Hybrid threats exploit the increasingly blurred line between civilian and military domains. By targeting critical civilian infrastructures (CCIs), whose cybersecurity remains the sole responsibility of civilian actors, adversaries weaken the defence sector, which heavily relies on these infrastructures. This strategy creates a blind spot in the defence community that only the EU Cyber Security Policy can address. The paper investigates the contribution of the EU Cyber Security Policy regulations to the EU Cyber Defence Policy, highlighting their synergistic relation. It bases its analysis on the NIS2 Directive as an illustrative case. By adopting a more defensive posture that integrates hybrid threats, NIS2 contributes to enhanced cyber defence that aligns with the objectives of the EU Cyber Defence Policy.