sharing labels
Label anything sensitive by writing its Traffic Light Protocol (TLP 2.0) label at the start of your post. The label sets who you may pass it on to outside the JTOC. Treat a post without a label as TLP:AMBER+STRICT.
- 06
Chatham House Rule
You may use what you learn here. Outside the JTOC, you should not reveal who said it or which organisation they are from.
- 07
Intelligence outputs
Intel-generated answers and reports are syntheses of what members have shared, not necessarily verified fact. Check the sources before you act on them. Treat an output as carrying the most restrictive label of the material it draws on.
- 08
Your decisions are your own
Each member remains responsible for their organisation's decisions resulting from Network engagement. Osinto convenes the community and runs the system - it does not advise on or take decisions for members.
- 09
Conduct
Professional and respectful at all times. Unsubtle selling, marketing or recruitment is discouraged (use the Forums for these), but using corporate material to add to the discussion is permitted.
- 10
Your data
Osinto administers the JTOC and handles your personal data under the Osinto.ai privacy policy. Content stays in the JTOC for the duration of the Network.
- 11
Length and review
The pilot will run for a limited period. Potential continuation will be assessed with members. Continued use of specific systems may require a subscription.
- 12
Leaving
You can leave the Network at any time by cancelling your membership in-app, or by emailing support@osinto.ai.
Sharing labels
Traffic Light Protocol (TLP 2.0)
The Traffic Light Protocol is the recognised standard for sharing sensitive information, maintained by FIRST, the Forum of Incident Response and Security Teams, and used widely by governments, national CERTs and intelligence-sharing communities. The person sharing sets the label, and the label tells you how far you may pass the information on.
Who you may share it with outside the JTOC
TLP:RED suits a direct message to named people, not a channel post seen by the whole network.
- Only the source can widen a label. To share something more widely, ask the person who posted it.
- TLP controls onward sharing. It is not a classification system and does not replace the handling of classified material.
- TLP works alongside the Chatham House Rule: TLP controls where information travels, Chatham House protects who said it.
Full standard: first.org/tlp
Membership is by invitation only.
Places are limited. Request an invitation below.