UK and Germany stand up a joint partnership against hybrid threats to critical infrastructure
The UK and Germany have committed to a counter-hybrid threat partnership announced after Burnham and Merz met in Berlin, pairing resilience-building against cyber-attacks and sabotage with a stated aim to degrade hostile actors' capacity to operate in Europe.
Prime Minister Andy Burnham met Federal Chancellor Friedrich Merz in Berlin on October 8, 2026, and the meeting produced a security commitment with a specific target: the two governments agreed to cooperate to address Russian hybrid threats to the countries’ critical national infrastructure. The instrument behind that commitment is a joint counter-hybrid threat partnership aimed at the kind of hostile activity — cyber-attacks, sabotage, pressure directed at the systems a country depends on — that does real damage without ever crossing into open conflict.
The UK Government’s announcement puts the commitment plainly: the UK and Germany are committing to a counter-hybrid threat partnership to tackle hostile activity threatening security and prosperity, one that will degrade hostile actors’ capacity to operate in Europe and build resilience against cyber-attacks, sabotage and threats to critical infrastructure. That is a two-way design. Half of it is about the adversary — making it harder for hostile actors to work in Europe at all — and half is about home, hardening the systems so that whatever gets through anyway matters less.
The joint statement issued after the meeting spells out the defensive half in detail. Both countries commit to building democratic and societal resilience, to better protecting critical national infrastructure, and to improving their ability to monitor, mitigate and counter hybrid threats. The phrase “democratic and societal resilience” is doing deliberate work there: it frames the threat as something a whole society has to be hardened against, not a problem left to the ministries and agencies that normally own security.
The object of all of it is critical infrastructure — the systems a country runs on, the ones that have to keep working for everything else to keep working. That layer is where hybrid pressure is aimed because it is where pressure is cheapest to apply and hardest to pin down: an adversary gets scale and deniability in the same move, and the target country is left defending points of failure that were never designed with a hostile state in mind.
Two features of the announcement are worth noticing. The first is the verb. Much of the surrounding language is defensive — resilience, protection, monitoring — but “degrade hostile actors’ capacity to operate in Europe” is a commitment to act against the adversary, not merely to absorb what the adversary does. The second is the naming. The UK Government’s announcement keeps its adversary abstract — hostile activity, hostile actors — while the reporting on the Berlin meeting names Russia outright. A communiqué that states the principle without attaching the accusation is a familiar piece of statecraft, and here both registers sit inside the same announcement.
What the partnership does not yet have is machinery. Nothing in either account specifies the mechanisms, timelines, or what “monitor, mitigate and counter” looks like as an operational matter — the commitments are to ends, with the means still to be filled in, which is how launches of this kind usually run. But the direction is unusually specific for an opening statement: two governments agreeing, in writing, that the threat to their infrastructure is hybrid, ongoing, and worth a standing partnership rather than an exchange of concerns. Whether “degrade” and “counter” become shared capability or remain shared vocabulary is the part that gets tested next.