SAGE Strategic Intelligence Brief #013

Before Block, Blunt, Break:

Integrating Threshold Conditioning™ into NATO’s Existing Counter-Hybrid Architecture

19 October 2026

SAGE International Australia

Author: Dr John Bruni

Suggested Citation

Bruni, J. (2026). Before Block, Blunt, Break: Integrating Threshold Conditioning™ into NATO’s Existing Counter-Hybrid Architecture. SAGE Strategic Intelligence Brief No. 013. SAGE International Australia, 19 October 2026, Adelaide, South Australia.

Executive assessment

At the Warsaw Security Forum on 12 October 2026, NATO’s Supreme Allied Commander Europe (SACEUR), General Alexus Grynkewich, outlined a public theory of victory: “Block, Blunt, Break.” In essence, an attack upon NATO territory would be blocked at the outset, blunted if it continued, and, if required, broken by striking the attacking force and the warfighting systems that sustain it. Grynkewich emphasised the defensive purpose of denying an adversary the ability to seize and hold Allied territory. ^[1]

There is a prior strategic question. What if a potential adversary progressively degrades the political, civilian and operational conditions that make NATO’s conventional response feasible—without launching the invasion to which that response is addressed?

SAGE International defines Threshold Conditioning™ as the deliberate, cumulative manipulation of an adversary’s political, institutional, legal or operational response thresholds to alter the conditions under which that adversary can make decisions, mobilise capabilities or exercise strategic freedom of action. It may employ hybrid methods, but its distinguishing analytical emphasis is the progressive transformation of the target’s decision environment and available options. Evidence of deliberate hostile conditioning must not be inferred solely from accumulating disruptions.

NATO has counter-hybrid institutions and understands cascading vulnerabilities. Its counter-hybrid strategy includes dedicated intelligence analysis, preventive and response options, assistance to Allies and a senior coordinator. Its 2026 Resilience Baseline Requirements explicitly address critical interdependencies and the civilian support NATO military plans require. ^[2][3]

Two exposures deserve explicit attention: artificial intelligence can accelerate cyber intrusion and expand the attack surface of critical systems, while reliance on commercially controlled communications, cloud and space services can create a single point of operational denial. Neither exposure by itself proves a hostile campaign; both can magnify the loss of strategic freedom of action that TCAM is intended to assess. ^[3][12][13]

The proposition advanced here is therefore deliberately narrower: existing information may be made more useful for policy by consistently presenting its cumulative strategic effects, confidence limits and available decisions in a common, concise form. This briefing proposes the Threshold Conditioning Assessment Mechanism (TCAM™), a proposed assessment procedure—not a new headquarters, intelligence organisation or command authority. Public sources cannot establish whether a similar function already exists in classified NATO procedures. TCAM should be tested against current practice, not imposed upon it.

NATO’s capacity to Block, Blunt and Break tomorrow also depends on recognising the gradual degradation of its freedom of action today.

1. A theory of victory and its prerequisites

Grynkewich’s formulation has the virtue of clarity. “Block” denies the attacker an initial breakthrough. “Blunt” prevents a continuing attack from gaining momentum. “Break” seeks to defeat the force and the operational system sustaining aggression. Public reporting of his Warsaw remarks describes a strategy of denial, rather than a programme for invading or occupying the adversary. ^[1]

It would be mistaken to infer that a short public formulation exhausts NATO’s classified planning or its preparation for hybrid conflict. NATO already describes its deterrence and defence posture as integrating conventional, nuclear, cyber and space capabilities; it has developed counter-hybrid arrangements alongside conventional planning. ^[2][4]

Nevertheless, execution requires more than combat-ready formations. Allied governments must remain capable of consultation and decision-making. Ports, railways, road networks, energy systems, communications, commercial providers, and host-nation support must sustain mobilisation and reinforcement. Political cohesion matters because collective decisions and military preparations depend upon governments making choices under pressure.

These are not peripheral assumptions. NATO’s September 2026 Resilience Baseline Requirements directly link national civilian preparedness and host-nation support to military plans, recognise cascading cross-sector disruptions, and address the Reinforcement and Sustainment Network. ^[3] The operational relevance of disruptions can therefore be demonstrated without claiming that every incident is part of a hostile campaign.

2. Threshold Conditioning is an effects problem, not a synonym for hybrid warfare

NATO defines hybrid threats as combinations of military and non-military, overt and covert methods, including disinformation, cyberattack, economic pressure and the use of irregular or regular forces. The European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) also expressly recognises coordinated exploitation of systemic vulnerabilities and thresholds of detection and attribution. Threshold exploitation and cumulative effects are therefore not absent from established hybrid-threat thinking. ^{[2, 18]}

Threshold Conditioning™ is not a replacement for hybrid warfare or an entirely separate category of conflict. It proposes a narrower effects-and-decisions analytical lens: how does repeated exploitation of response thresholds change an opponent’s operational preparedness, institutional responsiveness and strategic freedom of action? This is a difference of analytical focus, not a claim that NATO has overlooked cascading effects.

Interpretation: These perspectives overlap. The comparison describes TCAM’s proposed emphasis, not an exclusive division of analytical tasks. NATO’s existing assessments may already perform comparable work. ^{[2, 3, 18]}

Three proposed differentiators matter. First, it evaluates successive incidents against a baseline to identify cumulative changes in operational and political options. Second, the analysis identifies the particular decision thresholds or divided responsibilities that may have been exploited. Third, it asks whether disadvantageous conditions have become normalised without a clear moment of crisis. The mechanism must demonstrate that these questions improve decision support beyond existing assessments.

The concept requires four evidentiary tests before a sequence is described as a deliberate Threshold Conditioning campaign: (1) a credible strategic pattern linking activities; (2) identifiable exploitation of response thresholds; (3) demonstrable cumulative alteration in capabilities, resilience or available choices; and (4) credible evidence of adversarial intent. Each test must state confidence and alternative explanations. A combination of incidents may produce serious cumulative degradation even when these campaign tests are unmet.

TCAM™ therefore distinguishes three matters: observed cumulative effects, evidence of a coordinated hostile campaign, and options for protective action. A network outage, accidental infrastructure failure and commercially directed service restriction may together degrade reinforcement without proving common adversarial direction. Protective measures need not await attribution, but incident correlation alone cannot justify accusations or military escalation.

3. What NATO already possesses

NATO’s published counter-hybrid guidance identifies a hybrid analysis branch within the Joint Intelligence and Security Division (JISD), a Special Coordinator for Hybrid Threats appointed as a senior focal point in 2025, tailored Counter Hybrid Support Teams available at an Ally’s request, and preventive and response options endorsed in 2022. As at the January 2026 update, the Special Coordinator is Jean Charles Ellermann-Kingombe, Assistant Secretary General for Cyber and Digital Transformation. ^[2]

The Resilience Committee reports directly to the North Atlantic Council (NAC), provides resilience policy and planning guidance, and coordinates with NATO military authorities. ^[5] The Military Committee provides the NAC with consensus-based military advice. ^[6] The NATO Situation Centre (SITCEN) operates around the clock, exchanging information and providing alerts and situational awareness to the NAC and Military Committee. ^[7]

The Council Operations and Exercises Committee (COEC) plays an established role in crisis-management procedures and annual exercises that test Alliance decision-making. ^[8] NATO also has longstanding crisis assessment and response processes designed to coordinate staff and committee advice before political decisions. ^[9]

The published 2026 resilience requirements are particularly relevant. They already call for cross-sector analysis, consideration of cascading disruption, and a mechanism to notify NATO of significant transport-system problems that could affect the Reinforcement and Sustainment Network. ^[3] It would therefore be inaccurate to claim that TCAM invents cross-sector awareness, crisis assessment or infrastructure notification.

The proposed additional value is a short, explicit cumulative-effects decision product: what has changed in NATO’s strategic freedom of action, with what level of confidence, over what time horizon, and which existing authorities could consider which protective responses? This proposed format is a candidate refinement of existing processes, not evidence of an institutional vacuum.

3.1 AI-enabled disruption and concentrated technology control

Artificial intelligence is not merely another platform for disruption. AI can assist reconnaissance, vulnerability discovery, social engineering, and cyber intrusion, and integrating it into critical systems can create additional avenues for compromise. The UK National Cyber Security Centre assesses that AI will almost certainly increase the effectiveness and efficiency of cyber intrusion elements through 2027, while AI adoption in critical national infrastructure expands the attack surface. These findings do not demonstrate that fully autonomous AI campaigns can already conduct complex strategic attacks without human direction. ^[12]

For Threshold Conditioning, AI creates a potential tempo problem. Automated or AI-assisted activity may produce more frequent, mutually reinforcing incidents, compressing the interval between disruption, detection, attribution, and protective decision. TCAM should therefore record whether automation plausibly increases the rate, scale, or synchronisation of observed effects, while avoiding unsupported claims about the technology used.

A second exposure concerns ownership and control of indispensable military-enabling services. Operational dependence on a single commercial satellite, cloud, software, or communications provider can limit sovereign freedom of action when service access depends on contractual terms, technical controls, supplier continuity, or a foreign government’s decisions. This is a concentration and assured-access problem, not necessarily evidence of a monopoly in a legally defined market.

Ukraine’s reliance on SpaceX satellite services illustrates this vulnerability. SpaceX distinguishes Starlink, its commercial broadband service, from Starshield, a government and national-security offering built on Starlink technology. Ukrainian officials reported speed-dependent restrictions affecting military satellite connectivity and drone operations, and AP described Ukrainian efforts to resolve the restrictions with SpaceX and the Pentagon. Reuters subsequently reported, citing two US officials and one Western official, that an instruction to slow Ukraine’s Starshield service originated within the White House and reached senior Defense Department officials. The sources did not identify the person who authorised it or the individual or organisation that implemented it. ^{[13][14][15][16]}

3.2 Decision authority versus technical execution: what the Starshield case establishes

The open-source decision tree has at least five distinct nodes. (1) Operational effect: Ukrainian users reported speed-triggered loss or degradation of service; the detailed scope across Starlink and Starshield remains subject to differing accounts. (2) Reported instruction: Reuters’ anonymous official sources located the origin of the Starshield restriction instruction inside the White House. (3) Transmission: those sources said senior Defense Department leaders received the message. (4) Authorisation: neither the named presidential decision-maker nor a specific written order has been publicly demonstrated; President Trump denied requesting the restriction. (5) Execution: the precise technical act, contractual direction and implementing organisation are not confirmed in the public reports. Neither a Pentagon contracting authority nor a SpaceX technician should be treated as involved merely because each could have had a role. ^[14][15][17]

Elon Musk has said the US government controls Starshield usage limits; this is his account of authority, not proof of the full chain of command in this incident. Separate press accounts mention discussions or suspicions involving Musk, but they do not establish that he unilaterally ordered this restriction. Nor does reporting that a request originated in the White House prove a personally signed presidential directive. A White House-origin instruction, legal authorisation under a specific contract, and technical implementation by a provider are separate evidentiary propositions. ^[15][17]

The result should not be called a universal “Starlink shutdown”. The reported event involved speed-related restrictions and operational disruption; the accounts vary in product, mission, and geographic scope. Political motive is contested. The incident is not proof of Russian Threshold Conditioning, but it shows how decisions outside the dependent force’s control can constrain a technologically indispensable military function. For TCAM, the required assessment is an assured-access and authority map: identify the service owner, contracting customer, policy authority, technical administrator, geographic or mission-specific restrictions, fallback capacity and estimated recovery time—recording unknowns rather than filling them by inference. ^{[13][14][15][17]}

NATO has not overlooked these dependencies. Its September 2026 Resilience Baseline Requirements explicitly call for scrutiny of supply chains, foreign ownership, control of communications providers, access and contingency arrangements. TCAM would add a decision-oriented question: if an indispensable commercial service becomes unavailable at the same time as other disruptions, which military tasks, alternative routes, decision deadlines or political options are impaired, and who is authorised to restore or substitute the capability? ^[3]

Figure 1. Institutional relationships and proposed TCAM information flow

The first column identifies existing NATO structures and their publicly described roles. The second indicates suggested TCAM responsibilities; these are proposals and do not constitute an approved chain of command.

Proposed information flow (not an existing command chain): authorised incident reporting → JISD-led cumulative-effects assessment → existing specialist consultation and policy coordination → established military/political advice → NAC consideration where collective decisions are required. National authorities retain their respective powers.

4. TCAM™: operating concept

TCAM is proposed as a standardised analytical procedure embedded in existing reporting and consultation arrangements. It has five functions: detect a potentially consequential pattern; assess cumulative effects; separate confidence in effects from confidence in attribution; identify plausible trajectories; and map possible responses to existing authorities.

4.1 Initiation

An assessment would be considered—not automatically commissioned—when existing reporting indicates one of the following: repeated degradation of one operational requirement; different domains converging on a critical dependency; demonstrable loss of redundancy in military-enabling infrastructure; sustained interference with collective decision-making; or a material consequence for readiness, reinforcement or civil support. Media prominence alone would not be an activation criterion.

4.2 Analytical ownership

JISD’s hybrid analysis capability is the proposed analytical lead, subject to confirmation of internal mandates and capacity. It would use information available under existing rules, identify relevant relationships and alternative explanations, and distinguish observed effects from inferred adversarial purpose. No new national reporting obligation, intelligence database or collection authority is assumed.

4.3 Functional consultation

Where the assessment concerns civilian systems, the Resilience Committee’s established machinery would supply relevant resilience judgements. Where it affects military feasibility, military authorities and appropriate NATO command staffs would assess implications through existing lines, with Military Committee advice to the NAC as required. The Special Coordinator would be a proposed policy-integration focal point, not a new commander or superior of those organisations. SITCEN would continue existing situational awareness and alerting functions; it would not become a TCAM watch centre. ^[2][5][6][7]

4.4 The one-page assessment

Each TCAM product would contain five fields:

Pattern: Which events or pressures are established, and which relationships are hypothesised?

Effect: Which specific operational capability, resilience function or political option has deteriorated? What is the baseline and observable change?

Confidence: How strong is evidence of the effect, how strong is attribution, and what benign or unrelated explanations remain?

Trajectory: Is the consequence expanding or stabilising; what is at risk over relevant decision horizons?

Options and ownership: What lawful protective or preparatory measures could be considered, which authority owns each decision, and what further consultation is necessary?

The assessment should not reduce these dimensions to a single composite risk score. That would conceal uncertainty, imply spurious precision and potentially reward alarming but weakly supported narratives.

Within the existing five fields—not as separate forms—analysts should record two cross-cutting checks: (i) AI-enabled acceleration, where supported by evidence, including the time available for response; and (ii) assured access to critical provider services, including control rights, contractual guarantees, realistic alternatives and restoration timelines. The analytical owner should distinguish a supplier outage, lawful access restriction, hostile compromise and state-directed coercion; those causes have different evidentiary and policy implications.

4.5 Descriptive assessment categories

An emerging pattern indicates activity or effects warranting examination; cumulative degradation identifies demonstrable deterioration in defined capabilities or functions; strategic impairment denotes a material constraint on deterrence, decision, reinforcement, sustainment, or defence. These are consequence categories, not labels of a confirmed Threshold Conditioning campaign, and have no automatic legal or military effect. A separate confidence judgement records whether the four campaign tests—pattern, threshold exploitation, cumulative alteration and adversarial intent—are supported.

4.6 Political and legal safeguards

TCAM would neither amend the North Atlantic Treaty nor create a route around the NAC. Article 3 provides an important foundation for individual and collective capacity to resist armed attack. Any Ally may request Article 4 consultation when it considers its security, territorial integrity or political independence threatened; Alliance decisions follow consensus. NATO assesses Article 5 on a case-by-case basis, and it recognises that sufficiently serious cyber or hybrid activity may constitute an armed attack. Article 4 is not a mandatory preliminary step to Article 5. ^[2][10][11]

TCAM would not deem political disagreement evidence of hostile influence. Its categories could not automatically authorise military action, trigger treaty provisions or override national control of intelligence and domestic security operations. Proposed responses must preserve the distinction between resilience measures, intelligence judgements, diplomatic steps and military action.

5. Illustrative assessment: Baltic reinforcement resilience

Consider a fictional 30-day period in which rail signalling interruptions, a port scheduling cyber incident and unreliable communications reduce the reliability of reinforcement routes towards NATO’s northeastern members. A concurrent influence campaign attempts to weaken domestic support for additional deployments. One interruption ultimately proves to be accidental; the attribution of the others remains disputed.

A conventional incident report might capture each event correctly. The cumulative assessment asks whether the combination has reduced viable routes, increased time-to-deploy, or introduced a common point of failure. The evidence might support a finding of cumulative degradation despite low confidence in a common hostile direction.

A TCAM assessment would therefore separate: high confidence that certain transport functions have degraded; qualified confidence that alternative capacity is insufficient; and low confidence that the incidents originate from one hostile actor. Its response column might identify nationally owned infrastructure protection, alternative-route validation, improved host-nation support arrangements and consideration of NATO consultation as options—not automatic recommendations for military escalation.

The scenario should also inject a sudden restriction on a fictional commercial satellite service supporting force communications, alongside a surge of suspected AI-assisted intrusion attempts. Participants should assess technical continuity, provider and government authority, substitution time and cumulative reinforcement impact without presuming that the service restriction and cyber events share an author.

The exercise should be designed to make an analyst fail if they incorrectly bundle the accidental incident into a hostile campaign. It should also expose a failure to warn if analysts ignore verifiable cumulative effects merely because attribution is incomplete.

5.1 Tabletop exercise design: Baltic Reinforcement Under Threshold Conditioning

Purpose. Test whether the TCAM assessment identifies cumulative capability degradation, preserves attribution uncertainty and provides actionable options through existing NATO bodies faster and with less duplication than current reporting alone.

Exercise format. Use one existing approved NATO workshop or crisis-management exercise. Participants should represent the relevant existing intelligence, resilience, military and policy functions; no new standing exercise organisation is envisaged. Run the scenario twice—once using current reporting and once using the TCAM template—where practical.

Evaluation. Compare detection of cumulative effects; false-positive attribution; time from reporting to a decision-ready product; clarity of legal and institutional authority; adequacy of alternative-service planning; personnel hours; and any duplicated reporting. An effective pilot must show decision value without material net administrative growth. Include a negative-control inject in which a technical accident produces genuine disruption but no substantiated hostile pattern; participants must reject false campaign attribution while addressing observed effects.

6. An institutionally restrained pilot

SAGE proposes a limited test within an already approved exercise or analytical workshop, using COEC’s existing crisis-management exercise role where appropriate and subject to NATO agreement. The scenario would contain cross-domain disruptions, imperfect intelligence, benign false positives, disagreements among Allies and consequential military dependencies. ^[8]

The exercise should explicitly test whether the existing TCAM template can capture AI-driven compression of response time and commercially mediated denial of an essential service, without creating an additional reporting channel.

No new headquarters, committee, permanent post or parallel intelligence reporting system would be created. Each participating office would contribute only through established authority and information controls. The system should include one standard assessment template, an identified pilot sponsor within NATO, an agreed review route, and an explicit stop condition.

Evaluation should compare TCAM with the existing briefing process on six criteria: whether cumulative effects were recognised earlier; whether the correct decision owner was identified; whether uncertainty and alternative explanations were recorded; whether feasible protective choices were made clearer; whether any useful information was genuinely new; and whether preparation duplicated effort or materially displaced other work.

A bureaucracy-neutral design is plausible because it proposes no standing structure. Cost neutrality cannot be assumed: even an additional one-page assessment imposes opportunity costs. The pilot must measure staff time, duplication and any extra expenditure. If current classified or unclassified NATO processes already achieve the same purpose, TCAM should be incorporated as a refinement where useful—or not adopted.

7. Recommendations

1. Map the existing process before designing a replacement.

NATO should first test whether its classified and public procedures already join hybrid intelligence, resilience effects and operational decision requirements in a comparable format.

2. Pilot an effects-first assessment format.

Invite the relevant established offices to assess whether the five-field TCAM template makes the consequences of cumulative disruption more decision-relevant than existing products.

3. Separate attribution from exposure.

Require explicit confidence judgements and alternative explanations, while allowing protective action where a vulnerability is demonstrable.

4. Connect assessments to military feasibility.

Where practicable, translate effects into consequences for reinforcement routes, sustainment, communications, readiness or decision timelines, without disclosing classified plans in public reporting.

5. Preserve authority and minimise reporting.

Every proposed option should name its existing national or NATO decision owner. Avoid new reporting requirements, standing committees or automatic escalation rules.

6. Assess AI-enabled tempo and assured commercial access.

Within existing resilience and military planning assessments, examine whether AI-assisted operations accelerate cumulative disruption, and whether critical commercial services have verifiable continuity arrangements, substitution options and identified national or NATO decision owners. ^[3][12-14]

7. Evaluate and terminate if redundant.

Record the additional staff burden and compare the product with current practice. Do not institutionalise TCAM unless it has demonstrable net value.

Conclusion

General Grynkewich’s Block, Blunt, Break explains, in public terms, how NATO would deny an attacker military success. Yet the Alliance’s ability to execute that theory depends upon political cohesion, resilient infrastructure, operational readiness and assured access to the capabilities necessary for collective defence. Adversaries can progressively degrade these conditions before conventional hostilities commence.

Threshold Conditioning™ provides an analytical framework for examining that process. TCAM™ offers a practical way to translate cumulative strategic effects into decision-relevant assessments through NATO’s existing institutional architecture. Its purpose can be captured in three complementary imperatives: recognise emerging patterns of cumulative strategic degradation; understand how those developments affect Allied decision-making, critical dependencies and strategic freedom of action; and resist the progressive erosion of those conditions through timely, proportionate measures undertaken by existing national and Alliance authorities.

These functions do not substitute for NATO’s established counter-hybrid capabilities, nor do they create new military or political authorities. Rather, they describe the strategic purpose that TCAM is intended to serve. An important limitation remains: NATO may already have comparable mechanisms within its classified assessment and planning arrangements. NATO must therefore demonstrate TCAM’s additional value rather than assume it.

Before NATO can Block, Blunt and Break, it must be able to recognise, understand, and resist the cumulative degradation of the conditions on which its military effectiveness depends. In that sense, Recognise, Understand, Resist complements Block, Blunt, Break as a preventive and decision-support measure.

Recognise. Understand. Resist.

Figure 2. Complementary strategic frameworks

TCAM supports existing national and NATO decision-makers; it does not itself authorise action. These frameworks are complementary, not interchangeable.

Then, if deterrence fails: Block. Blunt. Break.

Annex A. TCAM™ one-page assessment checklist (proposed template)

This form is an illustrative decision-support product, not a NATO-approved instrument. Complete only from authorised information. Distinguish factual effects from hypothesised hostile intent; record classification, provenance, confidence and baseline. If identifying a Threshold Conditioning campaign, test strategic pattern, threshold exploitation, cumulative alteration and adversarial intent separately.

Analytical note: a provider-related interruption may generate strategic degradation without being an adversarial Threshold Conditioning operation. The form must not merge an observed loss of access, a reported instruction, the legal authority to direct a service and the technical executor into a single unverified claim.

References

1. Anadolu Agency, “NATO’s top military commander outlines ‘block, blunt, and break’ strategy to counter potential attacks,” 12 October 2026. https://www.aa.com.tr/en/europe/natos-top-military-commander-outlines-block-blunt-and-break-strategy-to-counter-potential-attacks/4086288
2. NATO, “Countering hybrid threats,” updated 29 January 2026. https://www.nato.int/en/what-we-do/deterrence-and-defence/countering-hybrid-threats
3. NATO, “2026 Resilience Baseline Requirements,” 15 September 2026. https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/15/2026-resilience-baseline-requirements
4. NATO, “Deterrence and defence,” updated 25 June 2026. https://www.nato.int/en/what-we-do/deterrence-and-defence/deterrence-and-defence
5. NATO, “Resilience Committee,” updated 7 October 2022. https://www.nato.int/en/about-us/organization/nato-structure/resilience-committee
6. NATO, “Military Committee,” updated 17 January 2025. https://nato.int/en/about-us/organization/nato-structure/nato-military-committee/military-committee
7. NATO, “Situation Centre (SITCEN),” updated 3 April 2026. https://www.nato.int/en/about-us/organization/nato-structure/situation-centre-sitcen
8. NATO, “Council Operations and Exercises Committee (COEC),” updated 29 September 2022. https://nato.int/en/about-us/organization/nato-structure/council-operations-and-exercises-committee-coec
9. NATO, “NATO’s assessment of a crisis and development of response strategies,” 10 May 2011 (historical account; not proof of unchanged 2026 detailed procedures). https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2011/05/10/natos-assessment-of-a-crisis-and-development-of-response-strategies
10. NATO, “The consultation process and Article 4,” updated 23 September 2025. https://www.nato.int/en/what-we-do/introduction-to-nato/the-consultation-process-and-article-4
11. NATO, “Collective defence and Article 5.” https://nato.int/en/what-we-do/introduction-to-nato/collective-defence-and-article-5
12. UK National Cyber Security Centre, “Impact of AI on cyber threat from now to 2027,” 2025. https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
13. Reuters, “Ukraine says SpaceX limits Starlink operations, disrupting military missions,” 14 October 2026. https://www.reuters.com/world/europe/spacex-limits-starlink-operations-ukraine-disrupting-military-missions-2026-10-14/
14. Associated Press, “Presidential adviser says Ukraine is in talks to lift speed limit on military satellite network,” 16 October 2026. https://apnews.com/article/385eb944f6c34990bdf21f624416b820
15. Reuters, Erin Banco and Gram Slattery, “Order to limit Starshield for Ukraine came from inside White House, sources say,” 16 October 2026 (syndicated by Defense News). https://www.defensenews.com/pentagon/2026/10/16/order-to-limit-starshield-for-ukraine-came-from-inside-white-house-sources-say/
16. SpaceX, “Starshield — Supporting national security,” product information. https://new.spacex.com/starshield ; Starlink, government procurement and product distinctions. https://starlink.com/en-qa/support/article/3ccad59e-9525-9492-9835-d1945a4ee30f
17. Axios, “Zelensky says Musk-owned satellite system still restricted in Ukraine,” 17 October 2026 (contrasting White House, SpaceX and Ukrainian accounts). https://www.axios.com/2026/10/17/zelensky-starlink-elon-musk-trump
18. European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), “Hybrid threats,” https://www.hybridcoe.fi/hybrid-threats/ (accessed 18 October 2026).

Make #13 downloadable now

Disclaimer

SAGE Strategic Intelligence Briefs are produced independently and are intended to support informed discussion of geopolitical, defence, security and economic developments. Assessments reflect information available at the time of publication and may change as new information emerges.

About SAGE International Australia

SAGE International Australia is an independent strategic research and analysis organisation specialising in geopolitics, defence, national security, economic resilience and strategic foresight.

Through objective, evidence-based, non-partisan analysis, SAGE helps decision-makers understand risk, identify opportunity, and prepare for future challenges.

For more information, visit:

www.sageinternational.com.au

Publication notice

Terminology and attribution: SAGE International has publicly developed and presented its Threshold Conditioning framework, including in SIB #004 (10 August 2026). This briefing proposes the Threshold Conditioning Assessment Mechanism (TCAM) as an independent SAGE policy concept, not NATO doctrine or an endorsed Alliance procedure. Use of ™ indicates a claimed designation, not registration or exclusive legal rights. © 2026 SAGE International. Copyright applies to the original expression of this publication, not to the underlying ideas or terminology as such.