Governments increasingly face incidents that fall between accident and deliberate malicious activity as hostile actors combine a range of measures to pressure democratic societies below the threshold of open conflict, particularly in the Baltic Sea region and across Europe. How can governments prepare and respond under conditions of persistent uncertainty, when attribution is contested and operational secrecy constrains what can be communicated?