It may be Allies believing different machines. That is the problem I explore in my new report: NATO’s AI Dilemma: Innovation Without Integration Most debates on military AI still sound like a race: faster analysis, faster targeting, faster command, faster adaptation. But NATO is not a single state. It is an alliance.
This changes the AI question.
Imagine a fast-moving crisis in the Baltic Sea. An undersea cable is damaged. Maritime sensors detect unusual movement. Satellites, drones, cyber feeds, electronic signals, and open-source data all begin producing information at speed.
One Ally’s AI-supported system reads the pattern as coordinated hostile activity. Another Ally’s model treats the same signals as ambiguous. A third Ally waits for manual confirmation.
🧠 In that moment, the problem is not only whether NATO has AI. The problem is whether NATO can still form a common judgment. This is where I think the usual “AI race” language becomes misleading. Speed matters, of course. NATO cannot afford technological hesitation. But speed without shared interpretation can create a new kind of vulnerability inside the Alliance. Not a capability gap alone. A judgment gap.
The report argues that NATO’s AI challenge should be understood through four connected gaps: Data quality Model trust Infrastructure dependency Decision tempo
The hardest issue is not whether every Ally can build frontier AI systems. They cannot, and they do not need to. The real test is whether different Allies, with different capabilities, can still use, question, audit, trust, and govern AI-enabled systems together under pressure.
That is why I argue for an AI-readiness ladder, modular and federated AI capabilities, stronger testing and evaluation, and much deeper AI literacy among commanders, diplomats, and political decision-makers.
My concern is simple 📢 : NATO may solve the AI adoption problem while underestimating the AI synchronization problem. Am I overstating this risk, or is Alliance-wide judgment becoming as important as Alliance-wide capability? The report is attached. I would welcome serious criticism, especially from those working on AI, cyber, defense innovation, interoperability, and strategic studies. #NATO #ArtificialIntelligence #CyberSecurity #DefenseInnovation #StrategicStudies
The moment you walk into a crisis meeting, the PowerPoint deck is already open, and the senior vice‑president of “Something Important” is asking, “Are we breached or not?” You could respond with a screenshot of the MITRE ATT@CK matrix— all 2,000‑plus coloured squares that make analysts purr and executives panic. Or you could open with UNIDIR’s new ICT Intrusion Path, a simple map that borrows more from airport signage than threat‑intelligence spreadsheets. The model doesn’t start by listing every exotic exploit or parsing the exact second a malicious DLL is sideloaded. Instead, it asks the oldest, most intuitive security question in the world:
Where is the adversary standing right now—outside our walls, pushing on the gates, or wandering our hallways?
The location-first view accomplishes two immediate objectives. Firstly, it establishes a clear and comprehensible framework for the discussion, defining the concepts of “outside,” “on,” and “inside.” Secondly, it facilitates the seamless integration of new technologies, such as cloud computing, zero-trust architectures, and emerging technologies like artificial intelligence, without necessitating a rewrite of the fundamental metaphor. In essence, the ICT Intrusion Path provides a concise and visually appealing three-color map that effectively conveys the concepts to even the most skeptical executives, ensuring their comprehension before the completion of the second slide.
The Three Zones in Plain Language
Zone
What it looks like
Everyday examples
Outside the Perimeter
Everything on the open internet that touches your brand but not your network.
Chart 1 above shows a quick attacker‑versus‑defender AI scorecard.
Each zone has its own legal rules, budget owners, and reputational landmines— one more reason pinning the attacker’s location first is so disarmingly effective.
How Artificial Intelligence Warps Every Zone
AI doesn’t wait politely at the door—it amplifies whatever zone it touches. Outside the perimeter, large‑language models automate reconnaissance, scrape breach forums in seconds, and pump out polymorphic malware that mutates faster than signature scanners learn its name. On the perimeter, the same generative engines craft deep‑fake voicemail scams and translate fresh exploits into your exact cloud‑edge stack on demand, while defenders lean on behavioural authentication and anomaly scoring to swat away the most convincing impostors. Inside the perimeter, the future threat is autonomous agents that pivot laterally at machine speed, balanced—one hopes—by self‑healing networks that isolate and patch without a 3 a.m. bridge call. AI, in short, accelerates both offence and defence; the ICT Intrusion Path simply points to the lane in which the arms race is unfolding.
Why Executives Love (and Sometimes Loathe) the Path
The model’s appeal is evident: three distinct zones can be conveniently displayed on a single slide, enabling even non-technical directors to monitor the conversation from risk assessment to budgetary considerations. For each potential negative outcome, the accompanying briefs provide at least one countermeasure, transforming the process of doomscrolling into a strategic game akin to chess. The AI spotlight forces a concrete discussion about how generative tools change every defensive playbook, and UNIDIR’s helpful footnotes crosswalk each zone to the familiar ATT@CK tactics and Kill‑Chain stages , ensuring analysts never lose their bearings when the meeting ends and the real work begins.
Yet simplicity is a double‑edged sword. Those same three buckets are far too coarse‑grained to write an EDR rule or a SIGMA signature; kernel‑level implants, operational‑technology quirks, and container break‑outs all collapse into a single “inside” blob. Hybrid and multi‑cloud architectures blur the neat perimeter metaphor, and the authors admit the document will have to evolve as zero‑trust mesh and AI‑native networks spread. In other words, the ICT Intrusion Path is an elegant framing device, not a replacement for the deeper playbooks it points toward.
From Map to Motion—Putting the Path to Work
Treat UNIDIR’s diagram as the brightly coloured concourse map at an international airport. It orients every traveller—legal, PR, operations, board—within seconds, and it exposes the chokepoints where AI may tip the odds in or against your favour. Once everyone knows which terminal they occupy (outside, on, or inside), hand the pilots and ground crew their detailed charts: ATT@CK for pinpoint‑level telemetry, the Kill Chain for timeline storytelling, and any cloud‑specific frameworks your environment demands ( CISA Cloud SaaS Security Guidance ). The ICT Intrusion Path does not guarantee complete coverage of all gates, but it ensures that every stakeholder commences the journey on an identical footing—a valuable advantage when an alarm genuinely occurs at 2 a.m. Do you think UNIDIR’s methodology helps politicians and C-level managers? Do we still need a middle person to explain technology in layperson’s vocabulary? Which methodology do you prefer, UNIDIR, MITRE Att@ck, or Kill Chain?
In the aftermath of a significant natural disaster such as an earthquake, communication systems often face immediate challenges. This phenomenon has been observed in previous earthquakes in Turkey, including the ones that occurred on February 20, 2023, and April 23, 2025. Within minutes, mobile networks become overwhelmed as thousands, even millions, attempt to connect with their loved ones or seek assistance. This critical juncture underscores the paramount importance of communication in such situations. However, it also highlights the inherent limitations of GSM network designs.
Therefore, the pertinent question arises: can we construct GSM cellular systems capable of handling such sudden and overwhelming demand? If this is feasible, is it economically viable?
Technically, yes — but with some complexity.
A GSM network can be designed to respond to extreme spikes in demand. This can be done by adding more cell towers, reserving extra radio frequencies, installing backup power systems, and integrating technologies like mobile base stations on trucks, drones, or balloons. These systems can be deployed rapidly and scaled based on the needs of the disaster zone. On top of that, prioritizing traffic — for example, giving emergency responders access to the network first — can ensure that critical services remain operational.
There are also technical solutions that include dynamic load balancing and intelligent traffic management, allowing the network to redirect users to less crowded cells. The industry has also started experimenting with satellite-based mobile coverage and using AI to predict where capacity will be needed most. In short, from an engineering perspective, building a GSM system that can survive and respond to disaster demand is entirely possible.
Let the challenge begins.
The primary reason why GSM networks fail under pressure is not a lack of technical solutions, but rather the high cost associated with implementing those solutions. GSM base station capacity is determined by the number of carrier frequencies and time slots, with each carrier typically offering 8 time slots, of which 6–7 are used for voice communication. The effective user capacity is calculated using traffic engineering models like the Erlang B formula, which considers the number of available channels, the average call duration, and desired call blocking probability. For instance, a cell with 30 traffic channels and a 2% blocking rate may support around 22 Erlangs of traffic, translating to roughly 400–500 concurrent users under normal load. During disasters, this capacity is quickly exceeded due to simultaneous call attempts, infrastructure damage, and signaling overhead, leading to network saturation and communication breakdowns.
Networks are typically designed to accommodate average or anticipated peak demand, not the overwhelming surge that occurs during crises. To permanently construct infrastructure capable of handling such rare moments would entail substantial investments in underutilized infrastructure, including spectrum licenses, maintenance of underutilized towers, and the powering of backup systems. These costs are substantial and may not be justified unless there is a consistent and substantial use for the additional capacity.
In economic terms, overbuilding is challenging to justify unless there is a clear and consistent use for the extra capacity. Telecommunications companies operate in highly competitive markets where the return on investment is paramount. Therefore, unless regulatory authorities or governments intervene to provide subsidies for the enhanced resilience, it is unlikely that operators will bear the full cost of such investments on their own.
A hybrid model.
Rather than building massive capacity everywhere, the more sustainable approach is to use flexible and deployable infrastructure. Mobile base stations, shared emergency networks between operators, satellite backup, and temporary spectrum allocations are all examples of this hybrid model.
Furthermore, it is imperative that there be enhanced collaboration among telecommunication companies, government agencies, and emergency services. Disaster resilience in communications is not merely a technical issue; it also presents a governance challenge.
Indeed, we can construct resilient networks that endure disasters. However, rather than meticulously over-engineering every aspect initially, we should prioritize scalable, adaptable, and cost-effective models that can be promptly deployed when necessary. Disaster-proofing our communication systems is no longer a luxury; it has become a necessity.
The pertinent question remains: are we prepared to invest in preparedness prior to the next impending emergency?
