NATO declared cyber a domain of warfare at Warsaw in 2016. Ten years on, the alliance has refreshed the pledge that followed, and an analysis published by the Journal of Law and Cyber Warfare in October 2026 lands on an uncomfortable reading of where things stand: formal commitments to cyber defense have moved faster than the legal and doctrinal machinery meant to govern them.
The journal drew on two Atlantic Council studies from earlier in the year, one from July on NATO’s cybersecurity posture by G. Alexander Crowther, a retired U.S. Army colonel, and one from March on AI in military operations by Dominika Kunertova.
What the updated pledge asks
The 2026 update to the Cyber Defense Pledge obliges members to run cybersecurity maturity assessments across every critical infrastructure sector, and it standardizes incident reporting with a twenty-four-hour notification window. Member states must also take part in joint cyber exercises and account openly for what they invest. Above the obligations sit three aims, from real-time sharing of threat intelligence to capability-building to a common standard and expanded cooperation with Asia-Pacific partners.
The institutional ambitions are real enough. The NATO Cyber Security Centre, working from Supreme Headquarters Allied Powers Europe in the Belgian city of Mons, guards the alliance’s own networks, and the plan set out at the 2024 Washington summit is to develop it into a NATO Integrated Cyber Defence Centre by 2028.
The catch under the surface
Crowther’s July assessment points to the structure beneath. NATO owns very few organic capabilities of its own; almost all cyber forces sit inside allied security services and reach the alliance only when a government agrees to provide them. The result is an alliance of two tiers, where collective promises rest on uneven national means, an asymmetry an adversary can work with.
The legal footing is no firmer. NATO runs no offensive cyber operations itself, yet it treats cyberattacks on allies as potentially amounting to an “armed attack” that could open the door to Article 5. When a cyberattack crosses that line remains legally unsettled, even though the new pledge adds procedural duties that presuppose an answer.
AI compresses the clock
Kunertova’s March report narrows in on algorithmic warfare, and her core finding is measured. Integrating AI into military systems does not create vulnerabilities that are new in kind. Once decision-support tools and autonomous platforms become central to alliance operations, though, interference with data, models and computing infrastructure can degrade how well NATO sees, decides and acts under pressure.
The openings available to an adversary run from espionage against model weights and poisoned training datasets to spoofed sensors on surveillance platforms, cut data relays and physical damage to cables, satellites, data centers or uncrewed hardware. Each raises its own questions of attribution, proportionality and lawful countermeasures. Alliance doctrine answers none of them systematically.
Attribution itself gets harder as systems grow more complex, because autonomy creates room for plausible deniability. Where blame stays ambiguous, the legal basis for a collective response under Article 5 wobbles with it.
Her report calls this an escalation-threshold problem, and it is specific. Would poisoning an adversary’s data count as an offensive cyber operation? Under what rules of engagement may an autonomous or semi-autonomous system respond? She also warns the alliance against moving the line between subthreshold manipulation and an armed attack in anticipation of an attacker’s deniability claims.
A manual built for human decision cycles
The Tallinn Manual, drafted at the alliance’s Cooperative Cyber Defence Centre of Excellence in Estonia, remains what the July report calls “the global standard for discussing the legal aspects of cyber operations during both peacetime and wartime”. It was never designed for algorithmic warfare. Its rules assume human decision cycles and tests of kinetic equivalence, assuming in turn a clarity of intent and of attribution that machine-speed operations can structurally deny.
Strip both reports down and one gap shows. The pledge sets reporting clocks and maturity checks. It does not say how the alliance should legally characterize the poisoning of an AI-enabled command system, nor who holds authority when compressed timelines leave the North Atlantic Council no time to convene. Without agreed response triggers and pre-delegated command authority, the analysis argues, faster timelines will produce decision paralysis rather than a response.
Both studies close on the same bottom line: procedural compliance with the updated pledge is necessary but insufficient, and the questions of attribution, proportionality and command authority need answers before an escalation spiral starts, not while one is running.
Sources
- NATO's Updated Cyber Defense Pledge and the Algorithmic Warfare Doctrine Gap · JLCW
- WSJ узнала о переосмыслении НАТО ударов вглубь России
