When the director of the Central Intelligence Agency flies unannounced into Moscow, the comparison that springs to mind is uncomfortable. In January 2022, then-CIA chief Bill Burns made a similar trip to deliver a private warning about the consequences of invading Ukraine. Russia invaded anyway, five weeks later. On 25 August, John Ratcliffe arrived in the Russian capital. One reported purpose: to caution Moscow against attacking NATO members. The visit has sharpened an anxiety that was already circulating through European capitals, that Russia's war might not stay contained within Ukraine's borders.
The concern is not abstract. For more than two years, countries on NATO's eastern edge have been absorbing what officials describe as hybrid warfare: sabotage, cyberattacks, disinformation, GPS jamming, and airspace violations. The question preoccupying defence planners is whether these operations remain below a threshold, or whether they are shaping preparations for something more direct. Analysts at the Atlantic Council have mapped the vulnerabilities across the alliance's front line. Their assessment, published in late August, makes for sobering reading.
The hybrid campaign already underway
Russia has not waited for a formal decision to escalate. It has been probing NATO's edges continuously, testing how far it can push before triggering a decisive response. In the Baltic states, the catalogue includes drone incursions, infrastructure sabotage, arson, assassination plots and electronic warfare. GPS jamming and spoofing has become so routine that it disrupted ambulance navigation in Kalmar County, Sweden, and on the island of Gotland. Finland closed its eastern border after Moscow instrumentalised migration flows, a tactic familiar from 2021 when Belarus pushed migrants towards Poland.
Poland has experienced some of the most serious incidents. In September 2025, nineteen Russian-manufactured drones entered Polish airspace. Most analysts interpret this as a deliberate test of Polish air defences. In June this year, a Russian-armed cruise missile crashed in eastern Poland. Polish prosecutors concluded that the 2024 arson attack on a Warsaw shopping mall was commissioned by Russian intelligence. The Warsaw-to-Lublin railway was sabotaged in November 2025. Poland's defence minister, Władysław Kosiniak-Kamysz, has warned publicly that as relations between Warsaw and Kyiv deteriorate, Russia could deploy captured Ukrainian drones in false-flag operations designed to provoke or confuse.
Romania, which shares a border with Ukraine and a coastline on the Black Sea, has recorded airspace violations on what President Nicușor Dan describes as dozens of occasions. In August, Romanian forces destroyed an explosive-laden maritime drone operating near the Neptun Deep offshore gas project, operated by OMV Petrom and Romgaz. Naval mines have drifted close to Constanța, the country's largest port. The Black Sea is becoming what several analysts now call a critical battlespace, one where Russia can harass shipping and infrastructure without clearly crossing the line into armed attack on alliance territory.
The Baltics: where the border is thinnest
Lithuania, Latvia and Estonia have lived with Russian pressure since regaining independence. Their assessment now is that Moscow is systematically identifying seams in national and allied defences, looking for gaps it can exploit. Justina Budginaite-Froehly, a nonresident senior fellow at the Atlantic Council, argues that Russia will keep pushing until it faces costs it considers credible. A Russia materially consumed by its war in Ukraine is not necessarily less dangerous; it may be more willing to bring the conflict closer to Ukraine's staunchest supporters, in the hope of fracturing the coalition supplying Kyiv.
The three Baltic states are strengthening national defences and pressing NATO to treat repeated sub-threshold attacks as elements of a coherent strategy rather than isolated incidents. A recent NATO manoeuvre focused on Kaliningrad, Russia's heavily militarised exclave between Poland and Lithuania, was useful as signalling. But ad hoc demonstrations of readiness are not the same as everyday consistency. The Baltics want a stronger allied forward presence, underpinned by US military deployments that some in Washington have been reluctant to sustain.
The strategic calculation for Moscow would be straightforward: a successful test of NATO's commitment in the Baltics would damage the credibility of American-led alliances far beyond Europe. The target of any Russian escalation in the region would be the alliance itself, specifically the promise that an attack on one member is an attack on all.
Poland builds for the first phase alone
Poland is no longer the lightly armed eastern flank state that would wait for NATO to arrive. Defence spending stands at 4.8 per cent of GDP, the highest ratio in the alliance. Warsaw has ordered Abrams and K2 tanks, HIMARS and Chunmoo rocket artillery, Apache attack helicopters, F-16 and F-35 aircraft, and is expanding drone capabilities and artillery formations at speed. The Eastern Shield programme is fortifying the border with Belarus and the Russian exclave of Kaliningrad.
The logic is clear: Poland aims to hold the line in the opening phase of a conflict without waiting for reinforcement. But as Aaron Korewa, director of the Atlantic Council's Warsaw office, notes, the Polish armed forces remain a work in progress. They are well equipped but not battle-tested. A sustained confrontation would require NATO reinforcement, particularly in air defence. The multinational battlegroup stationed in Poland can expand to brigade strength. Roughly ten thousand American soldiers are based in the country. Poland's strategy ultimately rests on ensuring that any Russian attack immediately becomes a war with the entire alliance.
The Nordics close ranks
Finland and Sweden's accession to NATO has fundamentally altered the geometry of northern European security. All five Nordic countries are now allies, and their defence planning is embedded in NATO's operational structures. A new Combined Air Operations Centre in Bodø, Norway, is designed to let Nordic air forces operate across borders while remaining integrated into alliance command. Sweden serves as the framework nation for Forward Land Forces Finland, a deployment hosted by Finland that guards the North Calotte, the northern region spanning parts of Sweden, Finland and Norway that sits close to Russia's Kola Peninsula and its strategic naval bases.
Anna Wieslander, the Atlantic Council's director for Northern Europe, points to several potential Russian targets in the region. The Baltic Sea islands of Gotland, Åland and Bornholm matter because controlling any of them would allow Moscow to extend its air-defence reach and constrain allied movement. Svalbard, in the Barents Sea, presents a different problem: its remoteness, its proximity to Kola, and its ambiguous treaty regime make it vulnerable to coercive pressure on Norwegian sovereignty. In an early phase of conflict, Russia would have an interest in expanding its anti-access and area-denial capacity across the north, potentially complicating NATO's ability to receive and distribute reinforcements through Norwegian ports and Swedish bases.
Nordic defence spending in 2025 ranges from 2.5 to 3.34 per cent of GDP, excluding Iceland, which has no standing army. The region also leads in support to Ukraine as a proportion of GDP, something Nordic governments frame as an investment in their own security.
Moldova and the Black Sea: outside the alliance umbrella
Moldova occupies the most exposed position of any state on NATO's periphery. It is not a member of the alliance or the European Union, though it remains on the EU accession path alongside Ukraine. Russia maintains a military presence in Transnistria, the breakaway region on Moldova's eastern border. Moscow has funded interference in Moldovan elections, weaponised energy supplies, and directed disinformation campaigns aimed at derailing the country's European trajectory. Despite these efforts, Moldovan voters have twice backed a pro-European direction in national elections and a constitutional referendum on EU membership.
The immediate worry is kinetic spillover from Ukraine. Russian drones have repeatedly violated Moldovan airspace, and Russian strikes have targeted Ukrainian-Moldovan border infrastructure. Defence minister Anatolie Nosatîi said in August that Moldova needs high-performance systems to detect and protect against these incursions. The Moldovan military remains limited, leaving the country vulnerable to a conventional attack it could not repel alone. Chișinău has responded by deepening security cooperation with Ukraine and Romania, including a recent trilateral arrangement covering drone threats, energy and transport infrastructure.
For Romania, Moldova's stability is a vital interest. But Bucharest has its own escalating problems. George Scutaru, chief executive of the New Strategy Centre in Bucharest, argues that Russia is testing NATO's speed of response on the eastern flank. The Romanian analyst Armand Goșu describes the drone incursions as probes designed to reveal Romania's military capabilities in countering them. The most plausible Russian escalation, in the assessment of several analysts, would not begin with an armoured invasion. It would intensify attacks below the threshold of open war: repeated airspace incursions, maritime drones and mines threatening Constanța and Black Sea shipping, sabotage of infrastructure on the continental shelf outside formally defined NATO territory, and information operations designed to erode confidence in collective defence.
Romania is expanding Mihail Kogălniceanu Air Base and building a military logistics network connecting Câmpia Turzii, Cincu, Smârdan, Babadag, Constanța and the Danube corridor. Its forces are anchored in American systems: Patriot air defence, HIMARS, F-16s, Abrams tanks, with F-35s planned. Bucharest could respond initially with national capabilities and the US and NATO assets already in country. But a sustained attack would require reinforcement. The question, as several Romanian analysts frame it, is whether Moscow can create a limited crisis faster than NATO can mobilise a collective response.
The credibility gap
What connects all these fronts is a question about political will. Russia's hybrid operations are calibrated to fall below the threshold that would trigger an Article 5 response. Individually, a drone crossing a border or a GPS disruption affecting civilian aviation can be dismissed as an incident. Collectively, they amount to a sustained campaign. The alliance has no agreed mechanism for accumulating these violations into a casus foederis. Each member state interprets its obligations somewhat differently, and Moscow is adept at exploiting those differences.
The Baltic states have argued for years that NATO must treat sub-threshold attacks as part of a deliberate strategy. The Nordics, now fully integrated into alliance planning, are building the kind of total defence structures that assume society itself is the battlefield. Poland is arming at a pace that suggests it does not entirely trust the alliance to arrive in time. Romania is fortifying its Black Sea coast and expanding bases that could serve as logistics hubs for rapid reinforcement. These are rational responses to an uncertain security environment, but they also reveal an underlying anxiety: that the political commitment to collective defence may not match the military planning.
Ratcliffe's flight to Moscow was intended to reduce that uncertainty by drawing a line. Whether the message landed depends on what Moscow does next, and on whether NATO's daily posture, not just its ad hoc exercises, backs up the rhetoric with credible, sustained deterrence. NATO's enhanced forward presence in the east remains the most visible expression of that commitment. The question is whether it is sufficient to close the gaps that Russia is already mapping.
People mentioned
-
Władysław Kosiniak-Kamysz
-
Anatolie Nosatîi
-
George Scutaru
Organisations
Central Intelligence Agency · North Atlantic Treaty Organization · Atlantic Council · New Strategy Center
