Both state and non-state actors are increasingly using atypical instruments in atypical combinations in international politics. This includes, for example, cyber operations or disinformation campaigns. These types of attacks are frequently referred to as “hybrid threats.”
Despite the growing relevance of these hybrid threats in the Western security landscape, we still know fairly little about exact extent of such threats.
Hybrid threats deliberately blur the lines between war and peace, as well as between friend and foe, by employing atypical instruments in unconventional combinations. This creates a state of strategically-calculated ambiguity, in which the threatened target can no longer clearly assess its security environment. The Heidelberg Hybrid Threat Indicator quantifies this ambiguity, translating it into a warning system for hybrid threats and their evolution over time. It examines the three dimensions of ambiguity: complexity, deniability, and bonding capacity.
In the video below, you will get an initial overview of the conceptual and methodological foundations of our proof-of-concept, as well as further possible applications of the HTI.
Dashboard
The HTI uses the six indicators listed below to measure hybrid threats. On a monthly basis, our dashboard provides access to indicators available for Germany, Poland, Moldova, Lithuania, and Kosovo.






Our Concept
The HTI conceptualizes hybrid threats as atypical combinations of atypical instruments by malicious actors. They create complex situations, in which the threatened target can no longer clearly assess its security environment. This strategically calculated ambiguity lies at the core of hybrid threats. It is created by the three dimension: Complexity, Deniability and Bonding Capacity.
Methodology & Data
For the quantification of hybrid threats, the HTI relies on the latest methods of empirical social research. A central element is a sequential network analysis based on machine learning. This analysis is applied to several data sources provided by Traversals Analytics and Intelligence GmbH; the European Repository of Cyber Incidents (EuRepoC); and the POLitical Event Classification, Attributes, and Types (POLECAT) database.
Case Study
Using the example of the conflict between Serbia and the Republic of Kosovo as a pilot study, we demonstrate possible interpretations of the HTI, its analytical value, its application in research, and its limitations.
About us
The HTI was funded by the German Foundation for Peace Research (DSF) and developed at the Chair of International Relations and Foreign Policy at the University of Heidelberg, in close collaboration with Traversals Analytics and Intelligence GmbH and the European Repository of Cyber Incidents (EuRepoC).