Introduction
The Kremlin is conducting a coordinated series of kinetic campaigns targeting Europe, and NATO states must understand and forthrightly discuss both these ongoing Russian campaigns against Europe and the evolving character of the near-term Russian conventional threat in order to design and execute holistic responses. European governments increased their willingness to publicly attribute and discuss ongoing Russian kinetic attacks against Europe after the German government officially attributed the August 5 Leipzig airport drone attack to Russia.[1] European states and leaders still too often refer to Russian actions with language that impedes effective responses, however, and have not taken sufficient action of their own to deter the escalating Russian campaign against them. European governments must develop a shared conceptual framework to understand ongoing Russian campaigns, an essential step toward creating a coordinated policy plan to respond to and deter Russian actions. NATO has recognized the changing near-term Russian conventional threat and has identified the need for rapid European rearmament and adaptation drawing on lessons from Ukraine to meet this threat, although action is lagging behind words. European states must accelerate and improve these rearmament and adaptation efforts and must prepare for the risk of a limited Russian conventional attack on a shorter timeline than the 2028-2030 window that many NATO states currently discuss. NATO and European states can defeat the ongoing Russian kinetic campaigns and deter the growing Russian conventional threat, but only on the basis of a shared understanding of the problem that will enable them to design and execute coordinated policy plans with the necessary sense of urgency and without panic. This paper presents an initial assessment of the current and near-term Russian threats, priority lines of effort for NATO states, and necessary future analytical work by ISW and other organizations.
The Ongoing Russian Kinetic Campaigns Against Europe
The Kremlin’s objectives extend far beyond Ukraine, and the Russian government has long considered itself to be in a long-term conflict with the West — a conflict it has recently escalated through a coordinated series of campaigns of kinetic actions against European targets beyond Ukraine. The Kremlin’s aims include preserving Putin’s regime; reestablishing Russia as a great power, which presupposes subjugating Ukraine and Belarus; regaining control over the former Soviet states, specifically including the Baltic States; and establishing a world order in which US influence is diminished, NATO’s unity is broken, and Russia has decisive influence.[2] ISW has long assessed that the Kremlin considers itself to be in an overt conflict with Europe and the United States.[3] The Kremlin has conducted a campaign of irregular actions, military posturing, and nuclear saber rattling against Europe for years, and individual Russian actions are not inherently new. The Kremlin has increased the intensity of its kinetic actions and statements since Summer 2025, however, such as with the September 9-10, 2025 Russian drone incursion into Polish airspace — and the Kremlin has become even more brazen in Summer 2026.[4] The Kremlin is conducting a series of coordinated kinetic campaigns against NATO member states, and European states must both understand internally and publicly name these campaigns externally for what they are: coordinated kinetic and non-kinetic attacks against NATO military and civilian targets, not isolated incidents or “provocations.”
The German government’s official announcement on September 1 that Russia was directly responsible for the August 5 drone attack targeting Germany’s Leipzig/Halle Airport marked a turning point in the willingness of European officials to publicly discuss ongoing Russian kinetic actions. German authorities discovered a drone containing explosives near a Ukrainian Antonov cargo plane overnight on August 4 to 5 and reported that a second drone collided with another cargo plane that was aborting its landing due to the first drone incident.[5] German Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul stated on September 1 that Germany and its partners clearly identified Russian involvement in the attack, and noted that the perpetrators used tactics consistent with known Russian modi operandi and technical capabilities.[6] Numerous NATO, EU, and European government officials expressed their agreement with the German assessment, expressed full support for Germany, and denounced future Russian actions against Germany and other European targets.[7] Even so, neither Germany nor any other European state or body has taken meaningful action against Russia in response.
The Kremlin and Russian-linked actors have escalated the pace and intensity of their kinetic actions against Europe over the past year. Russian-linked actors regularly attack critical infrastructure across Europe, such as persistent attempts to sabotage Polish railways.[8] The Kremlin is conducting a campaign of arson attacks against European defense industrial base targets producing material for both European militaries and Ukraine.[9] European intelligence agencies and media outlets regularly report that Russian-linked agents seek to assassinate executives in major European defense companies.[10] Russian and Russian-linked actors routinely conduct cyberattacks against European government and civilian targets.[11] Russian military aircraft routinely probe the borders of NATO airspace to test NATO defenses on a near-daily basis.[12] The Russian navy and intelligence services threaten NATO sea lines of communication and critical infrastructure such as undersea cables.[13] The Russian “shadow fleet” of falsely flagged vessels supports Russian sanctions evasion and likely supports other Russian kinetic actions against Europe such as drone launches.[14] The Kremlin has at minimum accepted the risk of drones and missiles used in strikes against Ukraine entering NATO airspace and injuring civilians, as when a Russian drone struck a Romanian apartment building on May 29 and injured two people.[15] ISW now assesses that some Russian airspace violations in conjunction with strikes in Ukraine are intentional, however, and both intentional and unintentional violations enable the Russian military to test NATO air defenses and erode the meaning of NATO’s Article 5 collective defense provision.[16] The Russians additionally very likely sought to injure or kill current and former European officials in the September 13 drone strike that apparently was meant to hit the train carrying those officials out of Ukraine following a conference in Kyiv.[17]
The Kremlin is conducting these actions against Europe as part of a series of mutually supporting kinetic and cognitive campaigns against Europe, rather than as a scattered collection of individual actions. The objectives of Russia’s campaigns include but are not limited to: physically disrupt NATO support for Ukraine, intimidate European states into halting support to Ukraine through the threat of strikes and the concern that they must reserve military equipment for their own protection, gather intelligence on NATO defenses and responses to Russian actions, raise NATO’s threshold of what kinetic Russian actions are considered normal or routine in an effort to “boil the frog” and normalize Russian attacks, exacerbate political divides in Europe, demonstrate to Russian domestic audiences that Russia can attack NATO, and set conditions for potential future Russian conventional operations against NATO. ISW will present a campaign framework for the Russian campaigns against Europe and will assess major Russian lines of effort in forthcoming papers.
European officials’ increased willingness to publicly discuss Russia’s kinetic campaigns is positive, but the language NATO and individual European states use to discuss the ongoing Russian campaigns will inherently shape Western policy responses, and much of it still obfuscates the coordinated and coherent nature of the Russian efforts.
European officials too often refer to Russian actions, from violations of NATO airspace up to and including blatantly kinetic attacks on European infrastructure, as “provocations.”[18] Calling Russian violations of NATO airspace and direct attacks on European targets “provocations” constrains NATO’s freedom to act by implicitly framing NATO responses to these Russian actions as NATO being “provoked,” a negative term that European states will inherently wish to avoid. Labeling individual Russian actions and entire categories of Russian actions as “sub-threshold” or “sub-Article 5” actions likewise preemptively constrains NATO responses by de facto labeling Russian actions as unworthy of NATO collective defense. The Kremlin will rightly read this language as what it is: NATO states attempting to downplay actual Russian attacks for fear that any effort to invoke the Article 5 (or sometimes even Article 4) provisions that the Russian attacks actually merit would fail. NATO and European states must work to avoid using this language and call Russian kinetic attacks what they are, whether the target states choose to invoke Article 4 or Article 5 or not.
European officials most commonly refer to Russian actions as “hybrid attacks” or “hybrid war.” German Interior Minister Dobrindt stated on September 1 that German intelligence perceives the August 5 Russian attack on the Leipzig/Halle airport as having occurred “in conjunction with other hybrid actions” and noted that Germany will be the target of future “hybrid” attacks.[19] Most European statements of support for Germany after September 1 similarly discussed the Russian “hybrid attack” and pledged responses to future “hybrid action,” and the “hybrid” language remains dominant in public discourse around Russian campaigns.[20] The problem with identifying Russian kinetic attacks on NATO states as “hybrid” is that it implies that they are not part of a coherent military campaign, but rather part of something else. Using that term is, again, meant to justify not invoking NATO’s collective defense provisions or taking meaningful action in response, and the Kremlin will read it as Europe’s willingness to accept continued and possibly escalated Russian actions along these lines.
An increasing number of European officials, particularly in frontline states, have correctly directly named Russian actions as “kinetic” or as “attacks” without any qualifier. Polish Foreign Minister Radoslaw Sikorski stated on August 17 that Russian actions against Europe have “turned kinetic,” citing Russian assassination attempts and efforts to sabotage Polish railways.[21] Lithuanian Foreign Minister Kestutis Budrys echoed this wording on September 2, stating that Russian attacks against Europe are “no longer hybrid; they are very kinetic.”[22] European Commission President Ursula von der Leyen characterized the Leipzig/Halle Airport attack as “an attack using military-grade material carried out by Russian operatives on European Union soil,” on September 1, characterizing it directly as an attack without the “hybrid” qualifier.[23] This language is much more accurate, even if it downplays the significance of previous Russian kinetic attacks on Europe.
The Baltic states have increasingly shifted since September 1 towards calling Russian attacks “state-sponsored terrorism,” though this language has not yet reached wide acceptance. Kaupo Rosin, Director General of the Estonian Foreign Intelligence Service, directly stated on August 28 that Europe must “abandon euphemisms like ‘hybrid warfare’ and call escalating [Russian] sabotage campaigns and subversion across Europe by its proper name of ‘state-sponsored terrorism.’”[24] EU High Representative Kaja Kallas similarly stated on September 2 that the Leipzig/Halle Airport attack had “all the characteristics of state sponsored terrorism.”[25] Terrorism is a form of war, and an act of terrorism on September 11, 2001 prompted the first and only invocation of NATO’s Article 5 provision to date, so this language is a move in the right direction. It still obfuscates the connection between current Russian kinetic campaigns against Europe and the actual near-term Russian conventional threat, however.
Defining the current Russian challenge will be a difficult and pressing challenge for NATO and Europe, and European states must at minimum understand the assumptions and inherent framing of justifiable responses to Russian actions that the terms they are already using introduce into ongoing policy debates. ISW will assess the policy ramifications of using different labels for Russian actions in a forthcoming paper and is not yet proposing a set of language to use to describe the Russian campaigns, other than a direct statement of what they are: coordinated, state-directed, kinetic attacks on European targets.
The Near-Term Russian Conventional Threat
NATO must additionally prepare for the possibility of near-term conventional Russian attacks that would not be militarily existential to NATO but could be politically existential by dividing NATO. The Russian military could conduct air, missile, or drone strikes or a limited ground incursion against one or more Baltic states to test and seek to break NATO’s resolve to invoke Article 5 and respond effectively on its basis. A limited Russian attack would aim to create a situation in which NATO is unable to agree how, or if at all, to respond to a Russian attack. Any near-term Russian conventional attack would be tailored to maximize the possibility that NATO states would fail to unify and provide military assistance as an alliance to an attacked member state. A scenario in which NATO does not unanimously vote to honor an invocation of the Article 5 mutual defense clause, or in which a state under Russian attack declines to invoke Article 5 at all out of concern that it would not receive unified support, would significantly damage NATO’s credibility and unity — an outcome that would achieve a longstanding Russian objective and immensely expand Putin’s space to maneuver and plan future attacks against a divided alliance.
Western analysts and policymakers must avoid the mistake of conflating “Russia cannot easily conquer the Baltic states and comprehensively win an extended war of maneuver with NATO” with “NATO does not need to worry about the conventional Russian threat.” The Russian military may not be capable of conducting extended maneuver warfare across the Baltic states and Poland, but a limited Russian operation to capture a thin slice of a NATO member state with operational concepts and tactics used in Ukraine before daring NATO member states to evict them could very well achieve its initial objectives. European policymakers unfortunately cannot assume that NATO will respond comprehensively to a Russian attack. A fully united NATO leveraging all of its available capabilities (including substantial US involvement); willing to conventionally strike targets in Russia; and properly mobilized in advance of a Russian attack, would very likely defeat a near-term Russian attempt to physically occupy substantial portions of the Baltic States and Poland. NATO cannot and should not solely prepare for that eventuality, however. Frontline NATO states must account for the possibility of at minimum delays in responses to an invocation of Article 5 and may need to fight the early stages of a limited war with Russia without many expected high-end capabilities and reinforcing units.
The potential timeline of such a limited Russian conventional attack could also be faster than the timelines that many European officials currently orient themselves on. Many NATO and NATO member state assessments assert that Russia could not credibly threaten NATO until 2029 or 2030; the German Ministry of Defense (MoD) stated on June 24, for example, that “the clear focus [of German rearmament] is initially on the year 2029 — the point at which Russia could foreseeably be capable of attacking NATO territory.”[26] Some NATO officials and intelligence agencies have recently assessed a shorter conventional risk timeline, however, and senior European commanding officers and Defense Ministry officials often warn of shorter timelines than civilian officials or intelligence agencies. The Dutch MoD’s 2026 annual defense strategy report noted that “in a worst-case scenario, a limited war against NATO members could be possible within one year of the Russian war in Ukraine ending.”[27] Commander of the Estonian Defense Forces General Andrus Merilo stated in May 2026 that the Russian military could restore its combat readiness as early as 2027.[28] Several NATO civilian officials and senior officers have struck a cautionary note, assessing that while Russia may not be capable of imminently posing a conventional threat to NATO, current European defense plans create a window of vulnerability prior to 2028 or 2029 that the Kremlin could exploit. Commander of the Latvian Armed Forces General Kaspars Pudans stated on June 4, for example, that “if I were the Kremlin, I would say if we do something, then we should do it by the end of 2028” because most European military modernization plans are not expected to be fully implemented until 2029.[29] It is not clear from publicly available information what assumptions about how Russian forces would attack underpin these assessments of when Russia could attack a NATO member state. It is also unclear if these estimates fully recognize the challenges NATO member states would face in defeating a Russian offensive operation like the ones they are conducting in Ukraine.
European Rearmament and Integrating Learning from Ukraine
NATO and its member states increasingly recognize the growing Russian conventional threat and are responding with announcements of large-scale rearmament programs and discussions about the new technologies and techniques emerging from the war in Ukraine. NATO warfighters and European defense analysts largely agree as of September 2026 that European militaries must synthesize existing capabilities with evolving drone-centric approaches drawn from Ukraine, but European states must both accelerate and refine these efforts.
Europe must not assess Russian military reconstitution as a linear process and cannot assume that the Russian military will stop and reconstitute to a nominal “full strength” after the end of major combat operations in Ukraine before conducting offensive action against NATO, as argued in ISW’s October 2025 report “The Russian Military: Forecasting the Threat.”[30] NATO assessments of when the Russian military could pose a threat to NATO that are based on timelines of when the Russian military could feasibly rebuild its formations to their pre-February 2022 strength and structure provide a sense of security by imposing a false degraded/reconstituted binary. The Russian military will not and cannot simply reconstitute to its pre-2022 structure and capabilities. A partially or inefficiently reconstituted Russian military can still threaten Ukraine and Europe, however, and what the Kremlin assesses is “good enough” for offensive action against a NATO member state may significantly differ from what NATO would consider a reconstituted military — particularly if the Kremlin assesses that NATO would not collectively respond to a Russian attack on a frontline NATO state.
Western analysts must also avoid the trap of assuming that Russian forces cannot pose a meaningful short-term threat to frontline NATO states because they are currently struggling to gain ground in Ukraine. While the Russian military may not be positioned to conduct rapid, deep drives into NATO territory with tanks and aircraft in the near term, its current capabilities could enable it to conduct meaningful advances with dispersed forces, drones, and infiltration tactics akin to its main efforts in Ukraine. The Russian military is not failing to advance in Ukraine in a vacuum; the Ukrainian military is stopping the Russian military from advancing and is increasingly contesting the initiative through limited counterattacks and a highly effective intermediate- and deep-strike campaign.[31] The Ukrainian military has optimized itself for defensive positional warfare. Ukrainian formations have over four years of active combat experience, are defending long-prepared defensive positions, and have a technological-tactical-industrial integration process that no NATO state can currently match. NATO cannot assume that operational concepts, and particularly plans for the use of airpower, that are designed to defeat Russian armored columns will inherently transfer to defeating Russian infiltration tactics and Rubikon drone teams. The Baltic states are smaller and lack Ukraine’s “wall of drones,” experienced forces, and increasing intermediate- and deep-strike capabilities. A shift in American strategic focus is also compelling European nations to prepare for the possibility of countering Russian aggression with diminished or absent support from key enablers and air power currently provided by the United States.
NATO member states face a dual challenge: they must not only modernize and expand traditional means that have been woefully neglected for decades, but must also learn, internalize, adapt, and institutionalize new capabilities to fight a changing way of war pioneered in Ukraine. NATO decisionmakers and force planners should not conflate NATO’s ability to execute existing NATO doctrine with having the capacity to defend Europe.[32] Analysts and policymakers should not impose a false binary between completely reshaping NATO capabilities to fight a positional war relying heavily on drones (often referred to as a “Ukrainian way of war”) or concentrating solely on traditional mechanized maneuver as NATO intends to execute it. Arguments that NATO forces must simply fight like Ukraine, as well as contrary claims that drones have completely invalidated legacy systems and concepts, both overstate and simplify the case. The Ukrainian military has stated throughout the war that it would prefer to field a more balanced high-low mix, synthesizing NATO-provided capabilities like airpower; survivable armor; and extended range rounds for traditional tube artillery with its indigenous drone-centric capabilities.[33] NATO cannot take for granted the effectiveness of its existing high-end capabilities such as long-range precision strike, modern air forces, and advanced air defense systems against Russian forces fighting as they are now (and as they will in the near future), however. NATO member states face the pressing challenge of updating the warfighting frameworks and the conceptual thinking underpinning NATO planning while balancing immediate actions to counter the existing Russian threat with efforts to prepare for the Russian military’s medium-term evolution.
NATO forces will face different combat situations and requirements from those confronting Ukrainian forces and must develop approaches to differing aspects of the changing character of war and potential phases of the next war. Frontline NATO states preparing first echelon units to fight an initial battle against a Russian invasion, or reinforcing armored units intended to liberate captured NATO terrain, should not inherently copy the structures and approaches of undermanned Ukrainian units who have been conducting an area defense of the same terrain for years — though that does not mean that NATO should ignore the practices of those Ukrainian troops. European states must study the lessons of each phase and campaign of the Russian invasion of Ukraine and integrate lessons learned with forward-looking research on how the next war will differ from what has been observed in Ukraine. NATO member states are already integrating lessons from Ukraine into their military exercises and considering force structure changes informed by the changing character of war in Ukraine, and must ensure they do so in a maximally effective manner.
Necessary European and NATO Lines of Effort
NATO states and the analytic community that supports them have not come to a consensus about what the current Russian threat is and therefore lack a consensus on how to deal with it. NATO and European states have three overall tasks: to understand and respond to the ongoing Russian kinetic campaigns against Europe; to rapidly accelerate efforts to forecast and prepare for the risk of a potential near-term limited Russian conventional attack that NATO is not yet sufficiently taking into account; and to improve ongoing efforts to leverage lessons from Ukraine and forecasts of the changing character of war and strengthen NATO’s ability to deter or defeat the evolving conventional Russian military threat.
Directly naming and attributing the ongoing Russian kinetic campaigns against Europe and pragmatically responding to the current and near-term Russian threat are not escalatory and are absolutely necessary. It does not take two to tango when it comes to Russia’s conflict with the West and escalating campaigns of kinetic actions against Europe. The Kremlin already sees itself in a protracted conflict with the West and is conducting active kinetic campaigns. That fact, constantly repeated by Russian officials, means that a Russia-Europe conflict is already underway, however European states might feel about the matter.[34] German Interior Minister Alexander Dobrindt hedged on September 1 that Germany is “not at war” but is the “daily target of hybrid warfare.”[35] Statements like these are tortuous attempts to deny reality — if one is the daily target of warfare activities, then one is at war even if one is not responding to those attacks. European states will not make Russian kinetic actions against European military and civilian targets go away by declining to admit that they are what they are, still less by failing to take them head on. European states targeted by Russian attacks and all NATO states must use clear language when communicating about Russian actions in order to facilitate prompt and meaningful action in response.
Arguments that NATO runs the risk of “war enthusiasm” and inducing a Russian attack by preparing for its own defense mistakenly accept the Kremlin’s framing that Russia was or will be provoked into illegally invading its neighbors. Pragmatic responses to Russian threats — such as shooting down Russian drones in NATO airspace, increasing NATO’s conventional presence in frontline states, or hardening critical infrastructure against the threat of Russian strikes or sabotage — are not escalatory actions by NATO, no matter how often the Kremlin frames them that way.[36] They are necessary and justified responses to Russian threats and attacks. Preparing better defenses against and responding appropriately to escalating attacks is not escalation; it is prudence. Concerns expressed by some policymakers in frontline NATO states that they do not want to overly alarm their populations or drive away economic investment by moving to a war footing or publicly discussing Russian threats are understandable on the surface but impede necessary efforts.[37] Europe may not need alarmed populations, but it needs informed populations and certainly does need alarmed governments.
Regarding the conventional Russian military threat, blanket assertions by some analysts and commentators that the Russian military does not and will not pose a threat to NATO stifle the quality of necessary debate and forecasting. Further claims that any analysts and policymakers who raise even the possibility of a near-term Russian conventional threat are alarmist, scaremongering, or trying to sell something are actively unhelpful to European defense. Alarmism is harmful and should be avoided, to be sure, and breathless warnings of an imminent World War 3 or claims that Russia could rapidly occupy the entirety of the Baltic states are also unhelpful. But one can have a clear-eyed view of a rising Russian threat and the challenges it poses, recognize that urgency is required to meet it, and prepare for possible Russian courses of action without being alarmist. The Kremlin has demonstrated that it can and will take offensive action that may seem illogical or unlikely to succeed from a Western perspective, and Europe must prepare to deter or defeat even a partial or failed Russian conventional attack that could still be disastrous for European stability and security.
NATO and European states must understand the challenge posed by ongoing Russian kinetic campaigns, should to the furthest degree possible agree on a shared concept to understand these campaigns, and must implement actionable policies to harden European targets and deter future Russian actions. Responding to ongoing Russian kinetic and informational campaigns is not a lesser included aspect of conventional deterrence. NATO and European governments must plan and execute a response to these Russian campaigns that is coordinated with, but not strictly a component of, NATO’s focus on conventional deterrence and warfighting. NATO officials often emphasize that deterrence is working and the Kremlin respects NATO’s unity.[38] NATO deterrence may be in place against a full-scale Russian conventional attack (though NATO cannot take that for granted), but deterrence is not fully succeeding if the Kremlin is willing and able to attempt to destroy Ukrainian aircraft at a German airport, sabotage European defense industrial base facilities, seek to injure or kill European officials as they leave Ukraine and in Europe itself, and accept the risks of Russian missiles and drones entering NATO airspace on a weekly basis. The Kremlin’s kinetic and cognitive campaigns are intentionally designed to target seams between individual states and international organizations and to exploit a difficult European information space. NATO and European states face a substantial challenge defining and responding to ongoing Russian campaigns and this report is not intended to downplay the difficulty of that challenge, but European states must develop a more coherent response to the Russian threat than they currently have.
NATO as an alliance and individual European states must plan and execute proactive policies towards the current Russian threat, rather than responding to individual actions as they occur. Europe and NATO are already taking steps to respond to the Russian threat, to be sure, such as hardening critical infrastructure against sabotage; increasing NATO’s ability to respond to aerial threats; and directly signaling NATO unity and capabilities to the Kremlin.[39] NATO and Europe must accelerate and integrate these disparate efforts into a unified response to the Kremlin’s kinetic campaigns, which will be predicated on developing a shared understanding of the threat Europe faces. NATO and European governments will additionally need to decide how to frankly discuss near-term risks and necessary responses both amongst themselves and with their populations.
NATO must also urgently consider potential scenarios of limited Russian conventional attacks against NATO member states on a closer timeline than NATO is currently orienting itself on, an effort which ISW will support in forthcoming papers. NATO must avoid lulling itself into a false sense of security by asserting that the Russian military cannot pose a threat until 2029 (or some other date) and therefore orienting military planning solely on that target date. NATO militaries must prioritize immediate adaptations to ensure they are as prepared as possible to truly “fight tonight” with the forces they have now to better meet the risk of a near-term Russian threat, alongside existing medium-term rearmament efforts. NATO must orient on what the Russian military, in its current state in Ukraine, could do against NATO frontline forces as they currently are, rather than orienting on a nominal “reconstituted” Russian force. This requires intensive and rapid study of Russian operational concepts, force structures, and tactics. It is far from certain that frontline NATO forces could rapidly defeat a limited Russian force using operational concepts and tactics iterated in Ukraine at acceptable cost.
Acknowledging and addressing the wide array of courses of action the Kremlin could pursue and potential gaps in NATO capabilities is essential to formulating cleareyed and effective responses to the threats NATO might face. The Kremlin could conceivably pursue a limited conventional attack on a NATO member state while continuing offensive operations in Ukraine, such as a drone-supported operation to support a purported Narva People’s Republic, direct Russian drone and missile strikes on NATO targets that Russian officials and media claim are supporting Ukrainian strikes against Russia, up to an unlikely (but possible) scenario in which the Kremlin perceives a window of opportunity to directly seize a strip of NATO territory in an attempt to break NATO or secure a bargaining chip in negotiations over Ukraine. NATO states must prepare military and political responses to these and other potential Russian actions. Russian cognitive warfare efforts will go all out to persuade one or more NATO states to decline to respond to a Russian attack, and NATO should not rely on every member state government responding to a limited Russian attack promptly, if at all. Frontline states must prepare the ability to defend against low-level Russian attacks with tactical capabilities that are not reliant on the mobilization or permission of the entire alliance, and to leverage command structures below the level of strategic NATO structures — though without preemptively abandoning the ideal case of a unified NATO response.
Finally, NATO must accelerate and improve its ongoing efforts to leverage lessons from Ukraine and forecasts of the changing character of war to create an adaptable force capable of defeating the medium-term Russian conventional threat. NATO member states are, to be certain, already taking into account lessons from the war in Ukraine and modernizing training, equipment, and force structures to respond to evolving Russian capabilities and the changing character of war — but more must be done, and quickly. Many of Europe’s challenges begin with its strategic approaches to rearmament and acquisitions policies. For example, European states should focus on building the capacity to rapidly surge production of iterative systems during wartime, rather than seeking to stockpile large amounts of drones pre-conflict that risk rapidly being rendered obsolete. ISW and other research organizations can and should support NATO efforts through open and closed dialogue, as NATO rearmament and adaptation efforts will benefit from multiple inputs.
Europe can confront the Russian threat through pragmatic policymaking and clear signaling, but neglecting deterrence and proactive action emboldens the Kremlin — a lesson European states should have learned long ago. The alliance as a whole retains superiority in escalation scenarios as long as the United States is fully committed to defending its European allies and Putin remains committed to the war against Ukraine. Strategic ambiguity, on the other hand, invites Russian adventurism and significantly increases the odds that Putin will continue to escalate his ongoing kinetic campaigns against Europe and might gamble on a scenario hoping to invalidate Article 5 at a low cost and risk to himself. NATO and Europe’s three pressing challenges — the ongoing Russian kinetic campaigns against Europe; the increasing threat of a limited near-term Russian conventional attack; and the challenge of effectively leveraging learning from Ukraine and adapting to the changing character of war — are interlinked and must be taken as a whole. Open, clear-eyed, and prompt discussion of potential European policy responses are essential to respond to the ongoing Russian threat and the risk of further Russian actions to test or directly attack NATO.
[1] Kateryna Shymkiv, Tetiana Trach, et al., “Russian Offensive Campaign Assessment, September 1, 2026,” Institute for the Study of War, September 1, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-1-2026/.
[2] Nataliya Bugayova and Kateryna Stepanenko, “A Primer On Russian Cognitive Warfare,” Institute for the Study of War, June 30, 2025, https://understandingwar.org/research/cognitive-warfare/a-primer-on-russian-cognitive-warfare/.
[3] Jennie Olmstead, Jessica Sobieski, et al., “Russian Offensive Campaign Assessment, September 15, 2025,” Institute for the Study of War, September 15, 2025, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-15-2025/; Nataliya Bugayova, Frederick W. Kagan, and Kateryna Stepanenko, “Denying Russia’s Only Strategy for Success,” Institute for the Study of War, March 27, 2024, https://understandingwar.org/research/russia-ukraine/denying-russias-only-strategy-for-success-2/; Frederick W. Kagan, Nataliya Bugayova, and Jennifer Cafarella, “Confronting the Russian Challenge: A New Approach for the U.S.,” Institute for the Study of War, June 19, 2019, https://understandingwar.org/wp-content/uploads/2025/04/ISW20CTP20Report20-20Confronting20the20Russian20Challenge20-20June202019.pdf, pg 24.
[4] Christina Harward, Anna Harvey, et al., “Russian Offensive Campaign Assessment, September 10, 2025,” Institute for the Study of War, September 10, 2025, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-10-2025/.
[5] Matthias Inverardi, “Explosive drone at German airport raises new danger, minister says,” Reuters, August 5, 2026, https://www.reuters.com/world/german-police-examine-suspicious-object-leipzig-airport-2026-08-05/; Geir Moulson, “Drone with explosives found at German airport, official sees ‘new quality’ of threat,” Associated Press, August 5, 2026, https://apnews.com/article/germany-leipzig-halle-airport-disruption-7812a9ca0916056dbe2530c9c8e90060.
[6] [“Foreign Minister Wadephul on Russian involvement in attempted attack in Leipzig at the joint press conference with Interior Minister Dobrindt,”] German Federal Foreign Office, September 1, 2026, https://www.auswaertiges-amt dot de/de/newsroom/2800598-2800598; Kateryna Shymkiv, Tetiana Trach, et al., “Russian Offensive Campaign Assessment, September 1, 2026,” Institute for the Study of War, September 1, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-1-2026/.
[7] Ursula von der Leyen, X, September 1, 2026, https://x.com/vonderleyen/status/2094814604358533554?s=20; Mark Rutte, X, September 1, 2026, https://x.com/SecGenNATO/status/2094818411066904731?s=20; Gitanas Nauseda, X, September 1, 2026 https://x.com/GitanasNauseda/status/2094817826825441512?s=20; Edgars Rinkevics, X, September 1, 2026,https://x.com/edgarsrinkevics/status/2094823993928757626?s=20.
[8] Athanasios Katsikidis, “Europe needs a ‘European Legion’ to take responsibility for its own security,” eKathimerini, August 15, 2026, https://www.ekathimerini dot com/in-depth/interviews-in-depth/1312199/europe-needs-a-european-legion-to-take-responsibility-for-its-own-security/; Piotr Podlewski, [“Railroad Diversion. Siemoniak: We Must Consider Worst-Case Scenarios,”] Polskie Radio, February 18, 2026, https://jedynka.polskieradio dot pl/artykul/3649316,Dywersja-na-kolei-Siemoniak-musimy-brać-pod-uwagę-najgorsze-scenariusze.
[9] Dietmar Neurer, [“Economy sounds the alarm about increased acts of sabotage,”] Handelsblatt, September 9, 2026, https://www.handelsblatt dot com/politik/deutschland/sabotage-wirtschaft-schlaegt-wegen-vermehrter-sabotageakte-alarm/100251704.html; “Two detained as German police probe arson attack on Munich defense firm,” Polish Television World, September 9, 2026, https://tvpworld dot com/95192962/germany-two-bulgarians-detained-aspolice-probe-arson-attack-on-munich-defense-firm; Anmar Anwer, “Polish PM says fire at drone factory supplying Ukraine was sabotage,” Polish Television World, September 9, 2026, https://tvpworld dot com/95175712/pm-tusk-sabotage-at-polish-wb-group-drone-factory-supplying-ukraine.
[10] Giulia Bernacchi, “UK warns Defense Executives of Russian Espionage Threat: Report,” The Defense Post, August 31, 2026, https://thedefensepost.com/2026/08/31/uk-defense-russian-espionage-threat/; Csongor Kormi, Hans von der Burchard, et al., “Russian plot to kill European weapons chief foiled by US and Germany,” Politico, July 11, 2024, https://www.politico dot eu/article/russia-plot-kill-arms-manufacturer-rheinmetall-ceo-armin-papperger-foiled-us-germany-cnn/.
[11] [“The European Union adopted the largest package of cyber sanctions against Russia to date,”] Estonian Ministry of Foreign Affairs, July 13, 2026, https://vm dot ee/uudised/euroopa-liit-vottis-vastu-seni-suurima-venemaa-vastase-kubersanktsioonide-paketi; Jurga Tvaskiene, [“Sakaliene, listing Russia’s methods of operation: we are approaching an incident in which a NATO citizen dies,”] Lithuanian National Radio and Television, August 25, 2026, https://www.lrt dot lt/naujienos/lietuvoje/2/3019089/rusijos-veikimo-budus-vardijanti-sakaliene-artejam-prie-incidento-kai-zus-nato-pilietis.
[12] Stanislaw Kaleta, “‘Do the math’: Shocking number of times NATO jets scrambled to confront Putin threats revealed,” Polish Television World, September 8, 2026, https://tvpworld.com/95278636/nato-admiral-jets-scrambled-700-times-in-two-years-amid-russian-air-threat.
[13] Sarah Mcfarlane, Gram Slattery, “NATO allies foil Russian subsea cable sabotage plot,” Reuters, September 10, 2026, https://www.reuters.com/world/europe/nato-allies-foil-russian-subsea-cable-sabotage-plot-2026-09-10/.
[14] Charlie Edwards, Rex Fox O’Loughlin, and Louis Bearn, “Russia’s UAV Campaign Over Europe,” The International Institute for Strategic Studies, July 2026, https://www.iiss.org/research-paper/2026/06/russias-uav-campaign-over-europe/; Benjamin Jensen and Jose M. Macias III, “Ghost Busters: Options for Breaking Russia’s Shadow Fleet,” Center for Strategic & International Studies, December 15, 2025, https://www.csis.org/analysis/ghost-busters-options-breaking-russias-shadow-fleet.
[15] Jakub Kostka, Kateryna Shymkiv, et al., “Russian Offensive Campaign Assessment, May 29, 2026,” Institute for the Study of War, May 29, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-may-29-2026/.
[16] Jacob Spencer, Tetiana Trach, et al., “Russian Offensive Campaign Assessment, September 8, 2026,” Institute for the Study of War, September 8, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-8-2026/; Tetiana Trach, Nikolai Sundstrom, et al., “Russian Offensive Campaign Assessment, August 18, 2026,” Institute for the Study of War, August 18, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-august-18-2026/.
[17] Jennie Olmsted, Tetiana Trach, et al., “Russian Offensive Campaign Assessment, September 13, 2026,” Institute for the Study of War, September 13, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-13-2026/.
[18] Urmet Kook, [“Latvian Defense Minister: A direct Russian attack on NATO is currently impossible,”] Estonian Public Broadcasting, July 29, 2026, https://www.err dot ee/1610088904/lati-kaitseminister-venemaa-otsene-runnak-nato-vastu-on-praegu-voimatu; Vilmantas Venckunas, Karolina Ambrazaitye, and Modesta Gaucaite-Znutiene, [“Nauseda: Lithuania is determined to shoot down drones, even if it means using expensive missiles,”] Lithuanian National Radio and Television, May 27, 2026, https://www.lrt dot lt/naujienos/lietuvoje/2/2942204/nauseda-lietuva-pasiryzusi-numusti-dronus-net-jei-prireiks-panaudoti-brangias-raketas.
[19] [“Foreign Minister Wadephul on Russian authorship of the attempted attack in Leipzig at the joint press conference with Interior Minister Dobrindt,”] German Federal Foreign Office, September 1, 2026, https://www.auswaertiges-amt dot de/de/newsroom/2800598-2800598; Kateryna Shymkiv, Tetiana Trach, et al., “Russian Offensive Campaign Assessment, September 1, 2026,” Institute for the Study of War, September 1, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-1-2026/.
[20] Ursula von der Leyen, X, September 1, 2026, https://x.com/vonderleyen/status/2094814604358533554?s=20; Mark Rutte, X, September 1, 2026, https://x.com/SecGenNATO/status/2094818411066904731?s=20; Jonas Gahr Store, X, September 1, 2026, https://x.com/jonasgahrstore/status/2094833640379134009?s=20.
[21] Athanasios Katsikidis, “Europe needs a ‘European Legion’ to take responsibility for its own security,” eKathimerini, August 15, 2026, https://www.ekathimerini dot com/in-depth/interviews-in-depth/1312199/europe-needs-a-european-legion-to-take-responsibility-for-its-own-security/.
[22] Paulius Perminas and Liudmila Petrakova, [“Budrys calls on EU to discuss use of frozen Russian assets to finance Ukraine”], Lithuanian National Radio and Television, September 2, 2026, https://www.lrt dot lt/naujienos/pasaulyje/6/3040156/budrys-ragina-es-diskutuoti-del-isaldyto-rusijos-turto-panaudojimo-ukrainai-finansuoti; [“K. Budrys Gymniche: Russian attacks against us are no longer hybrid, they are very kinetic,”] Lithuanian Ministry of Defense, September 2, 2026, https://www.urm dot lt/naujienos/141/k.-budrys-gymniche-rusijos-atakos-pries-mus-nebera-hibridines-jos-labai-kinetines:46392.
[23] Victor Jack, “Von der Leyen, Rutte say Russian ‘intimidation will not work’ to stop Ukraine aid,” Politico, September 2, 2026, https://www.politico.eu/article/eu-ursula-von-der-leyen-nato-mark-rutte-say-russian-intimidation-will-not-work-to-stop-ukraine-aid/.
[24] David Blair, “Estonia’s spy chief: ‘Russia is in a very bad place – revolution could come overnight,’” The Telegraph, August 29, 2026, https://www.telegraph.co.uk/news/2026/08/29/kaupo-rosin-interview-russia-bad-place-revolution/?msockid=388cf76db17b6fce1d9ee006b0586ea1.
[25] [“Kallas: EU summons Russian ambassador over drone incident in Leipzig,”] Lithuanian National Radio and Television, September 2, 2026, https://www.lrt dot lt/naujienos/pasaulyje/6/3040143/kallas-del-drono-incidento-leipcige-es-iskviete-rusijos-ambasadoriu.
[26] [“This is how the German Armed Forces are supposed to defend Germany and its allies in an emergency,”] German Ministry of Defense, June 24, 2026, https://www.bmvg dot de/de/aktuelles/verteidigungsaufstellung-bundeswehr-2029-vorgestellt-6115216; [“Russia and 2029: Sikorski Says What Could Happen,”] Polskie Radio 24, March 20, 2026, https://polskieradio24 dot pl/artykul/3662966,rosja-i-2029-rok-sikorski-mowi-co-moze-sie-wydarzyc.
[27] [“Defense White Paper 2026 – Together Forward!,”] The Netherlands Ministry of Defense, June 29, 2026, https://open.overheid dot nl/overheid/openbaarmakingen/api/v0/attachment/28d42075-1bf5-474b-8ee1-de138e45512d; “Russia Could Attack NATO One Year After Ukraine War: Dutch Govt,” The Defense Post, June 30, 2026, https://thedefensepost.com/2026/06/30/russia-attack-nato-netherlands-warning/.
[28] Maria-Ann Rohemäe, [“Defence Forces warn of Russia’s resumption of combat readiness,”] Estonian Public Broadcasting, April 5, 2026, https://www.err dot ee/1610014147/kaitsevagi-hoiatab-venemaa-lahingvalmiduse-taastumise-eest.
[29] Charles Clover and Richard Milne, “Russia could use drone edge to threaten Baltics, warns Latvian general,” Financial Times, June 4, 2026, https://www.ft.com/content/a8a6d038-e130-4637-a49f-49e50bf119a6.
[30] Mason Clark, “The Russian Military: Forecasting the Threat,” Institute for the Study of War, October 27, 2025, https://understandingwar.org/research/defense-of-europe/the-russian-military-forecasting-the-threat/.
[31] Christina Harward, Jakub Kostka, et al., “Russian Offensive Campaign Assessment, September 12, 2026,” Institute for the Study of War, September 12, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-12-2026/; https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-10-2026/Arielle Sher, Jacob Spencer, et al., “Russian Offensive Campaign Assessment, September 10, 2026,” Institute for the Study of War, September 10, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-september-10-2026/.
[32] Franz-Stefan Gady, X, January 28, 2026, https://x.com/HoansSolo/status/2016557540289421819?s=20.
[33] Dr Jack Watling and Nick Reynolds, “Tactical Developments During the Third Year of the Russo–Ukrainian War,” The Royal United Services Institute for Defence and Security Studies, February 14, 2025, https://www.rusi.org/explore-our-research/publications/special-resources/tactical-developments-during-third-year-russo-ukrainian-war.
[34] TASS, Telegram, October 18, 2024, https://t dot me/tass_agency/280212; Aleksey Zhuravlyov, Telegram, June 30, 2026, https://t dot me/DeputatZhuravlev/15766.
[35] Ann-Dorit Boy, Matthias Gebauer and Jan Puhl, [“Is the Kremlin now targeting Western politicians?,”] Der Spiegel, September 14, 2026, https://www.spiegel dot de/politik/deutschland/flughafen-leipzig-halle-alexander-dobrindt-und-johann-wadephul-aeussern-sich-a-f6727db6-b9ad-4c5b-9a05-9d414c673064;
Moritz Koch, Dietmar Neuer, et al. [“The German government sees Russia behind the drone attack,”] Handelsblatt, September 1, 2026, https://www.handelsblatt dot com/politik/deutschland/leipzig-bundesregierung-sieht-russland-hinter-drohnenangriff/100251085.html; Geir Moulson, “Germany blames Russia for last month’s attempted drone attack at Leipzig airport,” Associated Press, September 1, 2026, https://apnews.com/article/germany-leipzig-airport-explosives-drone-russia-fa3deebe59f81baadc821c743fb26814.
[36] TASS, Telegram, September 2, 2026, https://t dot me/tass_agency/393239; [“Lithuania will be targeted if it deploys nuclear weapons, Peskov said,”] Ria Novosti, September 11, 2026, https://ria dot ru/20260911/peskov-2116980664.html.
[37] https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-august-27-2026/Jakub Kostka, Tetiana Trach, et al., “Russian Offensive Campaign Assessment, August 27, 2026,” Institute for the Study of War, August 27, 2026, https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-august-27-2026/.
[38] [“NATO strategist: Russia must seek compromise or ‘Plan B,’”] Lithuanian National Radio and Television, June 14, 2026, https://www.lrt dot lt/naujienos/pasaulyje/6/2960062/nato-strategas-rusija-privalo-ieskoti-kompromiso-arba-plano-b; Anne-Sylvaine Chassany and Aysun Bora, “Russia ‘not looking for conflict’, says Nato’s top US commander,” Financial Times, June 11, 2026, https://www.ft.com/content/751d4555-9e8c-42a0-a37b-80893727776c?syn-25a6b1a6=1; “Can the Germans fight?,” The Economist, April 22, 2026, https://www.economist.com/europe/2026/04/22/can-the-germans-fight.
[39] Marek Strzelecki and Andrius Sytas, “Poland and Baltics shield infrastructure, fearing a Russian false-flag strike,” Reuters, August 10, 2026, https://www.reuters.com/world/europe/poland-baltics-shield-infrastructure-fearing-russian-false-flag-strike-2026-08-10/; Andrius Sytas, “NATO upgrades Baltic Air Policing mission to air defence,” Reuters, July 8, 2026, https://www.reuters.com/world/europe/nato-upgrades-baltic-air-policing-mission-air-defence-2026-07-08/; “NATO advances shift to robust Air Defence in AIRCOM-led training over Romania,” NATO Allied Air Command, September 3, 2026, https://ac.nato.int/archive/2026/nato-advances-shift-to-robust-air-defence-in-aircomled-training-over-romania.aspx; Ammar Anwer, “Poland preparing ‘very intensively’ for possible Russian provocation, PM says,” Polish Television World, July 3, 2026, https://tvpworld dot com/94161339/polands-tusk-says-poland-preparing-for-possible-russian-provocation.
