Changing Character of Warfare — Hybrid Threats & India's Strategic Readiness

From Clausewitz to the Grey Zone

Carl von Clausewitz famously described war as a continuation of politics by other means. What he could not have envisioned is a world where that "continuation" is now perpetual, invisible, and fought simultaneously across five domains — land, sea, air, cyber, and space — plus a sixth: the human mind. The modern security environment is no longer defined by the binary of war and peace but by what strategists call the grey zone: a space of sustained, ambiguous competition below the threshold of armed conflict where adversaries pursue strategic objectives while maintaining plausible deniability.

The concept crystallised in post-Cold War conflict analysis, but it was American defence researcher Frank Hoffman in 2007 who gave it operational definition, using the Lebanon War of 2006 — where Hezbollah blended guerilla tactics, missile strikes, information warfare, and civilian shielding — to argue that future adversaries would not choose between conventional and unconventional methods but deploy both simultaneously. That insight now shapes every serious security doctrine on earth.

What Has Actually Changed — The Five Structural Shifts

Five structural changes distinguish contemporary warfare from the 20th-century model:

• Threshold compression: Adversaries deliberately keep operations below the level that would trigger a legally recognised armed response. A cyberattack on a power grid, a drone incursion, a disinformation campaign — none individually crosses the threshold of "armed attack" under Article 51 of the UN Charter, yet cumulatively they inflict real strategic damage.
• Attribution ambiguity: State-sponsored attacks are routed through proxies, commercial tools, or third-country infrastructure, making attribution legally and politically contested. China's 2020 suspected cyberattack on Mumbai's power grid was never publicly acknowledged as state action, preventing a conventional deterrent response.
• Speed asymmetry: Autonomous systems and AI-enabled targeting can act faster than human decision cycles. The time between detection and strike has collapsed from hours to seconds, challenging command-and-control architectures designed for deliberate human authorisation.
• Cost inversion: Cheap drones and cybertools have upended the traditional advantage of expensive military platforms. During Operation Sindoor, Pakistan used low-cost drones to probe India's air defence networks, forcing India to expend expensive missiles and radar time on asymmetric threats.
• Societal targeting: Modern hybrid warfare is explicitly aimed at civilian populations — their perceptions, their confidence in institutions, their economic behaviour. This makes every citizen a potential battlefield participant and every information platform a potential weapon.

Why This Matters Specifically for India

India sits at the intersection of unique vulnerabilities. It faces two nuclear-armed adversaries — China and Pakistan — who have explicitly adopted grey-zone strategies against it. It has one of the world's largest digital populations, making it a premium target for information warfare. Its critical infrastructure spans vast geographies with uneven cyber-hardening. And its defence establishment, while powerful, is completing a multi-decade transition from a platform-centric to a network-centric conception of war — a transition that adversaries are not waiting for it to complete.

Domain 1 — Cyber Warfare

Cyber operations have become the first instrument of choice in grey-zone competition because they are cheap, deniable, and scalable. China's approach follows what analysts call "salami-slicing in cyberspace" — persistent low-intensity intrusions that remain below the threshold of armed attack. The 2020 suspected Chinese attack on the Mumbai power grid — which briefly knocked out a third of the city's power — is the most high-profile example. India's rail network, defence procurement portals, and BARC (the Bhabha Atomic Research Centre, first targeted in 1998) have all been documented targets.

Pakistan's cyber capability, though less sophisticated, is growing and is being augmented by Chinese technology transfer. During Operation Sindoor, Pakistan launched cyber-offensive operations alongside its kinetic response — the first time cyberspace played an active parallel role in an India-Pakistan conflict. India's response exposed a structural problem: the Defence Cyber Agency (DCyA), established in 2019, faces persistent inter-service silos, with Army, Navy, and Air Force maintaining separate cyber units that don't always share threat intelligence in real time.

Domain 2 — Cognitive & Information Warfare

Cognitive warfare — the deliberate manipulation of human perception, trust, and decision-making — may be the most consequential and least understood dimension of the new warfare. Pakistan deployed what analysts classify as fifth-generation warfare (5GW) operations during Operation Sindoor: disinformation campaigns targeting Indian public perception, false claims amplified through social media, and international narrative management. Chinese state media outlets CGTN, Xinhua, and Global Times, as well as Turkish broadcaster TRT, actively amplified Pakistani narratives and disseminated fabricated stories — including the false claim that India had captured a female Air Force pilot.

The result was a strategic asymmetry: India won on the battlefield but, by most independent assessments, struggled to convert that military success into a perception victory. This is not a new vulnerability — India has historically been reactive in information operations — but Operation Sindoor crystallised just how costly that gap has become. A parliamentary committee report confirmed in 2026 that no dedicated cognitive warfare organisation existed; however, CDS Chauhan announced in May 2026 that financial clearance had been secured for a new Cognitive Warfare Action Force.

Domain 3 — Proxy & Drone Warfare

Pakistan's decades-long strategy of "bleeding India with a thousand cuts" through proxy non-state actors has evolved. The Pahalgam attack of April 22, 2025 — which killed 26 tourists and triggered Operation Sindoor — followed the same pattern: state-sponsored terrorism using non-state actors (Lashkar-e-Taiba and Jaish-e-Mohammed) to maintain plausible deniability. But the addition of drone delivery systems for weapons and narcotics across the border has added a new operational layer that traditional counter-terrorism frameworks were not designed to address. The BSF intercepted 125 drone incursions from Pakistan in 2024 alone — a sharp escalation from previous years.

Low-cost drones have inverted traditional cost calculations. India's air defence systems — the L-70 and ZU-23mm guns, Schilka platforms, DRDO electronic warfare suites — are expensive to operate at scale against cheap, proliferating drones. There is no sustainable equation in which India defeats a ₹50,000 drone with a ₹50 lakh missile indefinitely.

Domain 4 — Economic & Space Coercion

Economic coercion — using trade, investment, and debt as strategic tools — is China's speciality. The Belt and Road Initiative's debt-trap diplomacy in India's neighbourhood (Sri Lanka's Hambantota Port, Pakistan's CPEC) is a form of strategic encirclement that complements military pressure. In the space domain, China has developed counter-space capabilities including anti-satellite missiles, electronic jamming, and directed-energy weapons. India, which relies on its GSAT and IRNSS satellite constellations for military communications, lags in both space surveillance and counter-space technology — a vulnerability ORF's 2025 analysis flagged explicitly.

What Are Lethal Autonomous Weapons Systems (LAWS)?

In November 2024, the UN Convention on Certain Conventional Weapons (CCW) Group of Governmental Experts provisionally agreed on a characterisation: a LAWS is "an integrated combination of one or more weapons and technological components that enable the system to identify and/or select, and engage a target, without intervention by a human user in the execution of these tasks." The critical phrase is "without human intervention" — LAWS can perceive, decide, and act within their own decision cycle, raising fundamental questions about accountability, proportionality, and the future of IHL.

The global drone warfare experience — from Ukraine's FPV drone campaigns to Azerbaijan's use of Turkish Bayraktar TB2s in Nagorno-Karabakh — represents a spectrum of autonomy, not full LAWS. But the trajectory is clear: AI-enabled autonomous decision-making on the battlefield is approaching, not receding.

India's Development of Autonomous Systems

India is actively building autonomous military capabilities even as the international legal framework remains contested. DRDO's Centre for Artificial Intelligence and Robotics (CAIR) has developed over 75 AI products including autonomous underwater vehicles (scheduled for deployment in 2026 for maritime security), AI-powered swarm drones (the MBC2 system designed for autonomous target neutralisation), and the Indrajaal defensive system that uses AI to counter aerial threats over thousands of square kilometres. The Rudrastra Hybrid VTOL UAV, with a 170 km range, provides tactical reconnaissance with autonomous capability. By early 2026, India was beginning deliveries of 40,000 Negev NG7 LMGs with autonomous variants already tested at high altitude.

A 2026 parliamentary committee report, however, confirmed the governance paradox: India is developing LAWS while the Ministry of Electronics and IT told the committee that "specific laws for AI are yet to be enacted in India." No domestic AI law exists. No domestic AI governance framework for defence applications exists. India is building the weapons faster than it is building the rules for them.

India's International Position — A Studied Ambiguity

India's position at the CCW GGE has been deliberately nuanced. It chaired the GGE in 2017–18 when the eleven guiding principles on LAWS were developed. India does not support a legally binding treaty prohibiting LAWS — it argues that a common definition must precede regulation, and that existing IHL is adequate. This stance aligns India with the US, Russia, China, and Israel — all of which are investing heavily in autonomous systems and are therefore reluctant to accept binding restrictions. However, in a shift from its 2023 position, India voted in favour of UN General Assembly Resolution 80/57 in December 2025, signalling some openness to a broader multilateral process.

Vulnerability 1 — The Cyber Governance Gap

India's primary cybersecurity law is the Information Technology Act, 2000 (amended 2008), supplemented by CERT-In directions. But the National Cyber Security Policy of 2013 — India's comprehensive cyber doctrine — is now over a decade old. It was designed for an era before AI-driven cyber threats, quantum computing risks, and the integration of cyberspace into kinetic military operations. ORF's 2025 analysis found that India's critical infrastructure "remains vulnerable" and that official policy is "in need of revision." The Defence Cyber Agency, while a step forward, faces inter-service coordination problems: Army, Navy, and Air Force maintain separate cyber units with independent priorities. Multi-phase cybersecurity drills in June 2025 were intended to address this, but doctrinal ambiguity remains.

Vulnerability 2 — The Cognitive Domain Deficit

India's most under-addressed vulnerability may be cognitive. India lacks the linguistic depth, institutional agility, and coordinated infrastructure for large-scale information operations. Pakistan's 5GW campaigns exploit India's democratic pluralism — creating targeted narratives for regional audiences, diaspora communities, and international media. The Operation Sindoor experience showed that even where India's conventional military superiority was evident, the information battle was effectively ceded. Official government communication is too formal and too slow for the social-media news cycle that shapes international perception in real time. The absence of a dedicated cognitive warfare organisation — now being corrected with the new Cognitive Warfare Action Force, cleared in May 2026 — left India strategically exposed for years.

Vulnerability 3 — The Theatre Command Delay

India's 17 single-service commands were designed for a different era. The Kargil Review Committee of 1999 recommended integrated theatre commands. That recommendation sat largely unimplemented for 25 years. China, meanwhile, restructured the PLA into five theatre commands in 2015. Pakistan has adapted its military structure for multi-domain operations. India's lack of integrated theatre commands means that cyber, space, conventional, and cognitive capabilities are still planned and executed in service silos — a structural problem that Operation Sindoor exposed sharply. Tri-service synergy during Sindoor was praised, but it was achieved through coordination rather than integrated command architecture — a higher-friction and less-reliable mechanism.

Implication 1 — The Deterrence Doctrine Must Evolve

India's traditional deterrence posture rests on two pillars: conventional military superiority and nuclear second-strike capability. Neither addresses grey-zone aggression effectively. A cyberattack on a power grid does not trigger the NFU nuclear doctrine. A disinformation campaign does not warrant conventional military retaliation. India needs a graduated deterrence continuum that includes credible cyber counter-strike capacity, cognitive warfare response capabilities, and defined red lines in the grey zone. The absence of such a continuum has allowed Pakistan to pursue its "thousand cuts" strategy for decades and China to pursue "salami-slicing" along the LAC with relative impunity below the threshold of declared conflict.

Implication 2 — Democratic Institutions Under Pressure

Cognitive warfare attacks democratic institutions by design. Disinformation campaigns targeting electoral processes, deepfake technology used for political manipulation, AI-generated content flooding public discourse — these are not hypothetical. India's Election Commission, judicial institutions, and parliamentary processes are all potential targets of adversary cognitive operations. The 2026 parliamentary committee report on AI found that shell companies are being created with AI-generated documents, deepfakes are defeating KYC processes at banks, and AI executes thousands of transactions simultaneously to evade anti-money-laundering detection. These are civilian manifestations of tools that, in a hostile context, become weapons of hybrid warfare.

Implication 3 — The Constitutional and Legal Accountability Gap

The use of autonomous systems in conflict raises constitutional questions that India has not resolved. Article 21 — the right to life — and its derivative right to protection from arbitrary state action require that lethal force be authorised by accountable human decision-makers operating within established legal frameworks. Autonomous weapons that engage targets without human authorisation challenge this requirement. No Parliamentary legislation governs the development, testing, or deployment of LAWS. No regulatory framework addresses civilian AI oversight in defence applications. This is not merely a policy gap — it is a potential constitutional exposure.

Implication 4 — Economic and Infrastructure Security

Hybrid warfare's targeting of critical infrastructure — power grids, financial systems, communication networks — blurs the line between military and economic security. India's digital economy is now large enough that a sustained cyberattack on payment infrastructure, banking systems, or power generation could have macroeconomic consequences comparable to a conventional military strike. The ₹12,500 crore unspent from the 2024–25 defence procurement budget — a recurring procurement efficiency problem — compounds this risk: India cannot absorb the cost of simultaneous military modernisation, cyber hardening, and economic infrastructure protection without resolving its procurement execution problems.

Operation Sindoor's Institutional Lessons

The Defence Ministry characterised Operation Sindoor as demonstrating "tri-services synergy, strategic depth, and technological dominance." Multi-agency intelligence provided targeting data for nine major camps. BrahMos supersonic cruise missiles, French SCALP-EG cruise missiles, AASM Hammer bombs, S-400 air defence, and indigenous EW suites were integrated in a 23-minute strike package. But the institutional lesson is as much about gaps as achievements. Tri-service coordination happened despite the absence of formal theatre commands — a testament to professional excellence but also a warning about systemic fragility.

India's 2047 Vision for Defence Technology

A government 2047 Vision document released in March 2026 outlined four new specialised tri-services organisations: a Defence Geospatial Agency, a Data Force, a Drone Force, and the Cognitive Warfare Action Force. The Semiconductor Mission (₹76,000 crore) aims to reduce dependence on US-controlled chip supply chains that currently constrain India's AI weapons development. The SRIJAN Portal has indigenised over 14,000 defence items as of February 2025, and five Positive Indigenisation Lists now ban import of over 5,500 items — creating domestic demand that iDEX and DRDO can supply.

What India Must Do Differently

The global comparison reveals a consistent pattern: the most effective hybrid warfare responses share three structural features that India is still building toward. First, unified multi-domain command — a single command architecture that integrates cyber, space, cognitive, and conventional capabilities under coherent operational authority. Second, civil-military technology fusion — a systematic pipeline from private sector innovation to military application, running faster than the standard procurement timeline. Third, proactive cognitive infrastructure — dedicated state capacity for narrative management, disinformation counter-operations, and international perception management, staffed by people who understand both technology and geopolitics.

India has the building blocks — iDEX, DRDO, a large technology sector, and demonstrated military professionalism. What it lacks, and what the global comparison makes clear, is the institutional architecture to integrate them.