Why gray-zone aggression is rapidly rising on the corporate risk agenda

Today, we're diving into a topic that's shaping global security and challenging corporates in ways that aren't always visible at first, known as gray-zone aggression. If you're new to the term, gray-zone aggression refers to actions that sit somewhere between peace and open warfare. There think cyber attacks, economic pressure, disinformation campaigns, covert operations.

The tricky part is that these actions often create real world consequences without triggering the traditional responses we associate with war. I am delighted to be joined by two experts in this field, who I worked with on our recently published gray-zone aggression report, Elisabeth Braw, a senior fellow at the Atlantic Council, where she focuses on the intersection between geopolitics and the globalized economy with a special focus on hybrid and gray-zone aggression. And Sam Wilkin, WTW director of political risk analytics.

Thank you both for joining us as we unpack what gray-zone aggression looks like in practice, and examine how these tactics show up in the context of recent conflicts and broader global power shifts. So let's dive in and start from the top.

Elisabeth, for listeners who may not use this language day to day, how do you define gray-zone aggression? And what distinguishes it from traditional conflict or espionage?

ELISABETH BRAW: Well, first of all, Jen, it's a pleasure to be on the podcast with you. And as you say, gray-zone aggression is incredibly topical because it's growing very quickly. And the way I defined it is hostile activities linked to a state that aim to weaken another state. And so it can be whatever that hostile state thinks up. And I think it's important to understand that the activities don't need to be undertaken by that hostile state itself. They can be undertaken by proxies, individuals, groups, and so forth who have been recruited by that hostile state.

And it's incredibly advantageous if you, as a country, as a government, want to weaken another country, it's incredibly advantageous to use gray-zone aggression because it is incredibly damaging to the country you're targeting. You can target companies, individuals, the population and as you noted in the intro, because it falls below the threshold of arbitrary violence, the targeted country really doesn't have a way of responding.

And if it were to respond with military means, then it would be incredibly dangerous and also disproportionate. But how else should you respond? Well, that is the open question. And I'll wrap up my answer here, because Sam, I'm sure, will have additional points to make.

But the reason it matters so much is that geopolitical tension or tension in the world is increasing. And for states that wish to harm other states, or countries that wish to harm other countries, it's cheap and effective to use gray-zone aggression. And you achieve the goal of weakening the country you are targeting without exposing yourself to much risk of retaliation.

And on top of that, we should remember that in the past, when countries weaken other countries, it was by taking their territory. Today, countries don't need more territory. They can weaken other countries by means other than taking territory. In fact, taking territory, it's mostly a headache because we are not agrarian societies anymore.

So let Sam come in with any additional points. But I think the most important thing to remember is that gray-zone aggression is growing by the day with new forms of this aggression essentially being presented on an almost daily basis. And each time a gray-zone act is carried out, somebody in the targeted country, whether the country itself or a company, loses a lot of money.

JEN DAFFRON: Yeah, so it's clearly mattering now to both corporates and national resilience. And so shifting over to Sam a little bit to follow up with that. From your work on the political risk survey, where nobody was focusing on gray own risk five years ago, and now, as we can hear from Elisabeth, it is dominating the agenda and we are seeing it, where do companies most consistently misjudge their exposure to gray-zone risk? Is this an ownership escalation or maybe the assumption that someone else is monitoring it?

SAM WILKIN: So political survey has been going on for about a decade now, nearly a decade. And as you said, from about five or six years ago, we added in the gray-zone questions at the time, mainly to appease Elisabeth. She was doing a book on the topic, maybe just published the book on the topic. And it was really a concern for national security types like Elisabeth.

But the West had had some big gray-zone losses in Asia. And it was becoming a real issue for the Nordics, for Eastern Europe, Russian gray-zone attacks. And so the issue was there, but I really don't think it was on the corporate radar. And honestly, when we put the questions in the survey, I really didn't anticipate how big it would get.

And I think that's the fundamental challenge that companies face is that it's so novel. We live through about 30 years, happily, 30 years of relative peace and stability in the West. And if you are incredibly old, like me, and you can remember the Cold War, even during the Cold War, companies were almost never targets. I mean, not almost never, but very rarely targets. So this is a really novel type of risk issue.

We're into this moment now. We're not only through gray-zone attacks. We've seen this in the Middle East as well. In a different context, companies have become a primary target and businesses or commercial assets have become a primary target in conflict. And that is a new thing. And so companies just don't have mechanisms in place to deal with it. And when they put new mechanisms in place, these are all also new. And so they're not tested. And sometimes they work and sometimes they don't work and so it's a new challenge that we're struggling to come to grips with.

ELISABETH BRAW: And if I can just add to that, since Sam mentioned the Cold War, I think what's different is that the geopolitical confrontation today is taking place in the world that has spent three decades globalizing. So companies have operations in all kinds of countries in a way that they didn't during the Cold War. So even if the Soviets had wanted and the other Warsaw Pact countries, even if they had wanted to target Western companies, their opportunity to do so would have been limited because not that many companies were doing business.

Western companies were doing business behind the Iron Curtain, and the global connectivity facilitated by undersea cables and so forth obviously didn't exist either. So the opportunity wasn't there even if countries would have wanted to use it. And I think that also explains why companies are becoming targets today. They are just targets of convenience. It's not like the Russians or anyone else hates Western company A, B, or C. It's just they happen to be available and easy to target. So why not target them?

JEN DAFFRON: So it seems like you're both kind of saying the fact that corporates are the ones that are being targeted more so now is what's shifted this from a niche security topic to more of a board level risk. Is that what you would agree with that?

SAM WILKIN: Yeah. And specific to the board level issue, it's really the direct cause of that is honestly-- although it's not only Russia that engages in these kinds of activities, it's really all credit-- I guess it's not the right phrase-- all credit to Russia in this case because basically, the Ukraine conflict, from the beginning, the Crimea Seizure in 2014 put Russia and Europe into an adversarial position. And then really, from 2022, with the full scale Russian invasion, then you have this really intense adversarial relationship.

And Russia basically launches these gray-zone attacks whenever Europe does something that Russia does not like. You expel some diplomats, you get the gray-zone attacks. Give weapons to Ukraine, you get some gray-zone attacks. Seize some reserves, you get some gray-zone attacks. There is a great chart in the WTW crisis management annual for this year, showing how the gray-zone attacks surged after peace talks where Putin didn't like, in 2021 and 2025, Putin didn't like the outcome and there was a big surge.

Maybe Elisabeth, help me here. But, I mean, it's just the breadth of attacks in Europe has been astonishing. We've got undersea cables cut, we've got sabotage, arson of critical infrastructure, plot to assassinate a CEO, alleged plot to assassinate a CEO in the defense industry. I'm only starting. There are definitely more if you can--

ELISABETH BRAW: Yes, you're only starting. And I think one particularly worrisome trend is Russia's recruitment of citizens, ordinary citizens in our countries to carry out these attacks. And that has been going on for a couple of years now. Many people refer to it as gig agents. And they are recruited on messaging apps like Telegram. They carry out one attack or several, take a photo just like any other gig worker. Then they get paid.

And what's really frightening about that is that it's incredibly hard for Western law enforcement agencies to find these people because they literally only do one or two jobs, and they go back into, or fade back into just being ordinary citizens or perhaps low level criminals. But it's not like the terrorists that we saw in the early 2000 radicalization, where you spend months becoming radicalized, and then carried out an attack. No, you have very little interaction other than that recruitment agreement, chat, exchange of brief messages with the Russian official on something like Telegram.

But I think it's also important to remember that the leader in gray-zone activity and also gray-zone innovation is able to do this because it doesn't care about its reputation. So if you don't care about your reputation, it doesn't matter whether you've been found out, as have pulling the strings, being the instigator. And I think as geopolitical confrontation increases in the world and fewer countries are committed to the rules based international order, then they too may decide that this is a good way of harming their neighbors or other countries. And that deterioration of the global order then really exposes countries and companies and groups of people to this kind of aggression.

JEN DAFFRON: Yeah, I think, if we think about it, traditional defense alliances like NATO are designed to respond to kinetic attacks, not ambiguous threats. And there's no kind of clear playbook for countries, let alone corporates, to respond to

gray-zone aggression. So we've got this mismatch where we have real world impacts that are tangible. But the event itself doesn't really seem to fit into the boxes that we're used to. That's what I was getting from what you were saying, Sam, that it's very new.

And I think that's kind of where structured tools matter. And that's where things like our recent gray-zone report come in because we want to provide corporates, countries, whoever is listening really with tools to respond to gray-zone aggression. It's a slippery topic and it's not something we can always identify within companies or even kind of imagine ourselves. And I think one of the strongest tools that we have when trying to understand things that we can't really put our fingers on are scenarios.

From a psychology perspective, they work with our natural tendencies to think in stories and simulations, not probabilities and concepts like return periods. And exponential growth scenarios put you in the hot seat, and they question whether your organization can adapt to, capitalize on events, or just stress test how you want to respond. And that's what we tried to do with this report, right, Elisabeth? We tried to bring that to life with gray-zone aggression.

So without giving too much away, thinking about the scenarios that you developed for the report, what does a scenario pathway reveal about how gray-zone aggression unfolds. Because I think that's something that everyone's kind of struggling with a little bit. So how does it unfold, why is it important that we the difference between a regular organized crime, a regular cybercriminal, versus what's happening with gray-zone aggression.

ELISABETH BRAW: Yes, it's a very good question, because sometimes, actually quite often, it's very hard to tell the difference between a criminal act and the beginning of some kind of gray-zone aggression, because it often includes criminal activity. It's just in a significant concentration. So for example, we have seen, for many years now, cyber attacks, cyber intrusion targeted at companies. And for a number of years, companies used to view it as just criminal activity.

And then when NotPetya happened, I think that's when many companies realized that they could be subjected to state sponsored cyber attacks. But when they're state sponsored, it's just a larger concentration. They're more sophisticated but you should wargame those kinds of situations so that you know, whether it's cyber or anything else, what to do if it turns out to be something more than criminal activity.

So, for example, in another area, if there were to be some sort of disruption in shipping, that is something we have in the report. And it has turned out to be extremely timely because there has been some disruption in shipping. And so regardless of where that disruption takes place, it usually starts with something that looks like one ship has stalled or can't get through and then you have to decide, as a company that may be affected, does this look like it's an accident or maybe an incident involving just one ship, or is it something that looks like it could escalate into something more, and then what are you going to do.

And it could appear anywhere. So whether it be the Strait of Hormuz or any other busy waterway, or indeed any other logistical node, it could appear anywhere and if you're not prepared, then you will suffer significant financial harm. And you may even find that some of your employees are in harm's way and that would obviously be extremely undesirable. So again, it comes back to thinking about what looks like-- it could be just an ordinary or low level incident-- how you're going to respond if it turns out to be something more than that, or if it grows from there.

JEN DAFFRON: OK, thank you so much, Elisabeth. The report itself lays out five key actions. We have elevate gray-zone risk, stress test supply chains, strengthen crisis management, integrate scenarios, and re-evaluate insurance wordings, triggers, limits. This question goes to both of you. If listeners only remember one or these five actions, which do you think matters most and why? And let's start with you, Sam.

SAM WILKIN: OK, I'll take insurance for 400 euros million, please. And the reason I picked that specific number is that's a reference to a gray-zone related claim that ended up in a big dispute. The difficulty is, if I may speak philosophically for a moment, insurance is a legal contract and it's just it's like oil and water when you have a gray-zone zone attack.

As Elisabeth mentioned, the idea is to be as obscure and misleading as possible to avoid normal deterrence and retaliation and so the actors and motives in gray-zone attacks are typically intentionally hard to pin down. And so that really causes trouble for insurance, because you'd like to have everything ideally laid out relatively neatly ahead of time.

We had a particular case where some of my colleagues received a claim dealing with policies in Ukraine that another carrier, another broker had put in place. And when the event happened, all the relevant policies in the Marine cargo and property and political risk, they all had different wordings. The result was what my colleague described as a dog's breakfast and I actually don't know quite specifically what that means, but it just sounds unappealing and unappetizing. So I think it's something you wish to avoid.

And that is absolutely crucial when you're dealing with issues in the gray-zone is you really want to have your ducks in a row. You really need to have things lined up in very tight because it's inherently going to be a challenge. It's really something that can really disrupt a risk program.

So in the end, I do think the report that you and Elisabeth have done is extremely useful for this specific issue because what you can do as a risk manager, for instance, or an insurance buyer is to go through one of the scenarios-- I think you laid out three scenarios in the report, if I recall correctly. And you can go through those scenarios and work through how they would impact you, how they would impact the specific policies that you have in place-- and they often overlap into a bunch of different areas, which adds more of a challenge-- and what would respond, what would not respond, and work out if you need to take action to tighten things up ahead of you, ideally, ahead of you potentially being the target yourself.

JEN DAFFRON: Thanks, Sam. That was really insightful. And I just want to make sure we have enough time to pass to Elisabeth. What would you say would be the number one thing that matters most to people listening for Gray-zone aggression.

ELISABETH BRAW: I would say consider yourself a geopolitical actor, even if you consider your company to be totally vanilla and your company doesn't take any political positions. Any company can become a target and based on that, use scenarios available to you, whether within your own company or the scenarios in this report, to build your own scenarios and the scenarios in the report can serve as a source of inspiration.

But the point is, using scenarios to plan forces you to think creatively and think really like the other side. And that's something that is not typically the case when you read a report about gray-zone aggression. You get the facts stated. But if you start working with scenarios, then you start thinking along the lines of what could the other side think up and that is really the key. You have to get to think the other side because Russia, which, again, is the prime innovator in gray-zone aggression and is already gaining followers among nation states.

Russia is very creative. So if you are not as creative as them, you will expose your company to harm. You obviously can't climb into the head of Vladimir Putin, but at least you can try. And if you try, if you work with scenarios, then you'll be better set up than if you just plan for what you have already seen happen elsewhere.

JEN DAFFRON: Yeah, I completely agree and I think, in writing these scenarios, it's even made my imagination grow when thinking about what happens with gray-zone aggression. I think the fact that these aggressors act with such plausible deniability and often impunity, they get away with so much and so it's how can corporates be protecting themselves and moving forward in a very unknown environment and that's the best way to try to just work through that environment.

And almost like you said earlier, war game, and try to think through what your different reactions could be in the different types of futures that lay ahead. And with those futures to keep us thinking for the rest of the day, or hopefully a little bit longer than that. And finally, a quick answer question to keep us thinking. What is one gray-zone tactic you both think we'll see more of in 2026? Sam, do you want to go first?

SAM WILKIN: Yeah, I do. So each year in the political survey, we ask what people are concerned about. And surveys in the field right now which has, as we're recording this, the conflict in the Middle East is fully ongoing. So this is very interesting to watch the results come in as this is happening.

Currently, the top gray-zone issue, beating out cyber-- cyber started being the number one. And it's changed over time. Now the number one is attacks on infrastructure, cutting undersea cables, destroying pipelines, disrupting power stations, arson and warehouses, and so on and so forth. And cutting undersea cable is going to be my nomination. I know Elisabeth's got a book on the topic coming, but because it's something that you should be thinking about regardless of where you are in the world.

I don't think it's quite at the board level in the U.S. yet, but it certainly is in Europe. It should be in Asia. This is something that is a big concern in Asia. It is a big concern in Europe just because it strikes at the heart of how digitally connected we all are and we've seen it be a concern now in the Middle East. A lot of the connections between Europe and Asia run through the Middle East. And on the current environment, if there were undersea cables being cut because the Marine environment is disrupted, it'd be very hard to repair. So this is the thing that I think companies need to think about in 2026 and hope it doesn't actually happen.

ELISABETH BRAW: Since Sam has already taken the cables as it were-- although I agree with you, Sam. It is a growing concern and it doesn't just affect companies in the countries that are connected by a cable that is damaged under suspicious circumstances. Obviously, the nature of digital connectivity is that it connects the whole world. And I would flag up one sector in particular that I think he has underestimated its exposure to losses caused by damage to undersea cables if they were to be subjected to gray-zone attacks.

And that is the financial services sector because other companies use cables to communicate and to operate equipment and so forth. But as we know, the financial services sector, their business is sending money and they send that money through those cables. So I'm endorsing your point, Sam. And if I would highlight another area that I think will become a growing concern and risk within the next 12 months, it is the use of gig agents.

And we have seen Western intelligence services warn that, or flag up the fact that Russia has given the Wagner Group, the now resurrected Wagner Group, the task of running the recruitment of gig agents in our countries, in Western countries, and also essentially being their handlers. So that is a sign that Russia is planning to make more systematic use of gig agents. And that should be a massive source of concerns for every Western country and companies in those countries. And by the way, not just Western countries, any country that Russia may want to harm in some way.

JEN DAFFRON: Absolutely and what I'm getting from both of you is that it's essentially with gray-zone aggression for 2026. It's questioning what can be targeted, who's going to be doing the targeting, how they're going to be fulfilling the targeting. And gray-zone operations deliberately exploit this ambiguity, making it difficult for governments or institutions to attribute actions or, more importantly, respond decisively and I think that's the thing that hurts the most in this is in these situations, you do need to be acting decisively to protect your corporation moving forward.

And if listeners want a practical way to pressure test their own organization against these tactics, the ones we just talked about today, or even other ones that your imagination may bring about, our report is designed to do exactly just that. It gives you structured scenarios and challenge questions to test readiness. Elisabeth and Sam, is there anything else you guys want to add to wrap up for today?

ELISABETH BRAW: I would add that the companies that can show that prospective customers and shareholders that they are prepared, they are the ones that will weather this storm the best.

SAM WILKIN: I just want to congratulate both of you on an excellent report.

JEN DAFFRON: Thank you very, very much. And thank you, Elisabeth and Sam, for joining me today. It's been a real pleasure talking to you about this. And thank you to all of you for listening to this Geopolcast. To get the episodes as soon as they're released, please make sure that you subscribe to Geopolcast. You can find us at your usual podcast players and please recommend us to your friends and colleagues. Thank you all so much and join us next time for our next episode of podcast.

ANNOUNCER: Thank you for joining us for this WTW podcast featuring the latest perspectives on the intersection of people, capital, and risk. For more information, visit the Insights section of wtwco.com.

Willis Towers Watson offers insurance related services through its appropriately licensed and authorized companies in each country in which Willis Towers Watson operates. For further authorization and regulatory details about our Willis Towers Watson legal entities operating in your country, please refer to our Willis Towers Watson website. It is a regulatory requirement for us to consider our local licensing requirements.

The information given in this podcast is believed to be accurate at the date of publication. This information may have subsequently changed or have been superseded, and should not be relied upon to be accurate or suitable after this date. This podcast offers a general overview of its subject matter. It does not necessarily address every aspect of its subject or every product available in the market, and we disclaimer all liability to the fullest extent permitted by law.

It is not intended to be, and should not be used to replace specific advice relating to individual situations. And we do not offer and this should not be seen as legal, accounting, or tax advice. If you intend to take any action or make any decision on the basis of the content of this podcast, you should first seek specific advice from an appropriate professional.

Some of the information in this podcast may be compiled from third party sources we consider to be reliable. However, we do not guarantee and are not responsible for the accuracy of such. The views expressed are not necessarily those of Willis Towers Watson. Copyright WTW 2026. All rights reserved.