Answer first: Hostile states increasingly exploit open-source data and digital platforms to conduct intelligence gathering, influence operations, and low-level attacks targeting governments, critical infrastructure, and academic institutions. Jack Borthwick of Fivecast highlights how AI-enabled open-source intelligence (OSINT) tool…
Policy context for IP teams
Jack Borthwick, account director for Europe, the Middle East, and Africa at Fivecast, a provider of AI-enabled open-source intelligence solutions, outlines the expanding scope of modern grey-zone warfare. Beyond traditional cyber-attacks and espionage, hostile states now leverage social media, online forums, and publicly accessible information to gather intelligence, influence public opinion, and target organisations while operating below the threshold of armed conflict.
These actors exploit digital environments to map relationships, understand organisational structures, and support operational planning. Intelligence services increasingly use publicly available data, false personas, commercial datasets, and open information to identify recruitment opportunities, target opponents, and build networks of influence or division.
Key takeaways for AI-enabled open-source intelligence for hostile state threats
- Confirm how the development affects policy ownership, enforcement, licensing, or portfolio records.
- Separate confirmed facts from legal interpretation before advising business teams.
- Map deadlines, affected assets, contracts, and evidence files to the responsible internal owner.
- Use the issue as a prompt for monitoring, filing strategy, dispute preparation, or member education.
Practical analysis
This sophisticated activity has implications beyond government and defence sectors. Businesses, universities, local authorities, and operators of critical infrastructure—including telecommunications providers—remain vulnerable due to their strategic importance, operational dependencies, and public visibility.
Universities face unique challenges given their international collaborations, open research environments, and access to sensitive intellectual property. While disrupting infrastructure can cause immediate impact, infiltrating research environments may yield longer-term strategic advantages for hostile actors.
Amid rising geopolitical tensions, the UK and Europe have witnessed increasing instances of hostile states employing criminal proxies to conduct sabotage, arson, and other low-complexity attacks targeting political figures, critical infrastructure, and soft targets.
Despite these threats, organisations are not powerless. Early warning indicators exist within vast volumes of fragmented data, provided organisations are equipped to detect them effectively.
Artificial intelligence, when applied to open-source intelligence (OSINT) tradecraft, offers this critical capability. Integrated into OSINT workflows, AI enables organisations to identify their digital exposure, detect emerging threats, and monitor activities directed at their operations, critical infrastructure, or workforce.
By connecting disparate data at scale, advanced analytics reveal coordinated behaviours and surface signals that would otherwise remain hidden. This approach identifies suspicious patterns, detects indicators of hostile reconnaissance, and clarifies how cyber, physical, and information threats intersect.
Such early visibility empowers organisations to make faster, more informed decisions, mitigating risks before they escalate into disruption, espionage, or sabotage.
Strengthening collaboration among government entities, critical national infrastructure operators, academia, and the private sector is essential. Sharing intelligence and developing a common operating picture enhance collective resilience, improve risk management, and enable more effective responses to emerging threats.
By integrating data from multiple sources, OSINT facilitates a shift from passive awareness to proactive early threat detection, enabling organisations to act decisively.
Defence and deterrence are significantly more effective when organisations receive critical early warnings that reduce adversary opportunities before operational impacts occur.
Related IIPLA reading
Leveraging AI-Driven Open-Source Intelligence to Counter Hostile State Grey-Zone Threats Hostile states increasingly exploit open-source data and digital platforms to conduct intelligence gathering, influence operations, and low-level attacks targeting governments, critical infrastructure, and academic inst... Read the full IIPLA blog post: https://iipla.org/blog/leveraging-ai-driven-open-source-intelligence-to-counter-hostile-state-grey-zone-threats