How Hybrid Warfare Exploits Cognitive Biases

I. Hybrid warfare does not only target infrastructure: it targets collective cognition

In a conventional war, the targets are visible: a military base, a bridge, a power grid, a port, a supply line. In a hybrid war, these targets still exist, but they are no longer sufficient to understand the conflict. The scope of action has expanded. It now includes institutions, media, social networks, elections, markets, online communities, protest movements and, even more profoundly, the way a society perceives reality. Modern hybrid warfare does not only seek to destroy material capabilities. It seeks to disrupt the mental orientation of an opponent. It aims at what allows a society to understand a crisis, to identify a threat, to trust its institutions, to distinguish truth from falsehood and to collectively decide on a response. In other words, the target is no longer just the physical infrastructure. The target also becomes the cognitive infrastructure. A society is based on material systems: energy, transport, telecommunications, finance, defense. But it also relies on intangible systems: trust, attention, common language, collective memory, feeling of belonging, ability to prioritize facts. If these systems are degraded, a country can become vulnerable without a single missile having been fired. This is where hybrid warfare becomes particularly dangerous. It does not always strike in spectacular ways. It often acts by accumulation. A rumor here. Leaked documents there. A controversy amplified at the right time. A cyberattack against a public service. A campaign of anonymous accounts on social networks. A fake outlet that repeats dubious information. An influencer who transforms suspicion into certainty. A video taken out of context. An accusation repeated until it becomes familiar. Taken separately, these elements may sound like noise. Taken together, they can produce a strategic effect: confusion, distrust, polarization, anger, fatigue, paralysis. The difference from classic propaganda is important. Traditional propaganda often sought to get a population to adhere to a clear narrative: “our side is just”, “the enemy is evil”, “sacrifice is necessary”. Modern cognitive warfare is more subtle. It does not always try to convince. It may simply seek to disorganize. It is not necessary for the target to completely believe false information. Sometimes it is enough for the target to doubt everything. It is not necessary for it to support the opponent. It is enough for the target to lose confidence in its own side. There is no need for it to adopt a foreign ideology. It is enough for the target to see its own institutions as dishonest, corrupt, or incapable. This is why hybrid warfare often operates below the threshold of open war. It allows a hostile actor to exert pressure on a society without immediately triggering a direct military response. The attack can be denied, diluted, attributed to local actors, activists, alternative media, independent hackers or simple “citizen opinions”. This ambiguity is central. It allows an actor to strike without clearly signing the attack. It makes it possible to exploit the internal divisions of a country while giving the impression that these divisions are entirely spontaneous. It makes it possible to transform democratic vulnerabilities, freedom of expression, media pluralism, public debate, into entry points for influence operations. The open society then becomes a field of operation. The heart of the problem is there: democracies cannot simply close the information space without denying themselves. They must accept contradiction, protest, satire, criticism, political anger. But this space can be exploited by actors who do not seek to debate, but to manipulate the very conditions of the debate. In this context, the human brain becomes an attack surface. Just as a cyberattack exploits a flaw in software, a cognitive operation exploits a flaw in perception. It uses our mental shortcuts, our fears, our tribal reflexes, our attraction to scandal, our need for consistency, our tendency to believe what already confirms our vision of the world. Cognitive bias becomes the equivalent of a system vulnerability. Confirmation bias reinforces pre-existing beliefs. The negativity bias allows attention to be captured with anxiety-provoking content. In-group bias makes it possible to transform a factual question into an identity marker. The effect of repetition makes an uncertain narrative familiar. Availability bias makes it possible to pass off a marginal phenomenon as a massive threat. An effective hybrid operation therefore does not necessarily create an opinion out of nothing. It builds on what already exists. A latent fear. A social frustration. A historic humiliation. A distrust of the media. Anger against the elites. A religious, ethnic, economic or generational divide. Then it amplifies. It simplifies. It radicalizes. It gives narrative form to an already present tension. This is what makes these operations difficult to counter. They are not always completely false. Often, they mix the true, the dubious, the exaggerated and the manipulated. A real fact can be taken out of context. A genuine problem can be turned into evidence of a conspiracy. An institutional error can be presented as a willful betrayal. An isolated event can be repeated until it gives the impression of a general collapse. Pure lying is fragile. The half-true is much more dangerous. Modern cognitive warfare operates precisely in this gray area. It does not only rely on the fabrication of false information. It exploits ambiguities, emotions, suspicions, silences, contradictions and communication errors. It transforms uncertainty into a weapon. Its final objective is not always to make people believe an alternative version of reality. It may be to make the existence of a common reality impossible. When a society no longer shares a minimum basis of trust, each crisis becomes more difficult to manage. An election becomes suspect before it even takes place. A health decision becomes a manipulation. A military alliance becomes submission. A journalistic investigation becomes a political operation. An official word automatically becomes false. A denial becomes further proof of a cover-up. At this point, the hostile actor no longer needs to directly control the debate. It only needs to establish an environment where all speech is contested, all authority is delegitimized, all truth is perceived as self-interested. It’s a form of mental sabotage. And this sabotage can produce very concrete effects. It can slow down a military decision. Weaken support for an alliance. Reduce voter turnout. Radicalize social groups. Divert attention from an actual operation. Push a population to reject a public policy. Create a crisis of trust between citizens and institutions. Or simply make a country more difficult to govern. Hybrid warfare therefore does not separate the psychological from the strategic. It understands that perception influences the decision, that the decision influences the action, and that the action influences the balance of power. This is why cognitive biases have become levers of power. Not because individuals are stupid or irrational, but because the human brain is designed to decide quickly, with incomplete information, in complex environments. What is useful in daily life can become vulnerable in a hostile information environment. Hybrid warfare exploits this tension. It does not create our biases. It activates them. It does not create our divisions. It intensifies them. It does not always create chaos. It learns to direct it. And this is precisely why understanding modern conflict requires looking beyond tanks, missiles and cyberattacks. We must also observe narratives, collective emotions, amplification mechanisms and trust architectures. Because today, attacking a country no longer only means attacking its territory. It is attacking a country’s ability to correctly perceive what is happening to it.

II. The cognitive kill chain: how a hybrid operation transforms a bias into a strategic effect

To understand modern hybrid warfare, it is not enough to identify the false information that is circulating. We must understand the complete chain that allows an influence operation to produce a real effect on a society. A rumor, a false document or a manipulated video are only the visible part of the mechanism. What matters is the process: how a cognitive vulnerability is identified, activated, amplified, legitimized, then converted into political, social or strategic behavior. We can talk about a cognitive kill chain. In the military or cyber domain, a kill chain designates the steps which allow you to move from the recognition of a target to the final effect: intrusion, compromise, destruction, sabotage or exfiltration. In cognitive warfare, the logic is comparable. The target is not a server or a military base, but a population, a community, an institution, a social group or a segment of opinion. The goal is not just to inform or misinform. The goal is to alter the target’s mental state to produce an exploitable effect.

1. Reconnaissance: mapping the mental fractures of a society

Any serious cognitive operation begins with an observation phase. Before pushing a narrative, you need to understand the terrain. Not only the geographical terrain, but the psychological and social terrain: what fears are already present? Which groups feel humiliated, abandoned or despised? Which institutions are already weakened? What topics provoke an immediate emotional response? Which communities no longer speak to each other? What recent events have left a trace of anger or suspicion? A society is never homogeneous. It is crossed by fractures: political, social, religious, economic, generational, territorial, cultural. These fractures are not necessarily created by the adversary. They already exist. The hybrid operation consists of identifying them, then exploiting them. This is an essential difference with a naive view of disinformation. An effective operation does not always invent a problem. It is based on a real problem, then it directs it. Social anger can become proof of elite betrayal. An administrative error can become a sign of an organized conspiracy. An economic crisis can become proof that an enemy group is “taking advantage” of the country. Community tension can be transformed into an existential threat. A diplomatic decision can be presented as submission to a foreign power. So the initial work is to find the areas where society is already flammable. In this phase, social networks are an extremely useful source of information. They allow us to observe the words that trigger, the images that circulate, the grievances that recur, the hated figures, the competing narratives, the active communities, the intermediary influencers, the hashtags, the Telegram channels, the Facebook groups, the activist accounts, the alternative media and the ideological fault lines. This work resembles less classic propaganda than a form of psychological reconnaissance. The hostile actor doesn’t just ask, “What message do we want to send?” Rather, he asks: “What wound already exists, and how can we press on it?”

2. Selection of cognitive vulnerability

Once the terrain is mapped, the operation must choose the vulnerability to exploit. Not all populations react to the same stimuli. Not all groups are sensitive to the same narratives. An effective cognitive operation adapts its angle to the dominant flaw of the target. If the target group is already distrustful of institutions, the narrative will emphasize state cover-up, corruption or lying. If the target group feels culturally threatened, the narrative will emphasize invasion, replacement, erasure or loss of identity. If the target group feels economically abandoned, the narrative will emphasize elites, profiteers, unfair aid, stolen resources or social humiliation. If the target group is sensitive to order and security, the narrative will amplify images of chaos, violence, impunity or collapse. If the target group is sensitive to anti-imperialism, the narrative will present any alliance, military cooperation, or diplomatic decision as submission to a dominant power. Cognitive vulnerability then becomes the entry point. This entry point can be fear, indignation, feelings of injustice, humiliation, nostalgia, anger, the need to belong or the desire for revenge. The information disseminated is only a vehicle. The real goal is the emotional state produced. This is why the most effective content is not always the most well-argued. They are often the most emotionally charged. An image of a wounded child. A video of violence taken out of context. A shocking sentence attributed to a political leader. A simplified map. An unverifiable figure. An anonymous testimony. A cut excerpt. An abusive historical comparison. A humiliated national symbol. A designated enemy. Emotion precedes analysis. And when a strong emotion is activated, the brain then searches for information that justifies this emotion. This is where bias becomes exploitable. The target no longer simply receives information. It receives an explanation that gives immediate meaning to what it already feels.

3. Construction of the narrative payload

In a cognitive operation, the narrative being broadcast functions as a payload. In cyber operations, a payload is the charge that produces the desired effect after the intrusion. In cognitive warfare, the narrative payload is the element that carries the emotion, interpretation and desired action. This narrative payload is not necessarily pure fake news. On the contrary, the most robust narratives are often hybrids themselves: they mix the true, the partial, the distorted, the taken out of context, the plausible and the false. A complete lie is easier to refute. A half-true is more difficult to neutralize. An authentic fact can be used as proof of a false conclusion. A real statistic can be presented without a basis for comparison. A real video can be attributed to the wrong location. A local scandal can be presented as a national phenomenon. An isolated mistake can be transformed into deliberate policy. A clumsy word can be used as proof of hostile intent. The strength of the narrative payload comes precisely from this ambiguity. It must be credible enough to circulate, emotional enough to trigger a reaction, simple enough to be remembered, adaptable enough to be taken up by several communities, and vague enough to survive rebuttals. A good cognitive payload often contains several layers: a factual or pseudo-factual core; an accusatory interpretation; a dominant emotion; a designated culprit; a political implication; an implicit invitation to react. For example, the narrative does not just say: “such and such an event took place”. It suggests: “this event proves that your leaders are lying to you”, “your group is threatened”, “the media is hiding the truth”, “the enemy is already inside”, “those who doubt are complicit”. At this point, the narrative ceases to be information. It becomes a reading framework. And when a reading frame is established, it can absorb new events. Each subsequent fact will be interpreted through this initial narrative. A contradiction will become an attempt at concealment. A denial will become proof of panic. An absence of proof will become proof that “everything is well hidden”. This is the power of conspiracy narratives and cognitive warfare narratives: they don’t just add a belief. They change the way evidence is evaluated.

4. Information laundering: making the narrative credible

A raw narrative, delivered directly from a hostile source, is unlikely to convince a wary target. It must be laundered through the information environment. Information laundering consists of passing a narrative through several intermediaries in order to give it the appearance of credibility, independence or spontaneity. A message may first appear on a fringe channel, then be picked up by an activist account, then by a fake local media outlet, then by an influencer, then by a politician, then by mainstream media covering the controversy. At the end of the process, many citizens no longer know where the initial information came from. They only see that it is “everywhere”. This mechanism is central. Credibility doesn’t just come from content. It comes from the content journey. The more information appears to be repeated by different sources, the more important it appears. The more it seems to emerge from several places at the same time, the more spontaneous it appears. The more it is commented on, debated, denounced or defended, the more it gains in social reality. This is where fake outlets, cloned sites, anonymous accounts, opportunistic influencers and ideological relays play a decisive role. The goal is not necessarily for each relay to be controlled directly. In an effective hybrid operation, some of the amplification can be organic. Local actors take up the narrative because it serves their interests, confirms their vision of the world or nourishes their audience. The hostile actor does not need to control everything. The hostile actor only needs to launch a narrative compatible with existing tensions. This is a form of opportunistic alignment. Once the narrative is introduced into the information ecosystem, it can be taken up by actors who are not aware of participating in an operation. They become involuntary amplifiers. This is why the line between foreign influence, domestic activism, media opportunism, and spontaneous polarization is often difficult to draw. Hybrid warfare thrives in this confusion. It does not replace the internal dynamics of a society. It parasitizes them.

5. Cross-platform amplification: creating a sense of reality

Isolated information is fragile. Repeated information becomes familiar. Familiar information becomes plausible. Amplification is therefore a determining step in the cognitive kill chain. The same narrative can be presented in several formats: article, short video, meme, screenshot, testimony, thread, comment, map, statistic, montage, audio extract, dubious survey, truncated quote. Each format reaches a different audience and activates a different mode of reception. On X, the narrative can take the form of political indignation. On TikTok, it can become a short emotional video. On Telegram it may be presented as prohibited or confidential information. On Facebook, it can circulate in community groups. On YouTube, it can become a long pseudo-documented analysis. On a fake outlet, it can take on the appearance of a professional article. On private messaging services, it can become an alert transmitted “by someone reliable”. The strength of this strategy comes from the apparent convergence. The target does not necessarily see a coordinated campaign. It sees several scattered signals that seem to confirm the same thing. It says to itself: “I’ve seen this happen several times, there must be something.” This is the desired effect. The goal is not always to prove. The goal is to create an impression. A feeling of scandal. A feeling of betrayal. A feeling of insecurity. A feeling of corruption. A feeling of collapse. An impression of a silent majority. An impression that “everyone is beginning to understand”. In this phase, repetition counts as much as veracity. The more a narrative is encountered, the more mentally available it becomes. The more it is available, the more it influences judgment. Even if the person remains cautious, the narrative already occupies a place in their mind. It becomes a possible hypothesis. Then a familiar hypothesis. Then, sometimes, a conviction. This is how uncertainty becomes exploitable. A cognitive operation does not always need to change a statement from “false” to “true”. Sometimes it is enough to move it from “absurd” to “possible”, then from “possible” to “probable for some”.

6. Conversion: transforming a perception into behavior

A cognitive operation is only successful if it produces an effect. This effect can be visible or discreet. It can be immediate or deferred. It can target a vote, mobilization, abstention, loss of confidence, social division, political pressure or institutional paralysis. Perception is only one step. The real goal is behavior. Making people believe that an election will be rigged can reduce participation, prepare for contesting the result or delegitimize the winner. Making it appear that a military alliance sacrifices national interests can weaken popular support for that alliance. Making people believe that a social group is favored or protected can fuel internal hostility. Making people believe that the media systematically lies can isolate part of the population from alternative, more manipulable sources. Making people believe that a crisis is deliberately organized can transform a political error into an existential accusation. Making people believe that “everything is ruined” can produce apathy, withdrawal or cynicism. In all cases, the narrative becomes a behavioral lever. This is where cognitive warfare fully meets strategy. It’s not just about winning an online debate. This involves weakening an adversary’s ability to decide, coordinate, maintain internal trust and act collectively. The victory sought may be a society that doubts too much to react, that divides too much to coordinate, that is too suspicious to believe its own institutions, or that becomes too exhausted to sustain a prolonged effort. Conversion can also target decision-makers. An information campaign can create artificial pressure on a government. It can give the impression that a position is unpopular, that a measure is massively rejected, that an ally has become toxic, that a crisis is spiraling out of control. Even if this perception is artificially amplified, it can influence real decisions. Hybrid warfare thus exploits a dangerous loop: public perception, media pressure, political reaction, new public perception. A well-run operation does not need to control the entire loop. It only has to influence it at the right time.

7. Feedback loop: measure, adapt, relaunch

The cognitive kill chain does not end after the initial broadcast. The actors observe what works and what fails. Which messages trigger the most reactions? Which formats circulate best? Which influencers are taking up the narrative? What counter-arguments appear? Which communities are resisting? Which emotions dominate? Which version of the message survives best? The operation can then adapt. If a specific lie is refuted, the narrative can shift to a broader accusation: “even if this case is false, the general problem exists.” If one source is discredited, another source may pick up the theme. If a platform reduces the visibility of content, the narrative can migrate to more closed channels. If a version that is too extreme does not pass, a more moderate version can be launched. If one community rejects the message, another may be targeted with a different angle. Cognitive warfare is iterative. It tests, measures and adjusts. This brings it closer to modern logics of marketing, growth hacking and information warfare. The message is not just designed once. It is optimized based on feedback. Tits ability to adapt makes defense difficult. We are not fighting simple content, but a dynamic system that learns from the opposing response.

8. What the cognitive kill chain really reveals

The notion of cognitive kill chain allows us to understand one essential thing: cognitive biases are not exploited in isolation. A hybrid operation doesn’t just say, “let’s use confirmation bias.” It constructs a sequence: identify a fracture, choose an emotion, create a narrative, whitewash the source, amplify the diffusion, create an impression of reality, convert this impression into behavior, then adjust the operation according to reactions. It is this sequence that transforms an individual bias into a collective strategic effect. The bias is only the entry point. Hybrid warfare is the architecture that turns this gateway into an operation. This is why a society cannot defend itself solely by teaching citizens to “check sources”. It is useful, but insufficient. It is also necessary to understand the mechanisms of targeting, amplification, laundering, polarization and behavioral conversion. The central question is therefore not only: “Is this information true?” But also : “Why is this information coming now?” “What emotion is it trying to activate?” “Which group is it trying to pit against another?” “Which institution is it seeking to delegitimize?” “What behavior is it trying to provoke?” “Who wins if this perception becomes dominant?” It is at this level that the analysis becomes truly strategic. Modern hybrid warfare does more than just exploit cognitive biases. It integrates them into a complete operational chain. It transforms ordinary human reflexes into levers of influence, then these levers of influence into political effects. The final target is not just what people think. This is what they become ready to do, to refuse, to tolerate or to no longer defend.

III. The most useful biases in hybrid warfare

In a cognitive operation, a bias is not a simple psychological curiosity. This is an information processing vulnerability. It does not only make an isolated individual believe something. It changes the way a group interprets facts, selects its sources, identifies its enemies and judges what becomes politically acceptable. This is why cognitive biases must be analyzed as cognitive attack primitives. A hybrid operation does not rely on the “irrationality” of populations. It exploits normal mechanisms of the human brain: need for consistency, search for belonging, reaction to fear, trust in authority signals, familiarity created by repetition. RAND already speaks of “cognitive hacking” to designate attacks that exploit the psychosocial characteristics of an audience, notably their pre-existing fears and anxieties.

1. Confirmation bias: reinforcing what the target already believes

Confirmation bias is one of the most important levers in cognitive warfare, because it reduces the cost of persuasion. There is no need to convince someone against their worldview. It is often enough to provide that person with information that seems to confirm what they already suspected. In a hybrid context, this bias serves to transform a latent belief into political certainty. A person who already believes the media lies will be more receptive to a narrative showing a supposed media cover-up. A group that feels abandoned by the state will be more sensitive to a narrative suggesting elite betrayal. A community that feels threatened will more easily accept content that confirms this threat. The key point is that information is not judged on its own. It is judged in relation to a pre-existing mental architecture. The strategic function of confirmation bias is therefore simple: stabilize a hostile perception. Once the narrative becomes part of an already established belief, it becomes much more difficult to remove. The denial can be interpreted as further evidence of manipulation. The contradiction does not necessarily destroy the narrative. It can strengthen it. This is where hybrid warfare moves beyond the realm of fake news. The question is not just: “Is this content fake?” The real question is: “what belief system does this content fit into?” Defensively, the signal to observe is therefore not only the presence of false information. It is the repetition of content which always validates the same emotion: betrayal, abandonment, humiliation, threat, corruption. When different narratives always produce the same psychological conclusion, we are no longer just faced with dispersed opinions. We may be facing a campaign of cognitive consolidation.

2. Motivated reasoning: protecting identity before the truth

Motivated reasoning goes even deeper. It is not just about preferring information that confirms a belief. It consists of processing information in such a way as to protect an identity, a side, a loyalty or a moral vision of the world. In this case, believing or not believing information becomes an act of belonging. Information favorable to the group is received with indulgence. Information threatening the group is examined with extreme severity. The person may have the impression of being rational, but their level of demands changes depending on whether the information protects or attacks their identity. Recent work on motivated reasoning shows that it can contribute to belief bias, polarization and overconfidence, particularly on politically charged topics such as immigration, crime, climate or weapons. In hybrid warfare, this mechanism is decisive because it allows a factual question to be transformed into a test of loyalty. The debate no longer concerns the reality of a fact. It is about the camp to which we belong. This is the dangerous passage: “Is this true?” becomes “Are you with us or against us?” From there, factual correction loses much of its power. Correcting the narrative can be seen as attacking the group. Asking for proof can be interpreted as betrayal. Nuancer can be seen as complicity with the enemy. The strategic function of motivated reasoning is therefore to lock identity around the narrative. The content becomes secondary. What matters is what the narrative allows us to protect: the honor of the group, its status as a victim, its moral coherence, its feeling of being lucid in the face of others. In a defensive reading, we must identify the moments when information becomes an identity marker. When disagreement is no longer treated as a divergence of analysis, but as a betrayal, the cognitive terrain is already degraded.

3. The negativity bias: circulating what threatens, shocks or humiliates

Negative content has a structural advantage: it captures attention more quickly. Fear, anger, disgust, humiliation, injustice, threat against children, threat against territory, threat against identity. These emotions bypass the slowness of the analysis. Hybrid warfare uses this mechanism because it does not always need to produce a stable belief. It can seek to produce an immediate reaction: impulsive sharing, collective indignation, pressure on decision-makers, moral panic, hostility against a group, breakdown of trust. The negativity bias transforms the information space into a permanent alert system. Everything becomes urgent. Everything is getting serious. Everything becomes a symptom of a broader collapse. This bias is particularly useful in polarization operations. A polarized society does not just react to facts. It reacts to emotional signals. A shocking image, even taken out of context, can be enough to reactivate an already established narrative: “they are attacking us”, “the State no longer protects”, “the media are hiding the truth”, “the country is falling”. The strategic function is to reduce the time available for thinking. The quicker the emotional reaction, the less room for verification. The stronger the anger, the less nuance is tolerated. The more the fear is repeated, the more available the target becomes for authoritarian, radical, or defensive responses. RAND notes that some operations do not need technical sophistication: they can succeed simply through a good psychosocial understanding of the audience, the timing, and the anxieties already present. Defensively, we must therefore look at the emotional charge of a narrative. Information can be true and yet exploited. The question becomes: why is this content presented in this form? What emotion should it produce? What rapid reaction is it trying to trigger?

4. The illusory truth effect: repeat until familiarity is created

The illusory truth effect is one of the most powerful mechanisms in saturated environments. Repeated information appears more credible, not because it is better proven, but because it becomes more familiar. It is a perfect weapon for modern conflicts, because digital platforms allow the same narrative to be repeated in different forms: article, video, meme, screenshot, comment, truncated quote, testimony, thread, audio clip, pseudo-analysis. The target does not always have the impression of seeing the same operation. It thinks it sees several independent signals. “I don’t know if it’s true, but I’ve heard about it everywhere.” This sentence is exactly the desired effect. A study published in Cognition shows that simple repetition of false information increases the likelihood that participants are willing to share it, in part because repetition increases their perceived accuracy. The strategic function of the illusory truth effect is to move a narrative from the status of absurd to the status of plausible. It is not necessary for the entire population to believe it. All it takes is for one party to say, “Maybe there’s something.” This shift is crucial. A democracy is not only weakened when citizens massively believe lies. It also becomes fragile when enough citizens are no longer able to distinguish the true, the false, the probable and the manipulated. Defensively, we must identify transformative repetition: when the same narrative changes format, apparent source and tone, while retaining the same accusatory core. The object to be analyzed is not just the content. This is the repetition trajectory.

5. Availability bias: making what is visible appear massive

Availability bias is based on a simple mental shortcut: the more easily an example comes to mind, the more we tend to believe that the phenomenon is frequent, important or representative. In hybrid warfare, this bias is used to modify the perception of proportions. A few violent incidents can be looped to produce a sense of national chaos. A few pieces of testimony can give the impression of a massive movement. A few administrative errors can be pieced together to suggest an organized policy. A few real cases can be used as evidence of a general trend. The mechanism is formidable because it does not always require false content. It can work with real facts, but selected, repeated and presented as representative. This is one of the most difficult areas to address: content can be factually accurate, but statistically misleading. The strategic function of availability bias is to distort the scale of reality. We don’t necessarily change what people think about an event. We change what they think about its frequency, its seriousness and its political importance. In a hybrid conflict, this can produce three effects: a threat effect (“it happens everywhere”), an abandonment effect (“no one controls anything anymore”), and an urgency effect (“we must act immediately”). The defensive counter-reading consists of asking the question of proportions. How many cases? Over what period? Compared to what basis of comparison? Is this a trend or a selection of examples? Does the narrative show a phenomenon, or just a series of available images?

6. In-group bias: making people choose sides before the facts

In-group bias is one of the most important biases in fragmented societies. It pushes individuals to place more trust in their group and to be more suspicious of opposing groups. In a cognitive war, this bias allows public space to be transformed into a tribal field. Facts no longer circulate according to their solidity, but according to their perceived origin: “who is speaking?”, “from which side does this information come?”, “who benefits from it?” Work on identity reasoning shows that individuals can accept or reject information depending on group alignments, and that trust in a source also depends on social biases such as similarity, conformity or prestige. The strategic function of in-group bias is to fragment common reality. Each group receives its own evidence, its own heroes, its own martyrs, its own traitors, its own media, its own experts. Ultimately, it’s no longer just about having different opinions. It’s about living in competing realities. This is where identities become attack surfaces. Hybrid CoE highlights that hybrid actors manipulate ethnic, religious, gender or socio-economic identities to fuel distrust and polarization in democracies. Defensively, the signal to observe is the transformation of a disagreement into a moral boundary. When a complex issue is reduced to “our group versus their group,” the narrative is no longer just informative. It becomes mobilizing.

7. Authority bias: creating artificial credibility

Authority bias consists of giving more weight to information because it appears to come from a competent, official, prestigious or technically legitimate source. In hybrid operations, this bias can be activated by credibility signals: fake experts, fake institutes, fake local media, fake documents, sophisticated graphics, technical language, logos, academic titles, quotes taken out of context, journalistic appearance. Content doesn’t have to be perfectly compelling. It should look serious enough to be shared without shame. This is where design becomes a cognitive weapon. A clean site, a neutral tone, a professional layout, some technical references and an institutional name can give a dubious narrative a force that it would never have had as a simple rumor. The strategic function of authority bias is to reduce critical vigilance. The target no longer checks the content because the form already tells it that it is verifiable. It does not just judge the argument. It judges the packaging: appearance of media, appearance of expertise, appearance of official document. The problem is reinforced by generative AI. Manipulative content can now be better written, better translated, better formatted and more tailored to different audiences. Recent work on post-AI cognitive operations observes a possible shift towards numerous original contents, expressing similar narratives with different wordings, which complicates detection methods based on exact textual repetition. Defensively, the right question is not just: “does this source seem credible?” We must ask: who finances it? How long has it existed? What other publications has it produced? Who cites it? Which accounts amplify it? Is authority real, borrowed, imitated or fabricated?

8. What these biases have in common

These biases do not operate separately. An effective hybrid operation combines them. A narrative can use confirmation bias to enter into an existing belief, negativity bias to trigger an emotional response, the illusory truth effect to become familiar, in-group bias to protect against criticism, and authority bias to appear legitimate. It is this combination that gives cognitive warfare its power. Manipulation does not necessarily look like a blatant lie. It can take the form of an emotionally satisfying, socially validated narrative, repeated by multiple sources, presented with signs of authority and perfectly aligned with the identity of the target. At this point, the content is no longer just information. It becomes useful to the one who believes it. It allows it to explain the chaos, identify a culprit, protect his group, justify his anger, simplify a complex crisis and feel more lucid than others. This is why cognitive biases are so important in modern conflicts. They are not just individual weaknesses. They are interfaces between psychology, information and strategy. Modern hybrid warfare does not always seek to establish a single belief. It often seeks to modify the conditions in which beliefs are formed. It doesn’t just attack what people know. It attacks how they decide who to trust.

IV. Three modern operating methods

Cognitive biases are not exploited in a vacuum. They are integrated into operating modes. A hybrid operation does not simply spread a lie and hope it is believed. It chooses a logic of effect: divide, delegitimize, saturate, divert, exhaust or paralyze. In modern campaigns, three modes often recur: polarization, delegitimization and saturation. They can be used separately, but their true power comes when they combine. An operation can polarize a debate, delegitimize the arbiters capable of clarifying it, then saturate the information space to prevent any stabilization of the truth. This is what makes cognitive warfare difficult to fight: it does not only attack opinions. It attacks the conditions in which a society can still produce a common judgment.

1. The polarization operation: transforming a divide into a front line

Polarization is one of the most profitable modes of operation in hybrid warfare. It exploits a simple reality: it is easier to aggravate an existing division than to create one from scratch. The objective is not necessarily to make the opponent like you. It is often enough to make the other half of your own country hate you. A polarization operation begins with the identification of an already active social divide: immigration, security, war, religion, gender, climate, inequalities, national identity, historical memory, police, media, European institutions, foreign policy. The chosen subject must have a strong emotional charge and an ability to produce “us against them”. Hybrid CoE emphasizes precisely this point: the manipulation of identities and values ​​is a powerful hybrid tactic to increase the polarization of a country from the outside. The organization cites campaigns targeting vulnerabilities linked to ethnic, religious, gender or socio-economic identities in European democracies. The logic is not just to spread a false narrative. The logic is to push each side to interpret the other as a threat. A migration crisis is no longer discussed as a public policy problem. It becomes proof that “the elites want to replace the people” or, conversely, that “all criticism is fascist”. A foreign war is no longer analyzed in strategic terms. It becomes a moral test: “if you do not support this position, you are a traitor”. A legal case is no longer evaluated based on the facts. It becomes proof that “the system always protects the same people” or that “the enemies from within control the institutions”. Effective polarization therefore does not only seek to convince. It seeks to reduce the space for acceptable disagreement. In a healthy environment, two citizens can oppose each other while recognizing a common basis: the initial facts, the legitimacy of the other, the existence of institutions capable of arbitrating. In a polarized environment, this basis disappears. Disagreement becomes identity. The person who adds nuance betrays. The person who checks protects the enemy. Anyone who refuses excess becomes suspect. This is where cognitive biases combine. In-group bias pushes people to believe their own side. Confirmation bias selects evidence that points in the right direction. The negativity bias gives more strength to humiliating or scandalous content. Motivated reasoning protects group identity against contradictory information. The strategic effect is very concrete: a polarized society becomes slower to decide, easier to manipulate, more difficult to govern and more vulnerable to crises. An outside actor does not need to control the debate. It just needs to increase the political cost of compromise. The defensive signal to observe is the transformation of a subject into a total moral boundary. When each event is immediately read as proof that “the other side” is dangerous, corrupt or illegitimate, the debate is no longer just tense. It becomes usable.

2. The delegitimization operation: destroying the arbiters of reality

The second logic is delegitimization. It targets the institutions that allow a society to stabilize truth, resolve conflicts and make accepted decisions. Typical targets are the media, the judiciary, electoral authorities, scientists, the police, the army, international organizations, health agencies, European institutions, military alliances and sometimes even fact-checking systems. The central message is always a variation of the same idea: “They all lie.” This formula is more dangerous than a specific lie. A specific lie can be refuted. Generalized distrust is much more difficult to deal with, because it attacks the very ability to receive a rebuttal. The objective is not necessarily to replace an institution with another reliable source. On the contrary, the goal may be to create a vacuum. If no one is credible anymore, then all versions are equal. And if all versions are equal, the most emotional, most identity-based or most repeated version takes the advantage. This is an essential shift: delegitimization does not only seek to make people believe false information. It seeks to make the correction mechanisms unusable. A delegitimization operation often works by accumulation. A journalistic error is presented as evidence of a corrupt media system. A contested judicial decision becomes proof that all justice is political. Scientific disagreement becomes proof that “the experts know nothing”. A public correction becomes an attempt at cover-up. An official denial becomes proof of panic. The Doppelganger campaign is a very telling case for understanding this logic. EU DisinfoLab describes Doppelganger as an emblematic Russian operation targeting Western countries and their information ecosystem. The operation notably used clones of legitimate media and public institution sites to disseminate manipulative content, with narratives seeking to weaken support for Ukraine and divide societies supporting Kyiv. Media cloning is a particularly interesting technique because it exploits two opposing mechanisms simultaneously. On the one hand, it uses the visual authority of legitimate media: logo, layout, journalistic style, professional appearance. On the other hand, it contributes to degrading general trust: when citizens discover that content imitates well-known media, this fuels the idea that the information space is impossible to secure. Even when the fake is exposed, a secondary damage remains: the public becomes more suspicious, more cynical, more uncertain. Delegitimization can also target organizations responsible for verifying information. Operation Overload, also called Matryoshka in some contexts, illustrates this logic. Check First and Reset Tech documented a campaign targeting fact-checkers, journalists and researchers, with mass emails directing them to false narratives promoted by anonymous accounts, pro-Russian Telegram channels or websites. The content included videos bearing fake logos from legitimate media outlets, doctored images and fake social media posts. This type of operation does not only seek to deceive the final public. It also seeks to overload defensive sensors. If journalists, fact-checkers and researchers spend their time verifying false content made for them, their attention is diverted. Their agenda is partly imposed by the adversary. Even refutation can become a form of amplification. This is an important subtlety: in some cases, the primary target is not the population. The primary target may be the verification ecosystem itself. The strategic function of delegitimization is therefore twofold. It weakens the sources capable of producing trust, then it forces these sources to react on the terrain chosen by the attacker. Defensively, we must be wary of narratives that do not criticize an institution on a specific point, but which seek to invalidate any possibility of trust. Criticism is normal in a democracy. Hostile delegitimization begins when every mistake is transformed into evidence of total and irreversible corruption.

3. The saturation operation: drowning the decision in noise

Saturation is the most underestimated mode of operation. In the classic imagination, disinformation is used to make people believe a false version of the facts. But in modern cognitive warfare, it is not always necessary to impose a coherent alternative narrative. Sometimes it is enough to produce too many competing versions to make judgment impossible. Saturation does not persuade. She’s exhausting. It works by volume, speed and confusion. An event occurs. Immediately, several narratives appear: accident, conspiracy, provocation, manipulation, false flag, responsibility of an internal group, responsibility of an external enemy, incompetence, betrayal, media operation. Each version finds its relays, its images, its “experts”, its screenshots, its videos taken out of context. The audience does not have time to stabilize an understanding. Journalists run after denials. Institutions react too slowly. Platforms amplify the most emotional content. Communities fragment around incompatible assumptions. The EEAS notes that FIMI campaigns are often triggered by major political or media events, such as elections, protests or international crises. These moments create a window of vulnerability, as citizens actively seek to understand what is happening, while reliable or contextualized information may take longer to circulate. This window is decisive. The first impression can guide everything else. Once an emotional framework is established, it becomes difficult to move. Even solid correction often comes after the initial judgment has been formed. Saturation therefore exploits a very concrete constraint: human attention is limited. A company cannot verify everything in real time. A journalist cannot dismantle a thousand false content per day. An institution cannot respond instantly to every rumor without appearing defensive. A citizen cannot maintain a maximum level of critical thinking in the face of a constant flow of scandals, alerts, images, comments and contradictions. The goal is not just to deceive. The goal is to create cognitive fatigue. By being exposed to contradictory narratives, the citizen can mentally withdraw: “we will never know”, “everyone lies”, “there is no point in checking”, “the truth depends on the side”. This apathy is already a strategic effect. A saturated population is not necessarily convinced by the adversary. It is simply less able to respond. Operation Overload also illustrates this saturation logic. The September 2024 report indicates that the campaign increased its email volume over previous months, particularly during global events like the Paris Olympics. It exploited narratives around security, public health and government management of the Games, with content notably using AI and voice cloning to give credibility to false information. This type of campaign shows that the objective can be as much clutter as conviction. We are not just trying to make people believe that the Games are dangerous or failed. We seek to create an atmosphere: imminent catastrophe, incapacity of the State, international humiliation, generalized disorder. Saturation often works by ambiance. It doesn’t always say, “believe this specific statement.” It makes you feel: “something is wrong”, “everything is fragile”, “the authorities have no control over anything”, “the media don’t tell you everything”. This is particularly effective in moments of crisis, as people search for meaning. When meaning is lacking, the most available narrative gains ground.

4. The combined mode: polarize, delegitimize, saturate

The most efficient operations combine all three modes. Polarization provides emotional energy. Delegitimization destroys correction mechanisms. Saturation prevents the stabilization of a reliable version. Imagine an international crisis. An operation can first polarize the debate by pitting “patriots” and “traitors” against each other. Then, it delegitimizes the media and institutions that try to clarify the situation. Finally, it saturates the space with videos, dubious documents, contradictory testimonies and pseudo-analyses. The result is not necessarily a massive belief in a single lie. The result may be more subtle: a society that is confused, divided, cynical, unable to distinguish important signals from noise, and politically paralyzed. This is exactly what distinguishes modern cognitive warfare from traditional propaganda. Traditional propaganda often wanted to produce support. Cognitive warfare may simply produce degradation. Deterioration of trust. Deterioration of attention. Deterioration of the debate. Deterioration of judgment. Deterioration of cohesion. Deterioration of the capacity for collective action. Recent figures give an idea of ​​the scale. The 4th EEAS FIMI Threat Report indicates that 540 incidents were investigated in 2025, involving approximately 10,500 channels or sites used to produce or amplify manipulative content. The report also indicates that 27% of incidents analyzed involved AI, including generated text, synthetic audio or manipulated video. This point is central: AI does not only change the quality of false content. It changes their economy. It allows you to produce more, faster, in more languages, with more variations and fewer resources. In terms of saturation, this is a considerable advantage.

5. Observable traces of an operating mode

To analyze a campaign, you must therefore not only ask: “what is the message?” It is necessary to identify the operating mode. A polarization operation leaves certain signals: The narrative pits two groups against each other in an irreconcilable manner. It transforms moderates into cowards or accomplices. It reduces a complex issue to a moral war. It seeks less to inform than to force alignment. A delegitimization operation leaves other signals: The narrative attacks the referees more than the facts. It repeats that the media, experts, judges, institutions, or electoral authorities are corrupt by nature. It presents any correction as further evidence of cover-up. A saturation operation has other traces: The volume increases suddenly. Several contradictory versions are circulating at the same time. The formats are multiplying. The sources seem numerous but often refer to the same narrative cores. Journalists and fact-checkers are pushed to react urgently. This grid is more useful than a simple true/false opposition. Information can be true and serve a polarization operation. A criticism can be legitimate and be recycled in a delegitimization operation. Real uncertainty can be exploited in a saturation operation. Sophistication consists precisely in using ambiguous, partially true or emotionally powerful materials.

6. What these operating methods produce in the long term

In the short term, these operations can influence an election, a diplomatic crisis, social mobilization or the perception of a conflict. But their most profound effect is often cumulative. A society constantly exposed to polarization learns to think like enemies. A society permanently exposed to delegitimization learns to no longer believe any arbiter. A society permanently exposed to saturation learns to give up understanding. In the long term, this creates an ideal environment for hybrid warfare: a combustible population, contested institutions, suspected media, delegitimized elites, social groups locked in their own realities, and crises that are increasingly difficult to manage. The final goal is not necessarily to win over public opinion. The goal may be to make the opposing society less capable of defending itself intellectually, politically and morally. This is where cognitive warfare joins global strategy. A divided country less easily supports a military effort. A cynical public accepts sacrifices less easily. A saturated population responds more slowly. Delegitimized institutions govern more difficult. Discredited media are less effective in correcting future manipulations. Hybrid warfare therefore does not only seek to win a narrative. It seeks to change the environment in which all future narratives will be received.

V. Why AI makes this cognitive war more dangerous

Artificial intelligence does not create cognitive warfare. It also does not create human bias, propaganda, influence operations or information manipulation. All this already existed. What it changes is the operational economy of these campaigns. Before, producing a credible influence operation required time, linguistic teams, graphic designers, translators, editors, human accounts, local relays, cultural variations, monitoring capacity and a distribution infrastructure. With generative AI, part of these costs decreases. The hostile actor can produce faster, in more languages, with more variants, and with a sufficient level of finish to pass the first credibility filter. This is why AI should not be thought of only as a deepfake tool. The spectacular deepfake attracts attention, but the real strategic change is deeper: AI makes it possible to multiply credible low-intensity narratives. These are not necessarily perfect videos. These are clean texts, plausible comments, false testimonies, coherent visuals, localized translations, semi-credible profiles, pseudo-journalistic summaries, infinite variations of the same narrative. The danger is not only exceptional forgery. It’s the banal, mass-produced fake.

1. AI industrializes narrative production

The first break is quantitative. A cognitive operation needs content: articles, posts, comments, video scripts, slogans, images, arguments, responses to criticism, translations, reformulations. Until now, this production required human labor. Now, generative models make it possible to quickly produce large volumes of content tailored to different audiences. IRSEM emphasizes that AI strengthens the offensive capabilities of States and malicious actors engaged in information warfare, in particular by enabling the massive production of false information and the intensification of information fog. The institute also notes that these tools can produce narratives adapted to specific cultural and linguistic contexts, at relatively low cost. This point is central: cognitive warfare does not need a single perfect narrative. It needs many versions credible enough to fill the space. The same narrative core can be used for several targets. For a sovereignist public, it will become a narrative of loss of national control. For an anti-imperialist audience, it will become a narrative of Western domination. For a conservative audience, it will become a tale of cultural decadence. For a socially vulnerable public, it will become a narrative of abandonment by the elites. For an anxious public, it will become a tale of impending collapse. AI allows this variation on a large scale. It does not necessarily replace human strategy, but it accelerates the production of variants. Cognitive warfare then becomes less artisanal. It becomes more industrial.

2. AI reduces the language and cultural barrier

Language is an important boundary in influence operations. A narrative that is poorly translated, too literal or culturally awkward loses credibility. Conversely, a narrative that uses local codes, political expressions, historical references and grievances specific to a community circulates more easily. This is where AI is particularly useful for hybrid players. It allows local versions of the same narrative to be quickly produced. Not just by translating, but by adapting the tone, vocabulary, references and argumentative structure. A campaign can thus target several linguistic spaces with a much lower cost than before. CSET had already identified this risk: AI can increase the speed, scale and personalization of disinformation campaigns. The report also highlights that language models and deepfakes make it possible to produce viral content on a large scale and can allow social bots to mimic human behavior with more targeted messages. Personalization is important because an effective cognitive operation does not speak to “public opinion” in general. It speaks to subgroups. It adapts the same theme to different frustrations. The strategic narrative remains the same, but its packaging changes. It is a logic of cognitive segmentation.

3. AI accelerates information saturation

In the previous part, we saw that saturation is a central operating mode. AI makes it simpler. A saturation campaign doesn’t need every piece of content to be perfect. It needs volume, speed and variation. The goal is not always to convince with decisive proof. The goal is to fill the information space until the target no longer knows what to believe. The EEAS reports that in 2025, 27% of FIMI incidents analyzed involved AI, including generated text, synthetic audio and manipulated video. The report adds that these tools enable faster content production and scale-up with fewer resources. This increase in scale changes the relationship between attack and defense. Producing fake content can take minutes. Verifying it, contextualizing it, attributing it, explaining why it is misleading, and circulating the correction can take much longer. The defense is slow because it must be rigorous. The attack can be fast because it does not need to be exact. This is a major asymmetry. AI accentuates this asymmetry: the easier it becomes to produce ambiguous content, the more expensive it becomes to maintain a clean information space.

4. AI enables more credible personas

Modern cognitive warfare does not only involve media or official accounts. It also comes through seemingly ordinary voices: citizens, witnesses, activists, local experts, former professionals, worried mothers, students, entrepreneurs, retired military personnel, independent journalists. AI makes it possible to make these personas more consistent. A fake account may have a credible bio, a stable tone, consistent interests, contextualized responses, the ability to engage in dialogue, regular content production, and a less robotic appearance than older bots. The NATO Strategic Communications Center of Excellence observes that online disinformation is evolving from simple automated spam to AI-powered operations capable of mimicking human behavior, adopting realistic personas and engaging in conversations more fluidly. This change is important because persuasion doesn’t just come from the message. It also comes from the apparent relationship between the target and the source. An account that responds, nuances, jokes, shares local references and seems to belong to the same community inspires more trust than an account that mechanically repeats a slogan. AI makes this relational illusion possible on a large scale. The threat is therefore not only the fake outlet. It is also the false neighbor, the false local expert, the false activist, the false witness, the false member of the community.

5. AI improves information laundering

Information laundering involves layering a narrative to make it appear independent. AI can reinforce this mechanic. A narrative can be reformulated several times with different styles. The same narrative core can appear in the form of an article, thread, comment, visual, video script, analytical summary or testimonial. Each version seems independent even though it serves the same cognitive effect. This complicates detection based on exact repetition. Previously, coordinated campaigns could be spotted because accounts posted the same phrases, hashtags, or structures. With AI, content can vary enough to avoid the crudest signals of duplication, while still maintaining the same narrative goal. This is an important development: the detection unit must no longer be just the repeated sentence. It must become the narrative core, the activated emotion, the designated target and the temporality of diffusion. In other words, you no longer have to just look for copies. You have to look for families of narratives.

6. Deepfake is only part of the problem

Deepfakes remain important, but they are not the sole core of the problem. A spectacular deepfake can cause a media shock, but it is also risky for the attacker: if it is detected quickly, it can discredit the campaign. The most effective uses can be more discreet: short audio, ambiguous image, fabricated screenshot, fake document, slightly manipulated video, synthetic voice in a private message, fake extract released at the right time. The International AI Security Report 2026 notes that real-world uses of AI for manipulation exist, but are not yet ubiquitous. It also highlights that, in experimental contexts, content generated by AI can influence beliefs in a manner comparable to human content, even if evidence of impact in real conditions remains limited. This nuance is important. We should not overestimate AI as a magic weapon capable of instantly turning around a population. But it should not be underestimated as a simple gadget either. Its main effect is not necessarily to make each content more persuasive. Its main effect is to make the whole chain faster, denser, more adaptable and harder to attribute. AI does not replace strategy. It increases the pace.

7. AI creates a new target: the machines themselves

A more advanced point is often forgotten: in recent information conflicts, it is no longer just about influencing humans. It can also be about influencing the systems that inform humans. Search engines, recommendation systems, aggregators, AI assistants and language models are becoming competition grounds themselves. If a population uses AI assistants to summarize news, seek explanations or verify a claim, then influencing the sources these systems consult becomes strategic. This is the debate around “LLM grooming”. EUvsDisinfo describes this logic as an attempt to target machines by flooding the web with low-quality articles and misleading content designed to be absorbed or viewed by AI systems. The article cites in particular the Pravda network, exposed by Viginum under the name Portal Kombat, as an example of a multilingual pro-Kremlin ecosystem targeting in particular Ukraine, the United States, France, Germany, Poland, the United Kingdom and certain African countries. However, we must remain precise: not all researchers conclude that “LLM grooming” is already proven as the dominant mechanism. A study published in the Harvard Kennedy School Misinformation Review estimates that some chatbot references to pro-Kremlin sources may come less from successful manipulation than from “data voids,” that is, topics where reliable sources are rare and low-quality content takes up space. This nuance makes the subject even more interesting. Even if hostile intent is not always demonstrated, the strategic risk exists: when an information space is poor in reliable sources, manipulative content can become more visible to automated systems. Cognitive warfare is no longer played out only in the minds of citizens. It also plays out in the architecture of access to information. Whoever fills in the information gaps can influence future responses.

8. AI complicates attribution

Attribution is already one of the major problems in hybrid warfare. Who is behind a campaign? A state? A private agency? An activist group? Influential entrepreneurs? A diaspora? Opportunistic accounts? Organic amplification? A mix of all of this? AI further complicates this issue. It makes it possible to produce more generic content, more difficult to link to a specific human style. It makes translation easier. It allows weak actors to simulate greater capabilities. It also allows powerful actors to subcontract or hide their footprint. OpenAI indicated that it had disrupted more than 20 deceptive operations and networks in 2024 that attempted to use its models, in a context where election years increased the risks of use by actors linked to States or clandestine influence operations. Microsoft also tracked influence operations by Russia, Iran and China during the 2024 US election cycle, with cases combining cyberactivity, leaks, political narratives and attempts to create discord or erode trust in the electoral process. The important point is not that AI replaces all of these operations. The important point is that it fits into already hybrid systems: cyber, leaks, fake outlets, social amplification, electoral targeting, geopolitical narratives, attacks on trust. AI is an additional layer in an influence architecture.

9. AI creates a “liar’s dividend”

The more citizens know that content can be fabricated, the easier it becomes for an actor to deny authentic content. This is what is often called the “liar’s dividend”: the existence of deepfakes allows officials, groups or institutions to say that a real video, a real audio or a real document is false. Even without proof, simple doubt can be enough to neutralize the effect of a revelation. In an environment saturated with synthetic content, the question is no longer just: “can we create fake content?” The question becomes: “can we still have the truth recognized in time?” This shift is dangerous for democracies, because public life relies on the possibility of producing accepted evidence. If every piece of evidence can be immediately suspected of being generated, manipulated or exited from an AI pipeline, then the burden of proof becomes greater for journalists, courts, institutions and researchers. The attack no longer even needs to craft a perfect fake. It may simply exploit the idea that the perfect fake exists.

10. AI increases pressure on defenders

Informational defense relies on limited resources: analysts, journalists, researchers, moderators, institutions, fact-checkers, platforms. AI increases the volume of suspicious content and therefore the cost of sorting. The 2026 Global AI Security Report highlights that detection and watermarking remain imperfect, techniques are evolving rapidly, and deepfake detection benchmarks can be surpassed by actual deepfakes circulating online. The report says a combination of measures is needed rather than a single solution. This is essential: there will be no magic “detect manipulation” button. The answer must be multi-layered: behavioral network analysis; monitoring of broadcast infrastructures; detection of coordinated narratives; synthetic media forensics; provenance of content; cooperation between platforms; monitors targeted communities; preparation of institutions to respond quickly without amplifying unnecessarily. AI can help defenders, but it does not eliminate the need for human analysts. It can classify, summarize, detect patterns, aggregate signals. But strategic interpretation remains human: why this narrative, why now, what target, what effect sought, what vulnerability activated?

11. AI does not automatically make manipulation effective

We must avoid a mistake: believing that AI makes each campaign powerful. Many AI-generated or AI-assisted operations fail to produce a significant audience. A lot of content remains mediocre. Many deepfakes are detectable. Many artificial accounts convince no one. Many narratives do not find favorable social ground. AI does not remove the fundamental rules of influence. A narrative must still correspond to real tension. It must be emotionally useful. The narrative must find credible relays. It must fit into an existing divide. It must arrive at the right time. The narrative must survive contradiction. AI can produce the content. It does not automatically create receptivity. This is why the most dangerous operations will remain hybrid in the strong sense: they will combine AI, social intelligence, political timing, human relays, digital infrastructures, relay media, opportunistic accounts and exploitation of real crises. Technology increases power, but the psychological terrain decides the effect.

12. The real breakthrough: cognitive cadence

Cognitive warfare is based on a loop: observe, produce, disseminate, measure, adapt, relaunch. AI accelerates each of these steps. It helps to observe reactions. It helps produce variations. It helps to reformulate according to the audiences. It helps translate. It helps respond to criticism. It helps to simulate personas. It helps maintain a constant presence. It helps make a narrative last beyond its natural cycle. The real threat is therefore not only AI-generated content. This is the cadence that it allows. A democratic society needs time to verify, debate, correct, arbitrate. A hybrid operation seeks to reduce this time. AI reinforces this time pressure. It pushes democracies towards a permanent dilemma: respond quickly at the risk of making a mistake, or respond slowly at the risk of letting the hostile narrative take hold. This is where AI becomes strategic. It doesn’t just change the messages. It changes the rhythm of informational conflict. Conclusion of Part V Artificial intelligence does not transform cognitive warfare into an exact science. It does not guarantee persuasion. It does not replace social fractures, human relays or real political tensions. But it makes operations more economical, faster, more varied, more localized and more difficult to allocate. It makes it possible to mass produce content, personalize narratives, create credible personas, saturate the information space, confuse evidence, and perhaps even influence the automated systems which now serve as intermediaries between citizens and reality. The disruption is therefore not simply technological. It is strategic. With AI, cognitive warfare moves from message logic to ecosystem logic. The issue is no longer just knowing whether a video is fake, whether an image is generated, or whether text was written by a machine. The challenge is to understand how a complete perception architecture can be accelerated, contaminated, automated and exploited. In modern conflicts, AI does not only produce fakes. It increases the speed at which doubt becomes a weapon.

VI. Defense: moving from fact-checking to cognitive security

The classic response to disinformation is often based on a simple idea: false information circulates, we verify it, we correct it, then the public returns to a more accurate perception of reality. This model is useful, but it is insufficient in the face of hybrid warfare. It works when the problem is an isolated factual error. It becomes much weaker when the adversary not only seeks to make people believe false information, but to saturate public space, polarize groups, delegitimize the arbiters of reality and manipulate the very conditions in which citizens evaluate evidence. In a cognitive war, fact-checking often comes too late. By the time the correction is published, the narrative has already produced its first effect: anger, suspicion, indignation, humiliation, fear, distrust. Even if the content is refuted, the emotion may remain. Even if the image is contradicted, the general impression survives. Even if the document is false, the public may remember: “maybe this one is false, but the problem surely exists.” The defense cannot therefore only consist of correcting the content. It must protect a society’s capacity to perceive, contextualize, prioritize and decide. This is cognitive security.

1. No longer treat disinformation as a simple information error

A society can be highly informed and yet cognitively vulnerable. The problem is not just the lack of reliable information. The problem is also excess noise, loss of confidence, fragmentation of audiences, attentional fatigue and the transformation of each fact into an identity marker. In this context, adding correct information is not always enough. You need to understand the environment in which this information is received. A correction published by a media already hated by a community does not necessarily produce trust. Institutional word can be technically accurate and yet ineffective if the institution is already delegitimized. A scientific report can be solid and yet rejected if the target interprets it as an instrument of the opposing camp. This is why a serious defense must distinguish three levels. The first level is factual: is it true, false, partial, manipulated, out of context? The second level is narrative: what broader narrative does this information feed into? The third level is cognitive: what emotion, what identity, what decision or what breakdown of trust does this information seek to produce? Most public responses get stuck at the first level. Hybrid operations often work at second and third.

2. Move from fact-checking to pattern-checking

Fact-checking asks: “Is this statement true?” Pattern checking asks: “Which operation pattern does this statement belong to?” This is an essential shift. Isolated information may seem trivial. But if it appears at the same time as other content, on several platforms, with the same emotions, the same designated enemies and the same relays, then it becomes an indication of an operation. The defense must therefore learn to read the patterns: repetition of the same narrative core in several formats; abnormal synchronization of publications; appearance of false experts or newly created sources; coordinated use of emotional videos; simultaneous attack on media, institutions and auditors; rapid movement of the narrative after refutation; exploitation of a crisis, an election, an attack, a war or a scandal. The DISARM framework moves in this direction: it seeks to provide a common language for analyzing influence operations, information manipulation, FIMI and related activities. The goal is not only to name false content, but to structure the analysis of behaviors, tactics and campaigns. This logic brings informational defense closer to cybersecurity. In cybersecurity, you don’t just look at a malicious file. We look at the attack chain, infrastructure, behavioral signatures, operating modes, compromised accounts, command servers, tactics, techniques and procedures. In cognitive security, we must do the same thing: not only analyze the content, but the ecosystem that produces, relays and exploits it.

3. Pre-bunker the techniques before the narratives arrive

Reactive correction is necessary, but it is not enough. Defense must become preventive. This is the role of prebunking. Prebunking is not about telling citizens what to think. It consists of showing them in advance the manipulation techniques to which they risk being exposed: false dilemma, appeal to fear, usurpation of authority, false consensus, artificial polarization, conspiracyism, forced emotion, image taken out of context. The idea comes from psychological inoculation: exposing a person to a weakened version of a manipulative technique, then explaining to them how to recognize it, in order to strengthen their resistance before the actual exposure. The HKS Misinformation Review describes this principle as a form of cognitive resistance built through preemptive exposure to weakened doses of manipulative techniques, accompanied by rebuttals or detection tips. This point is crucial: we must pre-bunker the techniques more than the narratives. A narrative changes quickly. A technique repeats itself. Today the narrative may be aimed at Ukraine. Tomorrow, it may target an election, a health crisis, a demonstration, the Olympic Games, a terrorist attack or social reform. But the techniques often remain the same: fear, anger, urgency, simplification, scapegoating, false evidence, false authority, repetition, confusion. A cognitively resilient society does not just know the fake news of the moment. It recognizes the forms of manipulation that recur. Recent data reinforces the interest of this approach. A meta-analysis of 33 psychological inoculation experiments, with more than 37,000 participants, concludes that these interventions improve the ability to distinguish reliable from unreliable information, without making participants overall more suspicious or gullible. This is important, because the goal of cognitive security is not to create a paranoid population. A population that no longer believes anything is already a victory for the adversary. The goal is to strengthen discernment, not to generalize suspicion.

4. Defend trust without blindly defending institutions

The major difficulty lies there: hybrid operations often exploit real vulnerabilities. There can be real media errors, real questionable judicial decisions, real political mistakes, real conflicts of interest, real violence, real injustices, real institutional contradictions. A clumsy defense is to deny or downplay these flaws in the name of fighting disinformation. This is a strategic error. It gives the adversary exactly what the adversary wants: apparent proof that institutions are protecting their image instead of recognizing reality. Cognitive security is therefore not about saying: “trust institutions.” Rather, it is about making institutions more trustworthy, faster, more transparent and more able to recognize their mistakes. In cognitive warfare, trust is critical infrastructure. Like a power grid, it can be attacked, degraded, overloaded and sabotaged. But unlike a power grid, it cannot be repaired by decree. It is rebuilt through consistency, transparency, competence and responsibility. An institution that quickly corrects its mistakes is more resilient than an institution that claims to never make mistakes. Media that shows its methods is more robust than media that demands automatic trust. A government that communicates clearly in a situation of uncertainty is more credible than a government that gives the impression of controlling what it does not control. Cognitive defense should therefore not protect the image of institutions. It must protect their ability to produce legitimate trust.

5. Reduce the emotional attack surface

Hybrid operations exploit collective emotions. Fear, humiliation, anger and injustice are fuels. The defense cannot suppress these emotions. It must prevent them from becoming channels of takeover. This involves monitoring the moments when public space becomes flammable: attack, blunder, election, war, shortage, health crisis, political scandal, natural disaster, social movement, community tension. These moments create windows of vulnerability. Citizens are looking for quick explanations. The media are looking for information. Institutions still lack consolidated information. Platforms favor content that triggers engagement. The adversary can then inject a narrative before reality is stabilized. The response must be prepared before the crisis. It requires rapid communication protocols, credible spokespersons, already identified channels, short ready-to-use formats, trusting relationships with journalists, links with exposed communities, and an ability to clearly say: “we know this, we don’t know that yet, here’s when we will update.” The phrase “we don’t know yet” can be a defensive weapon if used correctly. It avoids leaving a total void. It also prevents the institution from trapping itself in a premature assertion which will then be exploited.

6. Protect reality arbiters

A democratic society needs arbiters of reality: journalists, researchers, courts, electoral authorities, statistical agencies, scientific institutions, independent observers, monitoring bodies, technical experts. Delegitimization operations seek precisely to make these arbiters unusable. Defense must therefore protect not only individuals, but the functions they perform. This does not mean sacralizing the media or experts. This means maintaining mechanisms to produce verifiable facts, correct errors and resolve disagreements without each correction being immediately absorbed into the war of the camps. Concretely, this supposes several things: make methods visible; publish sources when possible; explain levels of uncertainty; clearly distinguish fact, analysis and opinion; document corrections; avoid overly emotional titles; do not overpromise certainty; cooperate between media, researchers, platforms and institutions in the event of a coordinated attack. The EEAS insists on this logic of defensive architecture. Its 4th FIMI report from March 2026 draws on the methodology, the FIMI toolbox and the FIMI Deterrence Playbook to make manipulation operations more costly and less sustainable for their authors. This point is important: the defense must not only respond to the content. It must increase the cost of the operation for the adversary.

7. Attack the manipulation infrastructure, not just the message

A cognitive warfare campaign rarely relies on a single post. It is based on infrastructure. This infrastructure may include: domain names; fake outlets; bridging accounts; Telegram channels; Facebook pages; content farms; political marketing providers; paid influencers; advertising networks; bots; proxies; information laundering sites; automated publishing platforms; translation or content generation services. The response must therefore target the critical nodes. The EEAS explains that its successive reports on FIMI have progressively structured analysis, response, exposure and deterrence, including an exposure matrix intended to reveal the connections between digital channels and hostile actor infrastructures. It is a logic of dismantling. Instead of refuting the same narrative a hundred times, we must identify why it comes back, who pushes it, what infrastructure makes it visible, which accounts relay it, which domains host it, which services allow its dissemination, which actors recycle it after deletion. The best defense is not always to respond publicly. Sometimes, it is to cut a broadcast channel, expose a network, sanction a service provider, demonetize an infrastructure, alert the platforms, or make the information laundering mechanism visible. We must distinguish the rhetorical response from the structural response. The rhetorical response responds to the message. The structural response degrades the adversary’s ability to start again.

8. Develop real cognitive awareness

Classic monitoring looks at keywords, volumes, hashtags and mentions. Cognitive monitoring must go further. It must track emotions, narratives, targeted groups, authorities attacked, formats used and coordinated behaviors. It must ask more detailed questions: What fear is activated? What humiliation is exploited? Which institution is delegitimized? Which group is designated as a threat? What behavior is sought? What event serves as a pretext? Which narrative appears in multiple languages? What false consensus is being manufactured? Which community is used as a relay? What content serves as an emotional entry point? This monitoring must also distinguish weak signals from noisy signals. A campaign doesn’t always start with viral content. It can start with marginal posts, narrative tests, new accounts, reused images, narratives launched in closed communities, then moved to more visible spaces. Cognitive warfare is often experimental. The opponent tests, observes, and adapts. The defense must therefore follow the evolution of the narratives, not just the peaks of visibility.

9. Do not amplify the attack by wanting to denounce it

A common mistake is to give too much visibility to weak manipulation. Not all misinformation deserves a massive response. Some campaigns specifically seek to provoke an institutional or media reaction to gain visibility. It is therefore necessary to evaluate before responding: Is the content really circulating? Does it affect a strategic community? Has it crossed a media threshold? Is it taken up by influential actors? Can it cause dangerous behavior? Does the response risk amplifying the narrative? In some cases, the best response is discreet: reporting, reducing visibility, targeted response to the exposed community, informing journalists, technical documentation, surveillance. In other cases, a public response is necessary: ​​when the narrative reaches a significant audience, threatens security, delegitimizes an election, endangers a community or alters a public decision. Cognitive security therefore requires a doctrine of graduated response. To respond to everything is to let oneself be governed by the adversary’s agenda. Not responding to anything is letting the environment become contaminated. The defensive art is choosing the right level of response.

10. Train citizens without transforming them into analysts

We cannot ask every citizen to become an OSINT expert, FIMI analyst or influence operations specialist. Cognitive resilience should be simple to apply. You need to train short reflexes: Why now? What emotion is this content trying to provoke? Does the content motivate me to respond immediately? Does the source really exist? Is this a fact, an interpretation or an accusation? Does the content show a trend or just an example? Who wins if I share this? This type of training is more useful than a vague injunction to “check sources.” Many citizens do not know how to verify a source. On the other hand, they can learn to recognize emotional pressure, false urgency, forced polarization or artificial authority. The objective is not to slow down all public speech. The goal is to slow down the propagation reflexes. In a cognitive war, not sharing impulsively is already a defensive act.

11. Build local trusted relays

A credible message does not always come from the State, a national media or a large institution. In certain communities, the most credible relays are local: teachers, associations, local elected officials, doctors, regional journalists, religious leaders, former soldiers, entrepreneurs, cultural figures, group administrators, specialized influencers. A centralized defense is often too slow or too distant. Hybrid operations target specific communities. The defense must also speak to specific communities. This requires knowing the audiences, their codes, their grievances, their trusted figures and their information channels. Effective communication with a young audience on TikTok is not like communication with local elected officials, a diaspora, a professional group, a religious community or an activist network. Cognitive security is not just national. It is also local, community and relational. A hostile narrative often enters through a gap in trust. It will not always be stopped by an official press release. It can be stopped by a voice that the target considers legitimate.

12. Defend decision-making capacity

Fundamentally, cognitive security is not only about protecting citizens against false information. It aims to protect collective decision-making. A cognitively attacked society can still have elections, media, institutions and debates. But if it no longer shares any basis of reality, these mechanisms work more and more poorly. An election becomes suspect before it even takes place. A crisis immediately becomes plotted. A military decision becomes treason. An investigation becomes propaganda. A correction becomes censorship. A nuance becomes complicity. At this point, the adversary does not need to control the company. It is enough to reduce that society’s ability to act coherently. Analyzes of the concept of cognitive warfare linked to NATO underline precisely this issue: cognitive activities target attitudes, behaviors, perceptions, decisions and situational understanding, with a desired effect that goes beyond the acceptance or rejection of an isolated narrative. This is why cognitive security must be thought of as a strategic function. It concerns defense, of course. But it also concerns education, the media, justice, platforms, research, diplomacy, communities, electoral campaigns, critical businesses and crisis communication. Protecting a modern society is no longer just about protecting its borders, its servers, and its infrastructure. We must also protect its ability to understand what is happening to it. Conclusion of Part VI Hybrid warfare exploits cognitive biases because they are normal shortcuts of the human brain. The answer cannot therefore be to ask citizens to become perfectly rational, perfectly informed and perfectly resistant to any manipulation. It’s impossible. The correct answer is systemic. We must pre-bunker the techniques, detect the patterns, protect the arbiters of reality, reduce the emotional attack surface, expose the infrastructures of manipulation, strengthen the relays of trust and learn to respond without amplifying. Fact-checking remains necessary. But it is only one layer of defense. Cognitive security is broader: it protects the mental environment in which a society perceives, debates and decides. In modern conflicts, the battle is not only about what is true or false. It revolves around the collective capacity to recognize the truth before doubt, anger and saturation make it politically unusable.

General conclusion: the battle is no longer just about information, but about the ability to decide Modern hybrid warfare does more than just add disinformation to the conflict. It modifies the very nature of the battlefield. For a long time, we thought of information warfare as a struggle between truth and falsehood: propaganda against counter-propaganda, a lie against a correction, a rumor against a fact-check. This reading remains useful, but it is now too narrow. The heart of the problem goes deeper. In modern conflicts, the objective is not only to make people believe false information. The objective is to degrade the mental environment in which a society forms its beliefs, grants its trust, identifies its threats and makes its decisions. This is why cognitive biases have become strategic. They are not just individual errors. They are entry points. They allow a hostile operation to exploit what already exists in a society: fear, anger, humiliation, distrust, fatigue, feeling of injustice, identity fragmentation, institutional mistrust. An effective hybrid campaign does not always create a new reality. It takes a real divide, amplifies it, simplifies it, repeats it, emotionally charges it, then inserts it into a narrative that names a culprit and directs a reaction. The final target is therefore not just opinion. The final target is the collective capacity for orientation. It is the capacity of a country to understand what is happening to it, to distinguish a real crisis from a manufactured crisis, to recognize manipulation without falling into paranoia, to criticize its institutions without rendering them unusable, to debate without disintegrating into irreconcilable camps. Cognitive warfare works precisely there. It seeks to make a society more flammable, more confused, more suspicious, slower to react, more vulnerable to emotional narratives and more incapable of producing common judgment. The issue is not only informational. It is decision-making. A society that no longer knows who to trust makes bad decisions. A society that confuses criticism and delegitimization weakens itself. A society that no longer distinguishes between rational doubt and generalized suspicion becomes manipulable. A society that lives under permanent saturation loses its ability to prioritize threats. This is where hybrid warfare meets strategy directly: the adversary does not always need to win militarily. It may seek to make its opponent less capable of acting. Less able to support an alliance. Less capable of sustaining a war effort. Less capable of protecting an election. Less able to respond to a crisis. Less able to trust its own institutions. Less able to recognize an attack while it is happening. Recent reports on FIMI clearly show this evolution: the EEAS no longer only treats these campaigns as “fake news”, but as organized manipulative behavior, with methodologies, a toolbox and a logic of deterrence aimed at making these activities more costly and less sustainable for their authors. This is an important doctrinal shift. We no longer respond to a simple rumor. We respond to an architecture of influence. An architecture that can include fake outlets, relay accounts, opportunistic influencers, AI-generated content, narratives adapted to each community, attacks on the arbiters of reality, saturation operations, and sometimes a combination with cyber, leaks, diplomatic pressure or physical actions. Hybrid warfare is dangerous because it does not separate domains. It understands that a cyberattack can become a narrative. That a document leak can become a psychological weapon. That an institutional error can become proof of betrayal. That a local event can become a national symbol. That a doubt can be more useful than a lie. That a collective emotion can produce a strategic effect. The logic is therefore less “make X believe” than “creating an environment in which X becomes plausible, useful, repeatable and politically exploitable.” This is where cognitive biases play their role. Confirmation bias selects evidence consistent with the target’s worldview. Motivated reasoning protects group identity against contradictory facts. The negativity bias places a premium on anxiety-inducing, humiliating or scandalous content. The illusory truth effect transforms repetition into familiarity. The availability bias makes the visible seem more common. In-group bias transforms facts into markers of loyalty. Authority bias allows fabricated sources to appear credible. Taken in isolation, these biases appear psychological. Organized in a cognitive kill chain, they become strategic. It is this chain that must be remembered: recognition of fractures, selection of vulnerability, construction of the narrative payload, information laundering, multi-platform amplification, behavioral conversion, adaptation according to reactions. A cognitive operation is not a message. It is a system. This is also why defensive approaches must evolve. Fact-checking remains necessary, but it is not enough. It corrects a statement. However, the attack often concerns a higher level: the narrative, trust, identity, emotion, and behavior. Defense must therefore move from a logic of correction to a logic of cognitive security. The DISARM framework goes in this direction by proposing a common language to document influence operations and better understand manipulative behavior, rather than being limited to content taken separately. The right question is no longer just: “Is this information true?” Analysts must also ask: Why is this information coming now? What emotion does it activate? Which group does it identify as a threat? Which institution is it trying to make suspect? What behavior is it trying to provoke? What broader narrative does it reinforce? Who wins if this perception takes hold? This grid is essential because a hybrid operation can use true elements. A real fact can be manipulated by its framing, its timing, its repetition, its lack of context or its emotional use. So the problem is not just falsity. The problem is the strategic exploitation of reality. This is what makes cognitive warfare so difficult to fight. It moves through the gray zone. Between true and false. Between legitimate criticism and organized delegitimization. Between authentic anger and hostile amplification. Between democratic debate and identity manipulation. Between spontaneous rumor and coordinated operation. Between foreign influence and sincere domestic relays. Between institutional error and a narrative of betrayal. Democracies are particularly exposed because they rely on openness. They accept protest, plurality, criticism, the rapid circulation of ideas, checks and balances, free media, conflicting opinions. These strengths can become vulnerabilities when hostile actors seek not to participate in the debate, but to manipulate the conditions of the debate. Hybrid CoE rightly emphasizes the exploitation of social identities in hybrid threats: hostile actors can manipulate ethnic, religious, gender or socio-economic identities to fuel polarization, exploit existing grievances and weaken social trust. This does not mean that we must close the democratic space. It means that democratic space must be defended differently. Defending a democracy against cognitive warfare is not about imposing an official truth. This would be a mistake and a gift to manipulators. It means protecting the conditions in which a society can still seek the truth, verify evidence, correct errors, criticize without destroying, debate without fragmenting, and decide without being governed by fear or saturation. Cognitive security is therefore not thought policing. It is a protection of the decision-making environment. It is based on several principles. Pre-bunker the techniques before the narratives arrive. Detect patterns instead of chasing each piece of content. Protect reality arbiters without making them untouchable. Recognize institutional errors quickly and clearly. Respond to hostile narratives without amplifying them unnecessarily. Build local trusted relays. Monitor manipulation infrastructure. Strengthen the culture of doubt without falling into cynicism. The balance is delicate. Too much naivety makes you vulnerable. Too much suspicion destroys trust. Too much silence allows hostile narratives to take hold. Too much reaction gives visibility to weak operations. Too much centralization makes official speech distant. Too much fragmentation makes the answer incoherent. Cognitive defense is therefore a discipline of precision. It requires understanding human psychology, social dynamics, digital platforms, amplification logics, geopolitical narratives, institutional vulnerabilities and adversary modes of operation. This is also why AI changes the scale of the problem. It does not make the manipulation automatically effective. It does not replace the social terrain, real fractures or human relays. But it increases the pace. It makes it possible to produce more variants, more translations, more fake profiles, more plausible content, more saturation, more ambiguity. The danger is not only spectacular deepfake. The danger is the semi-automated ecosystem capable of maintaining permanent cognitive pressure. A democracy needs time to verify. A hostile operation seeks to reduce this time. A democracy needs trust to decide. A hostile operation seeks to degrade this trust. A democracy needs structured disagreements. A hostile operation seeks to transform these disagreements into irreconcilable hostility. This is the central battle. Hybrid warfare does not always seek to impose a single lie. It may seek to destroy the possibility of even minimal agreement on reality. At this point, the conflict is no longer just about what citizens think. It concerns what they are still able to recognize together. Recognize an attack. Recognize proof. Recognize a mistake. Recognize manipulation. Recognize a legitimate institution despite its imperfections. Recognize a political adversary without turning that adversary into an absolute enemy. Recognize a truth even when it disturbs one’s own side. It is this capacity for common recognition that cognitive warfare attacks. And it is this capacity that must be defended. The most important conclusion therefore is this: cognitive biases are not a secondary topic in modern conflicts. They have become a strategic infrastructure. A society that understands its biases can better resist their exploitation. A society that ignores its biases lets others map them, activate them and transform them into levers of influence. Hybrid warfare does not just win when it makes people believe a lie. It wins when it renders a society incapable of trusting itself long enough to act. This is why the next great frontier in defense is not just cyber, military or technological. It is cognitive. Because in modern conflicts, attacking a country no longer only means targeting its territory, its networks or its institutions. It is targeting a country’s ability to perceive reality before others manufacture it in its place.

Related analysis

The War You Don’t See: Understanding Hybrid Warfare