Europe is building resilience – but not the kind it needs for war

A resilience paradox

Over the past decade, “resilience” has become one of the most prominent concepts in European security policy. It has shaped how the European Union approaches critical infrastructure, cyber threats and supply chains, how societal resilience has moved to the centre of political debate and how NATO integrates civilian preparedness into collective defence.

Few concepts have travelled so quickly across institutions, sectors and policy domains. Fewer still have attracted such broad consensus. Today, no one disputes that robust resilience is central in efforts to build a sovereign, powerful and competitive Europe, capable of defending itself and protecting its citizens.

And yet, despite this apparent success in shaping strategic agendas, a fundamental problem remains: Europe is building resilience in systems that were designed for “good weather”, not for sustained confrontation.

In other words, efforts are predominantly geared towards optimising the efficiency of existing solutions, rather than stepping back to ask whether the model itself needs to change too – to meet the new, substantially different, requirements.

Bluntly put: Europe has built a resilience agenda for peacetime disruption, not for wartime survival.

The experience of the war in Ukraine makes this unmistakably clear. Modern warfare targets civilian infrastructure, societies and institutions as deliberately as military forces and assets. In some cases, like in the current phase of Russia’s low-intensity warfare against Europe, the goal is to systematically undermine public trust in institutions and degrade the civilian systems that enable defence and sustain societies – energy, telecommunications, finance, transport and industrial production.

In this environment, resilience is no longer merely about absorbing shocks and recovering from disruption. It is about continuity under pressure – the ability to operate, decide and sustain effort in the midst of sustained attacks.

This is where Europe faces a growing gap between strategic ambition and operational preparedness.

From crisis management to sustained confrontation

European resilience thinking emerged in a strategic context that, after the turn of the century, was markedly different from today’s. It was shaped by terrorism and internal security threats, financial crises and economic instability, cyber incidents and hybrid interference and attacks, and, more recently, pandemic disruption.

These experiences reinforced a particular model that defines resilience as shock absorption and recovery. Even after 2014, when Russia’s annexation of Crimea prompted NATO to introduce baseline resilience requirements, the underlying assumption remained that future crises would be time-bound, geographically contained and manageable within existing governance frameworks.

Russia’s full-scale invasion of Ukraine in 2022 shattered these assumptions. We are well into the fifth year of Russia’s all-out war, and the conflict has demonstrated that Europe is entering an era not of episodic crises, but of persistent, multi-domain confrontation. The challenge is compounded by growing concern over strategic dependencies, economic coercion and the weaponisation of interdependence -developments that increasingly blur the boundary between economic security and collective defence.

Disruption is no longer exceptional – it is becoming the norm. Pressure is not sequential – it is simultaneous and relentless.

This shift has profound implications. It means that resilience can no longer be treated as a good-to-have, supporting policy. It must become a core organising principle of how European societies function under persistent duress.

The fragmentation problem: a system without a spine

Europe’s resilience landscape is evolving fast. Over the past years, the EU has introduced major regulatory and policy instruments. Among them are – to name but a few – the Critical Entities Resilience Directive (CER) drawn up to help protect infrastructure and societal services, the NIS2 Directive on cybersecurity and digital networks, the Digital Operational Resilience Act (DORA) with a focus on IT risk management in the financial sector, and various initiatives under the European Defence Industrial Strategy (EDIS), which are all aimed at bolstering EU defence readiness, competitiveness and security.

At the same time, NATO has strengthened its resilience baseline requirements and increasingly links civilian preparedness to military planning – a requirement that is rooted in Article III of the Washington Treaty.

member states too have developed their own national resilience strategies, which address a large array of threats ranging from supply chain disruptions and cyber attacks to climate change. Besides common concerns, they often reflect country-specific threat perceptions and infrastructure dependencies.

On paper, this looks fairly comprehensive, especially as these programmes and instruments will also continue to evolve. In practice, however, a major structural weakness is revealed, namely the absence of an integrated planning spine that could connect these important, but distinct efforts and ensure greater coherence among them. The current, fragmented approach inevitably weakens their efficiency and results in uneven preparedness across Europe.

The present distribution of responsibilities among the various actors shows a pattern like this: NATO defines the baseline requirements for collective defence and resilience; the European Union regulates markets and mobilises funding; member states carry primary responsibility for investment decisions; while industry delivers capacity and innovation. On the defence capabilities side, responsibilities and processes are largely clear, which is not the case for civilian resilience where the picture is a lot more blurry. There, we see a highly compartmentalised approach where coordination between the different strands of work is far from ideal. In other words, the problem is not insufficient attention or action but misalignment.

The missing layer: from principles to capabilities

The problem is also reflected in how resources under NATO’s 5% defence spending pledge are being allocated. There is a relatively high degree of understanding on how the 3.5% should be spent on core defence and there is a well-tested mechanism, the NATO Defence Planning Process, that translates agreed threat assessment-driven political guidance into capability targets, which guides national implementation and periodic peer review. There is nothing comparable on the civilian resilience side. Put simply: no one truly ‘owns’ the remaining 1.5%, despite its importance for ensuring coherence across civilian preparedness efforts. Moving one level up, we see that defence and resilience efforts are not sufficiently synchronised either, despite broad agreement that they represent two sides of the same coin, and neither can be truly efficient without close interplay between them – mirroring the way the attacker thinks and uses its wide toolbox.

Applying the NDPP logic to civilian resilience would ensure that resources follow clearly defined operational requirements rather than abstract spending benchmarks or national priorities that often have little to do with shared defence and resilience outcomes. Without such a framework, Europe risks continuing to expand resilience policy faster than resilience capability. A large number of national programmes labelled as resilience-related are often developed without a shared assessment of their contribution to collective defence and operational continuity.

To overcome current inefficiencies, the way forward therefore would be to agree to a single, coherent, demand-driven Civil–Military Resilience Planning Framework modelled on NATO’s Defence Planning Process (NDPP). In essence, the framework would align NATO, the EU, member states, and industry around a single capability-based (and not spending-based) planning spine – while respecting and preserving institutional mandates and national sovereignty.

Such a mechanism could ensure greater coherence throughout the entire chain of action, from the collectively agreed identification of strategic risks and associated capability requirements to the establishment of targets implemented through coordinated national action, kept under review and leading to measurable preparedness. All actors would benefit from this solution. It would mean more coherent prioritisation and reduced duplication for member states – a bigger bang for their euro. NATO would acquire improved visibility on civilian enablers of defence, including limiting factors, such as defence industrial capacity or supply chain issues. The EU could ensure that its regulatory and financial tools are more fully aligned with strategic requirements. Industry, on its part, would get clearer and especially more predictable demand signals, which is crucial for its investment decisions and would help coordinated engagement.

Known political impediments and sovereignty concerns will not likely disappear – but with a bit more flexibility in enabling informal decision-shaping processes and under the pressure of delivering efficient solutions, they can probably be overcome. There are several examples where partial results could be achieved – an example may be the EU-NATO parallel and coordinated exercises, with all its imperfect solutions.

Why more policy does not equal more preparedness

Europe’s response to emerging threats has been to add new instruments, strengthen coordination and increase funding.

This has produced progress – but also, in relative terms, diminishing returns. Three structural issues persist.

• First, demand signals remain fragmented. Industry receives multiple, often inconsistent signals from different member states and sectors. This complicates investment decisions, slows capacity development and weakens cross-border collaboration.
• Second, prioritisation is weak. Without a shared framework linking risk to requirements, it is difficult to determine which investments matter most under stress conditions.
• Third, preparedness is difficult to measure. Europe lacks a systematic way to assess whether civilian systems can actually support sustained defence operations in crisis scenarios.
• These are not technical problems. They are planning problems. And they point to a deeper issue: Europe is trying to fund resilience before it has fully defined what resilience must deliver under conditions of war.

Ukraine: resilience under real conditions

Several European countries have vast, decades-long experiences in total defence and whole-of-society approaches, like Finland and Sweden, which are the structural mechanisms used to achieve enhanced resilience. However, Ukraine, without a doubt, is the most relevant contemporary case study of resilience under sustained attack.

What makes Ukraine’s experience particularly valuable is not only the scale of the challenge it faces every single day, but the conditions under which its resilience is being tested. The spectrum is very wide: continuous missile and drone strikes on infrastructure; cyber operations targeting state and private systems; disruption of logistics and supply chains; economic and financial pressure; and the need to sustain large-scale military operations simultaneously.

Under these conditions, resilience has not merely been a well-considered policy framework or long-term strategy. It has been a function of survival.

Several lessons emerge that we should learn from:

• Resilience is systemic
  Energy, communications, finance and governance are interdependent. Failure in one domain cascades rapidly into others.
• Redundancy is essential
  Backup systems – whether in energy generation, communications networks or logistics – have been critical to maintaining functionality.
• Decentralisation increases robustness
  Local initiative and distributed decision-making have enabled faster responses and adaptation.
• Improvisation complements planning
  No system can anticipate all contingencies. The ability to adapt in real time is equally as important as pre-existing plans.
• Speed is decisive
  Decision-making under pressure has prioritised timeliness over procedural completeness or design perfection.

Are Europe’s institutions really learning from Ukraine?

Both NATO and the EU have sought to incorporate lessons from Ukraine into their planning and policies, and have achieved considerable progress in doing that. More specifically, NATO has reinforced its focus on high-intensity warfare, placed renewed emphasis on logistics and sustainment, and strengthened the link between resilience and operational planning. The EU has massively expanded efforts to boost defence industrial production, strengthened its regulatory frameworks for critical infrastructure and cybersecurity, and increased focus on economic security and supply chain resilience.

At the same time adaptation remains uneven. The core difficulty is not that Europe fails to identify the lessons from Ukraine, but that many of those lessons sit uncomfortably with the way European systems are designed to function. Absorbing these lessons into systems that were not designed to accommodate them is apparently a challenge. Several constraints explain this.

• Institutional inertia: large organisations tend to adapt incrementally, even when confronted with disruptive change.
• Civil-military separation: despite increasing cooperation, planning processes remain largely distinct.
• Regulatory rigidity: legal frameworks governing markets, procurement and state aid limit flexibility under crisis conditions.
• Political risk aversion: preparedness requires accepting costs and trade-offs that are difficult to justify in peacetime.
• Lack of urgency outside frontline states: without immediate threat perception, transformative change is harder to sustain.

What all this boils down to is that even though these factors create a situation where learning is acknowledged as an absolute necessity, lessons are still only partially operationalised.

Conclusion: from resilience to readiness

Europe has made significant progress in recognising vulnerability and building resilience. But the strategic environment demands a further step.

The next major crisis is unlikely to be a contained event. It will be a prolonged test of Europe’s ability to function under sustained pressure.

In that context, resilience will not be measured by recovery time alone. It will be measured by continuity of governance, stability of essential services and the ability to sustain defence efforts over time.

Ukraine has demonstrated what this requires in practice. The challenge for Europe is not simply to learn from that experience, but to reorganise its systems around it. Because ultimately, the question is no longer whether Europe is investing enough in resilience, but whether it is investing in resilience for the conflicts it may actually face.

The views expressed in this #CriticalThinking article reflect those of the author(s) and not of Friends of Europe.