When the director of the Central Intelligence Agency turns up in Moscow without warning, it is reasonable to assume the message was not cheerful. John Ratcliffe's unscheduled visit to the Russian capital in late summer 2026 generated immediate speculation across Western capitals, much of it linking the trip to Russia's intensifying campaign of sabotage, intimidation and covert aggression against European targets. Multiple reports subsequently suggested that Ratcliffe carried an explicit warning: do not test NATO directly.
The visit itself was unusual enough. CIA directors do not routinely travel to Moscow. That Ratcliffe did so, and did so without public explanation, pointed to a calculation in Washington that something needed communicating through intelligence channels that could not be said through diplomatic ones. What that something was, and how it was received, remains unknown. But the context surrounding the visit has only grown more troubling.
An intelligence warning with no expiry date
In early August 2026, a United States intelligence assessment concluded that Russia could potentially test NATO's resolve with some form of limited attack against an alliance member at any moment in the next few years. The phrasing was deliberately broad: not a prediction, not a specific threat, but a judgement that the possibility was real enough to warrant preparation. The assessment did not name a particular location or method. It did not need to. Russia has already provided ample evidence of its willingness to operate against European targets below the threshold of armed conflict.
Germany's announcement this week that Russia was behind the attempted bombing of Leipzig Airport brought the shadow war into sharp relief. If the German government's accusation is correct, a NATO member state suffered a direct Russian attack on its transport infrastructure. That this did not trigger an Article 5 consultation tells you something about how far the threshold for collective defence has been stretched, and how far European governments are willing to stretch it rather than confront what is happening.
The Leipzig incident is not isolated. Over the past two years, European intelligence agencies have documented a pattern of Russian-directed or Russian-inspired sabotage: arson attacks on warehouses, cyber intrusions into critical infrastructure, disinformation campaigns, and the harassment of dissidents on European soil. The Frontex risk analysis has noted the weaponisation of migration flows as an element of this pressure. What ties these operations together is their calibration: severe enough to disrupt and intimidate, but not so severe as to force a NATO military response.
Why dismissing the threat misunderstands the objective
A common response to warnings about a Russian attack on NATO is scepticism, and the scepticism is not irrational. The Russian military has spent more than four years grinding through eastern Ukraine at enormous cost in personnel and equipment. Its air force has not established air superiority over a country that lacked a modern air defence system at the start of the invasion. Its navy has lost flagship vessels to a country with almost no navy. The idea that this same military could take on the 32 members of the Atlantic Alliance, with their combined GDP roughly 25 times Russia's, appears faintly absurd.
But this analysis, while factually grounded, asks the wrong question. The question is not whether Russia could defeat NATO in a conventional war. It could not, and Vladimir Putin almost certainly knows this. The question is whether Russia could launch a limited, carefully calibrated attack designed not to win territory but to break the alliance's political cohesion. That is a different proposition entirely, and considerably more plausible.
Peter Dickinson, editor of the Atlantic Council's UkraineAlert service, has argued precisely this point: if Putin does decide to attack NATO, his goal will be to divide and discredit the alliance rather than defeat it. A small cross-border incursion, perhaps under the pretext of protecting ethnic Russians in a Baltic state or a Polish border region, would present NATO with a dilemma. Respond forcefully, and risk escalation. Fail to respond, and confirm that Article 5, the alliance's mutual defence guarantee, is a bluff. Either outcome serves Russian interests. The worst outcome for Moscow would be a rapid, unified alliance response, which is why Putin would calculate his provocation to make that response as politically difficult as possible.
Putin's reading of Western resolve
Any assessment of what Putin might do depends on how he reads Western politics. His record suggests he does not rate the likelihood of a firm collective response. Russia invaded Georgia in 2008. The Western response was condemnation and accommodation. Russia seized Crimea in 2014. The Western response was condemnation and limited sanctions that did not touch Russian energy exports. Russia launched a full-scale invasion of Ukraine in 2022. The Western response was more serious than Putin likely expected, but it stopped well short of direct military intervention and has been marked throughout by internal disagreements over the scale and speed of military aid.
From Putin's perspective, the pattern is clear: Western leaders protest loudly and act cautiously. He has no experience of a situation in which Western unity held so completely that it forced him to reverse course. That does not mean he is right about what would happen next time. It means he has reason to believe he might be.
The window Europe's rearmament gap opens
Europe's current defence posture adds to the risk. After decades of underinvestment, European governments are now rushing to rebuild military capabilities that were allowed to atrophy. The rearmament programmes are real, and they are substantial. But tanks, air defence systems, ammunition production lines and trained personnel cannot be conjured from nothing. The NATO alliance's collective defence planning recognises that capability gaps take years to close. Between the decision to rearm and the arrival of operational capability, there is a period of vulnerability. Russia is aware of this gap. It is reasonable to assume Russian planners have mapped it in detail.
The timing matters. European armies are weaker now than they will be in five years. Ammunition stockpiles have been depleted by transfers to Ukraine. Interoperability between European forces remains uneven. The United States, meanwhile, is preoccupied with Iran and with managing the fallout from its own domestic politics. The Trump administration's relationship with European capitals has been strained by disagreements over Middle East policy, trade, and burden-sharing within the alliance. Whether these disagreements would hold in a crisis is unknown, but Putin has every incentive to test the hypothesis that they would.
Grey zone operations as a proving ground
The sabotage campaign already underway across Europe serves multiple purposes. It disrupts logistics supporting Ukraine. It forces European governments to divert security resources. It tests what each target country will tolerate. And it generates data about Western responses that Russian planners can feed into any future decision about escalation.
The Leipzig Airport bombing attempt, if confirmed as a Russian operation, is a significant escalation within this grey zone. Infrastructure attacks inside Germany represent a different order of provocation than disinformation or the harassment of exiles. That Berlin chose to attribute the attack publicly, rather than handling it through intelligence channels alone, suggests a calculation that the incident had crossed a line that required a public response. What it does not suggest is that Germany, or any other European government, has decided how to respond to the next escalation.
What deterrence actually requires
The core problem for NATO is that deterrence requires credibility, and credibility requires the demonstrated willingness to act. For much of the alliance's history, credibility was maintained by the sheer scale of American military power in Europe. That power still exists, but the political assurance that it would be used has weakened. A presidential candidate who has questioned the value of NATO and the wisdom of defending allies who do not spend enough is now in the White House. European leaders cannot know with certainty how the United States would respond to a limited Russian provocation, and that uncertainty is itself a vulnerability.
The alliance's public statements about Article 5 remain unequivocal. An attack on one is an attack on all. But the practical question of what constitutes an attack, and what level of response an attack would trigger, is less settled than the rhetoric suggests. A squad of Russian soldiers crossing a border and occupying a village for 48 hours before withdrawing would not obviously meet the threshold for a full military mobilisation. A cyber attack that disabled a country's power grid might. The grey area in between is where the danger lies, and it is where Putin is most likely to operate.
People mentioned
Organisations
North Atlantic Treaty Organization · Central Intelligence Agency · Atlantic Council
