Three recent sources suggest it has started to, but unevenly, and with major gaps still visible in frontline capacity, attribution practice, and coordination.
We are writing in a different moment than the one many of us remember from early 2022.
Back then, a lot of what is now discussed openly still sat in the margins. Many people could see manipulation, but not the machinery around it.
The public conversation was still catching up. Terms were unclear. Threat models were vague.
In many places, the instinct was still to treat propaganda as messaging, spin, or political ugliness, not as a sustained pressure system that could shape public understanding, intimidate civic actors, and interfere with democratic processes over time.
A lot of work went into changing that. Researchers, journalists, civil society groups, practitioners, and yes, ordinary citizens who kept paying attention pushed these topics into the open.
They tried to make the problem legible. They pushed for recognition. They pushed for state reaction. Not because anyone thought this could be solved with a slogan, but because denial and delay were already part of the damage.
That awareness work mattered and still matters. But awareness was always the beginning, not the destination.
What stands out in some of the more recent material is that the field is starting to describe the problem differently. Not everywhere and not consistently but often enough to notice. The shift is subtle in some places and explicit in others.
The common theme is this. The issue is no longer being treated only as a matter of false narratives or manipulative content.
It is increasingly being treated as a broader resilience problem. That means infrastructure, procedures, evidence standards, coordination, and the ability to respond under pressure.
This matters because the threat did not remain where many public debates first found it.
One of the clearest signals comes from a recent civil society focused blueprint report produced through a pilot effort involving more than thirty organizations.
What makes that report useful is not just that it confirms disinformation targeting. We already know that. The useful part is how it describes what organizations are actually dealing with in practice.
The report does not present disinformation as a standalone content issue. It presents a pattern of hybrid pressure.
In that pattern, information manipulation shows up alongside phishing attempts, impersonation, account compromise, harassment, doxxing, and coordinated online attacks.
That is a very different operational picture than the one implied by the old public debate, where the main imagined response was often rebuttal, fact checking, or counter messaging.
The survey figures in that report are stark enough on their own. A large majority of responding organizations reported being targeted by disinformation. More than half reported coordinated online attacks.
But the more important story is not simply exposure. It is readiness. Many organizations reported that they wanted monitoring tools and did not use them. Incident response planning was often informal or absent.
Only a small share had a formal documented response plan. Training was uneven. Basic security practices were not universal across all tools and platforms.
That combination tells you something about the current moment. The gap is not primarily awareness but operationalization.
That matters because it explains why so many discussions on disinformation can feel strangely disconnected from the lived experience of the people dealing with it.
It is possible to have broad awareness in the abstract and still be unprepared when a coordinated incident lands on your organization on a Thursday afternoon.
It is possible to know the theory and still lack a logging procedure, a first response checklist, a reporting pathway, or a clear division of roles. It is possible to speak fluently about democratic resilience and still ask frontline groups to improvise their way through responder level pressure with volunteer level infrastructure.
This is one place where the field has matured. The diagnosis is becoming more concrete.
The second source, a new report on attributing Russian information influence operations, points to another kind of maturity. It deals with a different part of the problem, but it reaches a similarly practical conclusion.
If the first report is about frontline capacity, this one is about evidential discipline.
Attribution has always been a difficult space because it is where public urgency collides with incomplete evidence.
People want clarity. Researchers and analysts often work with fragments. Platforms control key data. Access changes. APIs narrow. Evidence appears across different systems and formats. Legal and reputational risks are real.
In that environment, the public conversation can easily collapse into two bad habits. One is overstatement. The other is paralysis dressed up as caution.
What this attribution report does well is refuse both.
It treats attribution as a cumulative process rather than a single proof event. Technical signals matter. Behavioral patterns matter. Context matters.
Narrative alignment, timing, targeting, coordination indicators, infrastructure links, and known tradecraft can all contribute to an assessment.
None of these alone automatically settles the question. The point is not to find one magical artifact that ends debate. The point is to build a responsible evidential picture and to state clearly what level of confidence that picture supports.
That sounds obvious when said plainly, but it is not how a lot of public debate still works.
One of the most valuable habits in this kind of work is confidence language. Not as a rhetorical shield, and not as a way to sound official, but as a discipline.
Low, medium, and high confidence assessments are not signs of weakness. They are signs that analysts are trying to communicate honestly inside uncertainty. That is what rigor looks like in a messy environment.
It does not mean nothing can be known. It means claims should match evidence.
The report also helps by moving beyond a simplistic binary view of state responsibility. In real influence operations, the line between direct state execution and total independence is often not where the action is.
There are gradients of support, encouragement, coordination, and integration. There are systems built around plausible deniability. There are actors who do not need daily instructions to move in alignment.
A spectrum model is simply better suited to the reality many researchers are trying to describe.
Put differently, the field is not becoming less rigorous because attribution is hard. It is becoming more rigorous by learning how to work carefully under conditions that are imperfect by default.
The third source, a fresh European Commission announcement on the launch of the new European Centre for Democratic Resilience, adds a policy level signal that ties the other two together.
It is still early. A launch announcement is not proof of effectiveness. It does not tell us yet whether the new centre will reduce burdens on those under pressure or become another layer of institutional language. That distinction matters, and it is worth keeping in mind from the start.
Still, the framing in the announcement is notable.
The Commission language points toward a coordination function and explicitly addresses fragmentation.
It speaks in terms of connecting existing networks and structures, supporting prevention, detection, analysis, and response, and building a platform that includes researchers, civil society, media, and other stakeholders. It also places this in the wider context of FIMI and election resilience.
That is not a small shift in emphasis.
It suggests that parts of the institutional response are beginning to align more closely with what frontline actors and methodological work have already been signaling. The problem is not only that bad information exists.
The problem is that democratic defenses are often distributed, uneven, under connected, and forced to operate without shared visibility.
This is where the three sources become more than a stack of documents.
Read side by side, they describe a field in transition.
The civil society report says the pressure is hybrid and operational, and many frontline organizations are under prepared in practical terms.
The attribution report says serious response requires layered evidence, confidence discipline, and methods that can withstand scrutiny in conditions of limited data.
The EU announcement signals an institutional move toward coordination architecture, anti fragmentation, and cross sector capacity building.
These are different genres of document. They speak in different registers. They are not making identical arguments. But they are circling the same reality.
So where are we today, four years into this war and after years of trying to drag these issues into public view?
We are in an in between phase.
The awareness phase is not over, because public memory is short and new audiences keep arriving. But awareness alone is no longer the main frontier.
The next frontier is capacity. It is process. It is coordination. It is the quality of attribution practice.
It is whether institutions can support those who are already being targeted, not only publish frameworks after the fact.
There is progress in that direction. Real progress. You can see it in the language. You can see it in the questions the newer reports ask. You can see it in what they treat as the core problem.
But progress in diagnosis is not the same as progress in operational help, and that is the gap to watch.
If this field is maturing, the proof will not be cleaner statements.
It will be whether organizations on the receiving end of these attacks have better tools, clearer pathways, safer reporting, faster support, and less need to improvise. It will be whether attribution standards remain careful without becoming unusable.
It will be whether coordination structures actually reduce duplication and close blind spots.
That is the real "quo vadis" question now.
Not whether propaganda is dangerous. We already know that.
The question is whether democratic societies can build the habits, infrastructure, and institutional cooperation needed to respond before each new incident becomes another lesson learned too late.
And now, you know.
Sources
- CyberPeace Institute and EU DisinfoLab, EDRN Blueprint Report (February 2026).
- NATO StratCom COE and Center for Strategic Communications and Information Security (Ukraine), Attributing Russian Information Influence Operations (January 2026).
- European Commission / DG ENEST, The new European Centre for Democratic Resilience starts its work (24 February 2026).
