The Netherlands is confronting its most complex and sustained security challenges in decades, according to the latest annual report from the General Intelligence and
Security Service (AIVD). The agency describes a threat environment unlike anything seen in its 80-year history, marked by overlapping risks from foreign powers, cyber operations, and domestic extremism.
AIVD Director-General Simone Smit emphasized that national security is being tested on multiple fronts simultaneously—and over an extended period. Central to these concerns is Russia, which the agency says is preparing for a long-term confrontation with Western nations. Moscow has taken an increasingly aggressive stance toward Europe, particularly in response to continued support for Ukraine. The Netherlands, as a prominent backer of Kyiv, is seen by Russia as part of an “increasingly hostile” bloc.
The report highlights several cyber incidents linked to Russian actors, including attacks targeting civil servants and military personnel via messaging platforms. A hacking group known as “Laundry Bear,” believed to be affiliated with Russian intelligence, was also implicated in a major breach involving Dutch police data.
Meanwhile, China is described as a growing and multifaceted threat. Dutch intelligence officials warn that Beijing has been covertly working for years to extract sensitive knowledge from companies and research institutions. These activities, the report notes, threaten the Netherlands’ economic competitiveness and technological independence. The AIVD also links China’s actions to broader ambitions to reshape the global order in line with its own political model.
The agency further points to Iran as an active cyber threat actor, particularly targeting critics of its regime, Middle East specialists, and government employees. Iranian operations have not been limited by national borders, with some targets residing in Western countries.
A notable trend identified in the report is the increasing use of criminal networks by state actors to carry out espionage and cyber operations. Some of these networks are already embedded within the Netherlands, raising additional concerns for law enforcement and intelligence agencies.
Domestically, the AIVD continues to view jihadist extremism as the most significant internal threat. The influence of Islamic State remains strong, particularly in online spaces where young people are being radicalized. Authorities observed a rise in individuals under 24 becoming involved in extremist activities over the past year.
Right-wing extremism also remains on the radar, with the agency distinguishing between non-violent ideological groups and more dangerous factions willing to resort to violence. In parallel, so-called anti-institutional extremists—often referred to as “sovereign citizens”—continue to challenge state authority. These individuals frequently target public officials such as judges and journalists. Police operations last year led to multiple arrests and the discovery of weapons and explosives.
Left-wing extremism, while present, is considered a lesser threat. The report notes that the conflict in Gaza has been a key mobilizing issue for such groups, though their activities have not reached the same level of concern as other forms of extremism.
Overall, the AIVD paints a picture of a security landscape that is not only more dangerous but also more interconnected, where foreign interference, cyber threats, and ideological extremism increasingly overlap. Photo by FaceMePLS from The Hague, The Netherlands, Wikimedia commons.