This work presents a novel method of hybrid threat assessment based on the scenario-case approach and is developed for use in early warning systems. Authors propose a model of hybrid attacks referred to time and spatial location and their sequences as well as a model of multi-stage and multi-step hybrid operation. The observed events can be matched with sample scenarios accumulated in the case base to find similarities, which are considered as soft grey assessments of hybrid threats with respect to specific domains. The proposed method provides enough performance to fulfill the requirements of early warning systems.