Hybrid wars reach far beyond borders. The next target could be a company record, a family phone or a trusted voice.
A war need not begin with an explosion. A false message may unsettle a city, a stolen password may expose an employer and a forged voice may persuade someone to transfer savings. Information is no longer merely something to protect – it can also be used to influence decisions and weaken trust. A company may even be functioning normally while its customers believe a manipulated account of events. That gap between reality and perception becomes an opportunity for disruption. This is the everyday face of hybrid conflict. Governments and other hostile actors may combine cyberattacks, misleading stories, economic pressure and physical disruption to gain an advantage without open confrontation. European and NATO guidancerecognises this deliberate mixing of methods.
Not every online scam is hybrid warfare. Criminal fraud is often opportunistic, while a coordinated hybrid campaign pursues a wider political, strategic or economic outcome. Yet both exploit the same opening – personal details that make an invented story sound authentic.
The practical question for a boardroom or household is therefore the same – what could someone learn about us, what could they make us believe and how quickly could we verify it?
Strategic Risk/ The Information Front Line
The five moves behind an information attack
Most campaigns begin quietly, with research rather than spectacular hacking.
First comes observation: Attackers study company websites, job advertisements, social posts, photographs, supplier names and leaked contact lists. Small fragments reveal who approves payments, who travels, who manages access and which colleagues are likely to trust one another.
Second comes entry: A realistic invoice, delivery update, recruitment note or password-reset request invites a click or a reply. Stolen sign-in details or a compromised contractor account may then provide access.
Third comes exploitation: Copied documents, altered bank instructions, stolen customer records or malware that locks important files. Supplier portals and remote-access tools are attractive because one compromise can touch several companies at once.
Fourth comes amplification: Fabricated screenshots, edited audio, convincing video or armies of coordinated accounts may spread a misleading version of events.
The final move is pressure: Fear of embarrassment, an urgent payment deadline, a threat of exposure or a public accusation that leaves little time to check.
The warning is no longer theoretical. In 2024, Hong Kong authorities described a case in which fraudsters impersonated a finance chief in a fabricated video meeting – a company lost about HK$200 million. This was reported as fraud, not proved state-directed warfare, but it demonstrates how easily apparent authority can be manufactured.
What businesses really stand to lose
A breach can affect operations, customers, contracts and confidence long after systems are restored.
For companies, the obvious exposure is confidential information – bids, product plans, drawings, contracts, pricing, employee details and customer records. The less visible loss is decision-making confidence. If nobody knows which instruction or document is genuine, normal business begins to slow.
An attacker may change a supplier bank account, leak a tender, impersonate a senior executive or spread a fabricated statement about product safety. Theft and deception can be paired with denial of service, supplier disruption or misuse of connected building and industrial systems. The consequences may include delayed shipments, interrupted services, regulatory scrutiny and reputational damage. Where digital identities also open doors or control alarms, a data problem can become a physical security problem.
A useful defence starts with asking which information and processes cannot be allowed to fail. Limit who can see or change them. Require a second, independent check for new payees and urgent transfers. Keep protected backups and test how the business would work if email, cloud services or a key supplier went offline.
Board reviews should measure recovery time, unusual payments stopped, supplier exposure and the speed of factual crisis communications – not just the number of security products purchased. Cyber resilience is a management responsibility, as reflected in NIST’s framework.
The personal cost: identity, money and peace of mind
Names, faces, voices and everyday routines can become raw material for a convincing deception.
An individual may reveal more than intended through an innocent holiday photograph, a public birthday, a professional profile or an old account. Pieced together, these details help an impostor sound like a banker, employer, relative, police officer or school administrator. Even school photographs and public travel plans may reveal the locations and routines of family members.
Common harms include stolen accounts, false loans, fraudulent payments, blackmail, harassment and reputational attacks. A cloned voice can claim a family member is in danger. A polished video may appear to show a genuine executive or public figure. The FBIhas warned that generative AI can make such scams faster to produce and more believable. The safest response is not to become suspicious of everyone; it is to slow down when a request creates fear or urgency. Call back on a number already saved or independently found. Never share a one-time code or recovery code. Use separate, strong passwords and additional sign-in checks; keep phones and applications updated.
For suspected financial cybercrime in India, contact the bank immediately and report through the national cybercrime portal or helpline 1930. Preserve messages, transaction details and screenshots.
Future-ready protection begins with verified trust
Good security must protect the truth as carefully as it protects the technology.
The next information war will be more personal and more convincing. Artificial intelligence can help adversaries translate messages, imitate voices and create plausible material at speed. Defenders should assume that a familiar face on a screen, by itself, is no longer proof of identity.
Organisations need five habits – classify their most important data; restrict and regularly review access; authenticate sensitive instructions through a second channel; practise restoring critical work; and prepare one credible voice to communicate during a crisis. Include suppliers and contractors in the same exercises.
Security teams should also watch for coordinated false claims and establish a process to preserve evidence, check facts and correct damaging errors promptly.Avoid repeating a rumour so widely that the response becomes another vehicle for spreading it. Counter manipulation without treating legitimate disagreement as an attack. For Indian organisations, incident-response plans must also cover applicable CERT-In reporting requirements; certain reportable cyber incidents fall under a six-hour reporting rule.Families can use a trusted callback number or private verification phrase for unusual emergencies.
Technology matters, but calm verification, dependable records and rehearsed decisions matter more. In a world of uncertain messages, resilience is the ability to separate what is true from what merely looks true – and to keep functioning while that distinction is established. The strongest advantage will belong to people and organisations that make independent verification easy, not merely mandatory.
