The Black Sea has emerged as one of Europe’s most volatile security frontiers following Russia’s full-scale invasion of Ukraine. This war has reshaped the region’s strategic landscape and compelled the European Union to reconsider its role in regional security. As Russia assumes an increasingly disruptive and hostile posture, the littoral states that remain committed to the EU path are seeking ways to protect their economic and security interests by strengthening their own deterrence capabilities and exploring the EU’s potential role as a security actor.

Given the limited economic, defence and ISR capacities of the individual littoral states - Bulgaria, Romania and Ukraine – the key question is how to coordinate their efforts to strengthen regional resilience. Equally important is defining the role of international actors, particularly the EU and NATO, in supporting these efforts. The prospect of a Russia-Ukraine ceasefire has further underscored the need for a coordinated approach to deter Russian hybrid threats effectively.

In May 2025, the EU launched a holistic Black Sea strategy that addresses security, connectivity, and economic prosperity. Central to the strategy are the EU Maritime Security Hub, strengthening defence cooperation, and fostering dual-use infrastructure in the region. The region matters to Europe for several reasons.

First, it hosts key infrastructure and transport routes, including gas pipelines, submarine electricity cables, grain export routes, and mining areas, and lies on major trade corridors connecting Asia to Europe through the Balkans and the Caucasus.

Second, Ukrainian and Russian grain exports underpin global food security, with direct effects on migration pressures towards Europe. And third, any further development of the region’s hydrocarbon reserves could reduce Europe’s dependence on Russian energy. Although its strategic relevance is primarily economic for the littoral states, instability in the Black Sea can send global shock waves, driving up energy prices, causing food crises, and disrupting trade.[67]

Russia understands this geography well. Its foothold on Ukraine’s southern coast provides leverage over global grain markets, access to warm-water ports for power projection into the Mediterranean and the Middle East, and direct influence over EU energy supplies. Increasing digitalisation of maritime operations has introduced new vulnerabilities: cyberattacks can disrupt navigation, port operations, critical infrastructure, and naval systems, creating economic and strategic weaknesses that can be exploited in hybrid or coercive campaigns. At the same time, the maritime domain provides opportunities for plausible deniability in physical hybrid operations, as the principle of freedom of the seas allows actors to operate covertly while complicating attribution and response. Moscow’s hybrid tactics, such as false-flag operations, cyberattacks, disinformation, and sabotage, allow it to exploit divisions among EU states and delay or fracture collective responses, even as its conventional military forces remain inferior to NATO’s. These realities ensure that the Black Sea will remain strategically vital long after today’s battles end.

Moscow behaves as a calculated, adaptive actor, moving up and down the spectrum of the hybrid-threat escalation ladder depending on how far the targeted state diverges from Russia’s strategic objectives, the resistance it expects to encounter, and the anticipated cost of a response. To meet this challenge, the report argues that a multifaceted approach is needed to strengthen the resilience of littoral states - the EU members and candidates - across the full range of hybrid threats below the threshold of armed conflict, with several priorities for Europe and the littoral states.

Tilting the balance of power

The most urgent priority concerns maintaining Ukraine’s maritime access, since its loss would threaten Kyiv’s economic stability and shift the regional balance of power by giving Russia direct access to more than one-third of the Black Sea and positioning Russian military assets closer to NATO territories. Ensuring lasting access requires a combination of explicit guarantees for Ukraine’s ports, sustained military and technological support, including drones and air-defence systems, and strengthened economic resilience through deeper EU integration and infrastructure investment. After a ceasefire, coordinated Black Sea monitoring and patrol missions, backed by credible deterrence and international security guarantees, will be essential to prevent renewed Russian aggression and protect the littoral states.

Addressing political and economic vulnerabilities in littoral states would decrease their exposure to external influence. Moldova’s strategic transit role and internal fragilities, Bulgaria’s energy profits dependence and evolving defence potential, and Georgia’s pivot toward Russia and China - all illustrate how domestic and external pressures can limit these states’ ability to contribute to regional security. Bulgaria’s growing defence industry and Moldova’s potential as a logistics hub highlight avenues for targeted EU investment and strategic support.

The EU-aligned states in the region – Bulgaria, Romania, Ukraine and Moldova - face multiple challenges, including vulnerabilities in critical infrastructure, limited situational awareness, and reliance on external intelligence networks, with Romania emerging as the most proactive NATO littoral state through expanded defence capabilities and efforts to “internationalise” Black Sea security. Türkiye’s strategic position and enforcement of the Montreux Convention are crucial, as its cooperation will determine the effectiveness of coordinated maritime monitoring, patrols, and a proposed EU Black Sea Maritime Security Hub. Strengthening North-South connectivity, coordinating actions across the Black Sea and Baltic corridors, and sharing navigation and intelligence data are essential steps to reinforce NATO’s eastern flank and safeguard commercial navigation in the Black Sea.

Stability in the Black Sea cannot rest on land-based measures alone. A permanent maritime security architecture is needed to monitor any ceasefire, safeguard commercial navigation, and counter hybrid threats. A new ceasefire monitoring framework that builds on emerging and existing initiatives, such as the EU Maritime Security Hub and the Mine Countermeasures Black Sea Task Group, and actively links these initiatives to the extent possible, would enhance the collective security of all littoral states. A dedicated monitoring mission, integrating aircraft, UAVs, and ships from third-party nations, could provide real-time intelligence to a joint coordination centre, enabling necessary coordination across this mosaic of political systems. Mine countermeasures vessels and naval drones, well suited for frequent route surveys and lacking offensive capability, would reduce escalation risks while keeping shipping lanes safe.

Recommendations for the European Union and the EU member states