Strategic competition in the Indo-Pacific is increasingly taking place in the “gray zone”—the space between routine state competition and open warfare. Rather than relying solely on conventional military confrontation, states are employing hybrid tactics such as economic coercion, cyber operations, disinformation campaigns, and limited military provocations to gradually shift the strategic balance in their favour.

China, North Korea, and Russia are among the most active practitioners of gray zone strategy. Their activities are deliberately calibrated to remain below the threshold that would trigger a large-scale military response, allowing a to challenge the rules-based order while avoiding outright conflict.

For policymakers and military planners, this presents a difficult dilemma. Traditional deterrence models were designed to prevent major wars, not persistent low-level coercion. As gray-zone competition intensifies across the Indo-Pacific, regional states must consider how to deter and respond to these activities without inadvertently escalating the situation.

Understanding the actors involved, and the tactics they employ, is therefore essential. The following sections outline how China, North Korea, and Russia conduct gray zone campaigns across the Indo-Pacific and how these activities collectively challenge regional stability.

China: Gradual Strategic Expansion

China arguably conducts the most sophisticated and comprehensive gray zone campaign in the Indo-Pacific. Beijing’s approach combines military presence, maritime coercion, economic pressure, and legal strategies to expand its influence while avoiding direct confrontation.

In the maritime domain, China frequently uses coast guard vessels and maritime militia to harass foreign ships in disputed waters, particularly in the South China Sea. These forces operate in ways that blur the line between civilian and military activity, allowing Beijing to apply pressure while maintaining plausible deniability.

China also conducts frequent aircraft incursions and large-scale military exercises near Taiwan, while maintaining persistent patrols around the Senkaku Islands. These operations serve multiple purposes: demonstrating military capability, testing regional responses, and normalizing Chinese presence in contested areas. Moreover, Beijing employs cyber espionage, economic coercion, and diplomatic strategies sometimes described as “lawfare,” often passing domestic laws that extend jurisdiction into contested spaces to codify expansive claims, selectively invoking international law, and using legal ambiguity to its advantage. These efforts allow China to reinforce its territorial claims and political narratives while staying below the threshold of open conflict. Over time, such actions gradually reshape the strategic environment in China’s favour.

North Korea: Coercion Through Provocation

North Korea relies heavily on gray zone tactics to pressure its opponents while avoiding the disastrous consequences of full-scale war on the Korean Peninsula.

Cyber operations are one of Pyongyang’s most important tools. Groups such as the Lazarus Group have conducted large-scale hacking campaigns targeting financial institutions, governments, and cryptocurrency exchanges. These cyber activities not only generate revenue for the regime but also demonstrate North Korea’s growing technological capabilities.

In addition to cyber operations, North Korea regularly conducts missile launches, artillery exchanges near disputed maritime boundaries, and military demonstrations aimed at raising tensions in the region. These examples are limited military provocations designed to signal resolve without triggering open conflict.

North Korea also operates extensive sanctions-evasion networks. Through covert maritime trade, smuggling operations, and cyber-enabled financial crime, the regime generates revenue while circumventing international restrictions. These activities allow Pyongyang to sustain its economy and military programs despite heavy sanctions pressure.

Taken together, North Korea’s gray zone strategy enables the regime to coerce its adversaries, generate financial resources, and maintain strategic relevance without crossing the threshold of major war.

Russia: Information Warfare and Strategic Signalling

Although Russia’s primary strategic focus lies in Europe, Moscow also conducts gray zone activities in the Indo-Pacific that challenge regional stability and Western influence.

Cyber operations remain a central element of Russia’s approach. Moscow-linked actors have been associated with intrusions targeting government systems and critical infrastructure in countries such as Japan and Australia. These operations are often accompanied by online disinformation campaigns aimed at undermining public trust and influencing domestic political debates.

Russia also engages in strategic military signalling across the region. Long-range bomber patrols and naval deployments near areas such as the Sea of Japan and the East China Sea demonstrate Russia’s military reach and reinforce its presence in the Indo-Pacific. In some cases, these activities occur alongside Chinese forces, highlighting increasing coordination between Moscow and Beijing. Such cooperation amplifies the strategic message that Russia and China are capable of jointly contesting Western and allied presence in the region.

Russia also maintains sanctions-evasion networks that facilitate illicit maritime trade, including ship-to-ship transfers involving North Korea. These networks allow Moscow to sustain economic ties while bypassing international restrictions.

The Strategic Challenge of Gray Zone Competition

Gray-zone campaigns pose a growing strategic challenge for Indo-Pacific states. Because these activities remain below the threshold of armed conflict, they are difficult to deter using traditional military tools. Yet over time, they can gradually erode regional stability and shift the balance of power. This raises an important question for policymakers: how should states respond to persistent gray zone coercion without escalating into major conflict?

One approach is to use limited, proportionate conventional responses to push back against gray-zone activities. However, such responses must be carefully calibrated to prevent unintended escalation. This is where broader strategic deterrence may play an important role.

A stronger Indo-Pacific security framework—potentially including deeper military integration among regional allies and partners—could provide the stability needed to manage escalation risks. In particular, a future Indo-Pacific nuclear security architecture could serve as a strategic backstop. As much as nuclear deterrence underpins NATO’s conventional defence posture in Europe, a similar framework in the Indo-Pacific could help ensure that responses to gray zone provocations remain limited rather than spiralling into major war.

Preparing for Persistent Competition

Gray zone competition is likely to remain a defining feature of Indo-Pacific security in the coming decades. China, North Korea, and Russia are already using these tactics to challenge the existing strategic order while avoiding direct confrontation.

For regional states, the challenge is not simply responding to individual incidents. It is developing a deterrence framework capable of managing persistent, low-level coercion across multiple domains. Without such a framework, gray zone activities will continue to stress the limits of allied resolve and gradually reshape the strategic landscape. Strengthening regional cooperation, improving resilience against hybrid tactics, and reinforcing strategic deterrence will therefore be essential steps in preserving stability in the Indo-Pacific.

Natalie Treloar is the Australian Company Director of Alpha-India Consultancy, a Senior Fellow at the Indo-Pacific Studies Center (IPSC), a Senior Analyst at the National Institute for Deterrence Studies (NIDS), and a member of the Open Nuclear Network. Views expressed are the author’s own.

Beyond a Pacific Defense Pact 2: Gray zone campaigns and activities conducted by China, North Korea, and Russia in the Indo-Pacific was originally published on Global Security Review.

The international system is undergoing a profound global power shift characterized by the resurgence of great power competition and a broad diffusion of technical capabilities. This environment is intensifying security competition across all domains. Concurrently, the proliferation of artificial intelligence (AI) and other disruptive technologies has fundamentally transformed espionage and defense. The traditional landscape of counterintelligence (CI) is obsolete and requires rapid, systemic overhaul to address the increasingly amplified, technologically enabled threats posed by state and non-state actors.

Specifically, the shift to great power technological competition has expanded CI’s mandate from protecting military secrets to securing critical infrastructure, intellectual property (IP), and the integrity of the information domain. The dual-use nature of AI functions as both in support of automated espionage and a critical mechanism for preemptively anticipating and mitigating threats. The failure of the United States to strategically integrate AI into CI methodologies will result in the systemic erosion of national technological and economic advantage.

The Expanded Mandate of Modern Counterintelligence

CI functions to protect a nation’s secrets, personnel, and systems from foreign intelligence entities (FIEs). Yet today, CI must also confront a threat matrix dramatically enlarged in scope, sophistication, and velocity. The current geopolitical climate has necessitated a significant expansion of the traditional CI mission. In the context of great power competition, the most significant threat has shifted from the theft of classified military and diplomatic secrets to the large-scale acquisition of IP, trade secrets, and technological data, as highlighted in the recently released Annual Threat Assessment.

FIEs are aggressively targeting the private sector, academia, and research institutions, the very engines of national innovation through sophisticated economic espionage. Their strategic goal is not merely to obtain information, but to erode a nation’s competitive advantage and accelerate the adversary’s technological timetable, thereby shifting the global balance of power. CI must establish robust protective mechanisms that extend deep into the non-governmental technology and research ecosystem.

The dissolution of a clear distinction between peacetime competition and active conflict has resulted in a continuous state of confrontation known as the ‘gray zone’. This strategic domain is characterized by persistent, non-lethal, yet tactically damaging activities designed to achieve political objectives without triggering traditional military responses. CI must now defend against a spectrum of subtle subversion, including large-scale cyber operations, persistent penetration of networks for reconnaissance and preparatory measures, and covert attempts to manipulate political discourse and decision-making.

The globalization of commerce and technology has created intricate, interconnected supply chains. These networks present significant CI risks, as adversaries seek to compromise the integrity, trustworthiness, and authenticity of products and services. By inserting “backdoors” or creating exploitable “choke points” at various nodes, adversaries establish capabilities for future exploitation. CI efforts are essential to conduct comprehensive due diligence and risk mitigation, securing these complex networks against both hardware and software compromise.

Artificial Intelligence: The Dual-Use Catalyst

AI and emerging technologies are not merely targets of modern espionage; they are simultaneously the most potent tools and the most necessary defenses in the counterintelligence battleground. This dual-use dynamic creates a challenging “AI vs. AI” scenario that demands immediate, radical adaptation. Adversaries are leveraging AI to dramatically enhance the speed, scale, and sophistication of their intelligence operations:

Automated Espionage and Big Data Analysis: AI-powered tools can automate and scale the processing, translation, and analysis of vast, heterogeneous datasets (Big Data), vastly increasing the volume and velocity of intelligence collection from both open-source intelligence and classified sources.

Adaptive Cyberattacks: Machine learning (ML) algorithms enable the development of more elusive and adaptive cyber threats. This includes automated exploitation of vulnerabilities, dynamic creation of polymorphic malware, and rapid penetration of defenses, operating at speeds that effectively outpace traditional, human-centric cybersecurity responses.

Generative AI for Influence: Generative AI can create highly realistic deepfakes (synthetic videos and audio) and synthetic narratives at scale. This facilitates sophisticated disinformation and propaganda campaigns to manipulate public opinion and conduct advanced social engineering, severely compromising the ability of institutions to discern truth from falsehood.

Three interconnected factors fundamentally redefine the scope of CI responsibility: target expansion, the blurring of conflict lines, and supply chain vulnerabilities. To effectively counter these technologically enabled threats, CI must aggressively embrace and integrate these same technologies, transforming them into proactive defensive tools:

Threat Anticipation and Predictive Analysis: AI can process and analyze massive amounts of threat data, identifying subtle, non-obvious patterns, trends, and anomalies. This capability allows CI to transition from merely reacting to threats toward predictive modeling, allowing one to forecast adversary actions before they materialize and enabling preemptive defense.

Enhanced Surveillance and Anomaly Detection: ML algorithms are crucial for the detection of subtle anomalies in network traffic, user behavior, and physical security systems that a human operator would miss. AI-driven monitoring provides real-time, large-scale pattern-of-life analysis that significantly exceeds human cognitive capacity.

Counter-Disinformation and Integrity Checks: CI requires AI-driven tools to effectively identify, analyze, and flag AI-generated propaganda, deepfakes, and synthetic media. Systems designed for content provenance and authenticity verification are essential to safeguard the integrity of the information domain and maintain public trust.

Insider Threat Mitigation: Defensively, AI can monitor internal networks to flag anomalous user behaviors such as unusual data access attempts, large data transfers, or deviations in an employee’s digital pattern-of-life. As such they assist in identifying potential insider threats before significant compromise occurs.

The Strategic Imperative

The shift of global powers and the proliferation of disruptive technologies have thrust counterintelligence into an even more important aspect of national security. The stakes of this technological arms race transcend traditional security concerns, encompassing the integrity of a nation’s innovative ecosystem, its economic competitiveness, and the resilience of its democratic institutions.

CI must rapidly evolve its strategies to prioritize the defense of economic and technological assets, and it must integrate AI as a foundational defensive technology to achieve predictive, scalable threat mitigation. Failure to aggressively master and deploy AI defenses against technologically augmented adversaries risks the systemic erosion of national advantage in a world where technological leadership is increasingly synonymous with global power. The future success of great power competition hinges directly on the adaptive capacity and technological sophistication of CI’s function.

Joshua Thibert is a Senior Analyst at the National Institute for Deterrence Studies (NIDS) with over 30 years of comprehensive expertise. His background encompasses roles as a former counterintelligence special agent within the Department of Defense and as a practitioner in compliance, security, and insider risk management in the private sector. His extensive academic and practitioner experience spans strategic intelligence, multiple domains within defense and strategic studies, and critical infrastructure protection. The views of the author are his own.

Redefining Espionage: The Unseen War for Technological Dominance was originally published on Global Security Review.

Ideology matters, as I learned from surviving 18 years under the Chavista regime in Venezuela. The United States pretended otherwise for three decades, clinging to the “end of history” and similar dreams. Today, with ideologically driven conflicts simmering around the world, it is time for America to integrate deterrence, defense, and a theory of victory across the so-called gray zone of geopolitics. Doing so will require policymakers to start listening to what America’s enemies have been saying for years about their ideological designs.

In 2004, when questioned about whether a Venezuela-Cuba alliance was exporting communist revolution throughout the Western Hemisphere, the Venezuelan ambassador to the United States averred: “It is a thing outdated in time and it is not understanding the relationships that exist between the countries.” That was a backhanded ‘yes,’ if there ever was one. The message was meant to assuage the busy, post-9/11 national security community, diverting attention away from the problems brewing south of the U.S. border. More than two decades later, the annual warnings of USSOUTHCOM Combatant Commanders before Congress have finally been heeded by the White House.

Ideology has been slapping America in the face since the late 1990s. For this era of refocusing on state-based threats, it comes in these forms and many others: Beijing’s obsession with employing “united front” organizations to silence dissidents overseas; Moscow’s obsession with Ukraine, kicking off a murky war in 2014 that is now sustained conventionally; Tehran’s obsession with aiding and abetting proxy martyrs of the Islamic Revolution; Havana’s and Caracas’ shared obsession with waging “asymmetric war” on Western powers (which included flooding the American homeland with illicit narcotics); and Pyongyang’s obsession with subverting Seoul’s political processes and civic life. All these gray-zone efforts have an ideology at the heart. Their ideologies, variously rooted in Marxism, religion, and revanchism, drive the leaders of these states to employ irregular warfare tactics without any remorse and at any cost to civilians in the West or anywhere else. You will not find high degrees of intellectual coherence between these constructs; shared hatreds and collectivist doctrines and dogmas are cohesive enough for what now amounts to an anti-Western coalition.

Anti-Western adversaries became sneakier when strategizing and aligning with those espousing similar worldviews. They also became more convinced of their moral superiority. The U.S. national security community makes arbitrary distinctions between geopolitics and ideology. These distinctions obfuscate reality, which is already tough to comprehend, and lead to poor policymaking. Nowhere is this weakness more prominent than in the domain of irregular warfare. How did ISIS carve out its domain between Iraq and Syria, for instance, if not through the aid of its ideology?

Discussing rival-state ideology in the Departments of State, Defense, and Homeland Security seems to generate discomfort despite some strides to understand strategic cultures. It started with the spectacular triumphs of 1991. After Saddam Hussein’s defeat in the First Gulf War and the dissolution of the Soviet Union, international relations’ ideological variables have been marginalized in the Federal Government. The American bureaucrat could finally put ‘Sovietology’ to rest, and, with it, anything to do with alternatives to liberal internationalism. The term ‘Great-Power Competition’ continues the delusion; ‘strategic-ideological struggle’ captures reality much better.

Disclaimer: Ideologies are messy. Their study requires incredible levels of nuance, subtlety, cultural awareness, philosophical skill, and extensive interpretive room. It is not a field of expertise attuned nor prone to engineering solutions or linear responses, making it politically dangerous to confront ideological challengers. Bringing up ideology always risks alienating a group and hurting its feelings. Hence, American political leaders and senior officials have scarcely breathed a word about state-centric ideological conflict since the demise of the USSR.

This problematic approach is a vestige of America’s long-gone “unipolar moment.” Through mirror imaging, it takes our attention away from elements that the Western world’s rivals thrive on. Several foes of the West have developed highly complex irregular warfare doctrines, intelligently focusing on the types of operations that some of these actors can excel in, and backing off from the type of war that they know they cannot win. Because illegality is the common denominator to all irregular warfare activities coming from any type of challenger, ideological zeal and fervor are absolute strategic imperatives to the leaders of these revanchist entities. Indeed, during the Global War on Terror, we recognized it as an essential enemy warfighting capability. Ideology is the glue that authoritarians, totalitarians, and other extremists apply to bind together the domestic constituencies that they rely on for control and aggression. In ideology, those leaders find the corpus of thought and the narratives required to morally justify atrocities committed in pursuit of greed, territorial expansion, or a simple clinging to power.

Acknowledgement is growing that defeating mere symptoms of its rivals’ irregular warfare campaigns cannot bring American strategic victory or even achieve deterrence in the “gray zone.” Looking back at the U.S.-led quagmires of Afghanistan and Iraq, more observers have called for defeating root ideologies, rather than just crushing the fighters who currently espouse a certain ideology’s flavor-of-the-moment (e.g., Taliban, al-Qaeda, ISIS, Hezbollah, Boko Haram, al-Shabaab, FARC, ELN, etc.).

Defeating our enemies must include defeating their ideologies. This no longer demands global wars in the traditional (conventional) military sense. To defeat regime ideologies, whole-of-government efforts require dusting off forgotten or atrophied competencies that America used to cultivate, including the ‘dark arts’ of U.S. foreign policy. Washington needs to articulate once again what it believes in, beyond vague notions of stability, and bring like-minded allies to our side.

David Guenni is completing his doctorate with Missouri State University’s Graduate School of Defense & Strategic Studies. His research focuses on nation-states’ employment of narcotrafficking as an irregular warfare modality. He is a Venezuelan political asylum seeker in the United States, having spent many years in the struggle against the Chavista regime in Caracas. His opinions are his own and no one else’s.

Why Ideology Matters in Irregular Warfare was originally published on Global Security Review.

Cyber Shockwaves

Imagine a simple piece of computer code shutting down nuclear power plants, paralyzing transportation networks, and disrupting vital military systems. For more than a decade, cyberattacks against critical infrastructure have been more than just intrusions; they can have effects comparable to those of conventional acts of war, and threatening global stability. For nuclear democracies, the question has become crucial: at what point does a digital incident cross the threshold of severity required to trigger deterrence calculations, or even justify a nuclear response?

Cyberspace is now a theater of constant confrontation where adversaries seek to undermine each other’s trust, disrupt economies, and test resilience. This invisible competition weakens traditional deterrence mechanisms, which rely on clear signals. In cyberspace, nothing is clear, with uncertain effects and often unintentional escalation. Yet, the potential damage of a sophisticated cyberattack against an electrical grid or supply chains could exceed that of a conventional bombing. The problem stems from three major developments.

Critical Weak Spots

The first development is the increasing vulnerability of critical infrastructure, whose technical complexity creates countless points of weakness. Hospitals, refineries, water distribution systems, and railway networks rely on technologies that are sometimes outdated and rarely protected against determined state and non-state actors. A coordinated and simultaneous attack against multiple sectors could severely paralyze a country for weeks to months, causing economic chaos and widespread social disruption.

The second development concerns the strong integration of cyberspace and nuclear power. Command, control, and communication systems have become more digital than ever, and thus more exposed to cyberattacks. Even a non-destructive intrusion, subtly targeted and difficult to detect, could be interpreted as an attempt to undermine the capacity to retaliate. In such cases, the precise or approximate perception of risk becomes as dangerous as the attack itself, amplifying the potential for misunderstandings and unintentional escalation.

The third development, finally, is the bolder behavior of adversaries of democratic regimes, who use cyberspace as a tool for exerting pressure without incurring significant costs. Who would doubt that Russia, China, North Korea, and Iran regularly demonstrate their ability to disrupt the institutions of democratic regimes? The relative success of their operations encourages them to push the boundaries even further, as they are aware of the existence of a “gray zone” where traditional deterrence does not fully apply.

These major transformations lead to a fundamental question: should democracies clarify as quickly as possible that certain cyberattacks could cross a threshold triggering a major military response, including nuclear? The objective of a new doctrine would then not be to lower the nuclear threshold, but to re-establish a credible and robust level of deterrence. Because if adversaries believe that cyberattacks are “zero-cost,” they will continue to systematically target vital infrastructure, exploiting critical vulnerabilities with impunity and minimal risk to themselves.

Strategic High Stakes

A first argument for clarifying the doctrine rests on proportionality: a massive cyberattack targeting critical infrastructure could have consequences comparable to a bombing. In this context, it would be consistent to specify that the response is not limited to conventional means. Analysts point out that U.S. nuclear doctrine already considers the possibility of devastating consequences from non-nuclear strategic attacks, and they believe that the nuclear threat is not explicitly excluded, even if the no-first-use scenario remains dominant.

A second argument concerns strategic stability. Today, adversaries regularly stress the defenses of democratic regimes in the “gray zone,” without immediate risk of escalation. Clarifying the rules of engagement and explicitly integrating cyberspace into strategic thinking could strengthen deterrence and limit adversarial gambles in this gray zone. The United States, the United Kingdom, and France could thus reduce uncertainty regarding the potential consequences of sophisticated cyberattacks, one form of irregular warfare, while emphasizing that any major offensive would have significant repercussions.

A third argument concerns the protection of nuclear command. Even a limited attack on control systems could be interpreted as an attempt to neutralize the second-strike capability, creating an extreme risk of miscalculation, especially with the increasing use of artificial intelligence. By clearly announcing that such an intrusion would be considered a serious and unacceptable act, democratic regimes would strengthen their strategic stability, discouraging any hostile action and reducing the risk of unintentional escalation during times of international crisis.

Perilous Lines

This doctrinal shift, however, carries significant risks, notably the unintentional lowering of the nuclear threshold. Even if the clarification primarily aims to strengthen deterrence, it could be perceived as an excessive threat by non-democratic States, prompting them to rapidly modernize their nuclear arsenals or develop sophisticated offensive cyber capabilities. The proliferation of cyber threats with potentially physical effects creates a low-profile but ultimately strategic space for competition, paradoxically exacerbating tensions and instability.

Responding to a cyberattack with a nuclear strike requires absolute certainty as to its true perpetrator. Yet, operations in cyberspace often involve proxies, opaque international relays, and technical masking of the source. An attribution error could have profound consequences. Additionally, a cyber intrusion seen as preparation for a major attack might provoke an overreaction during a crisis. Any doctrine that includes the possibility of a nuclear response must therefore incorporate rigorous deconfliction mechanisms, otherwise the worst will happen.

However, these risks should not obscure a strategic reality: current doctrine dates to a time when cyberattacks could not paralyze a country in minutes. This is no longer the case. Adversaries of democratic regimes have understood that cyberspace offers them a means of inflicting considerable damage while remaining below the threshold for a nuclear response. Doing nothing would amount to accepting a structural vulnerability, especially since middle ground is emerging. This involves explicitly defining two categories of cyberattacks likely to trigger an appropriate military response:

1. Attacks causing massive impacts on the civilian population or critical infrastructure (hospitals and emergency services, water distribution networks, etc.).
2. Intrusions targeting the command systems of the armed forces, even without destructive effects, with the aim of degrading a country’s decision-making capacity.

Though it would not directly reference nuclear weapons, this clarification would connect strategic cyberattacks to potential responses, giving decision-makers flexibility while clearly warning adversaries. A more explicit doctrine should reduce the risks of accidental escalation and limit the audacity of State and non-State actors willing to test the nerves of democratic regimes, in line with recent analyses on the evolution of the U.S. nuclear posture in the face of new strategic threats that the war in Ukraine has only exacerbated.

About the Author

Gilles A. Paché is a Professor of Marketing and Supply Chain Management at Aix-Marseille University, France, and a member of the CERGAM Lab. His research focuses on logistics strategy, distribution channel management, and military studies. On these topics, he has authored over 700 scholarly publications, including articles, book chapters, and conference papers, as well as 24 academic books. Views expressed in this article are the author’s own.

Hacking the Apocalypse: How Cyberattacks Could Trigger Nuclear Escalation was originally published on Global Security Review.