Danish Intelligence Warns of 'Low But Growing Risk' of Limited Russian Military Attack on NATO

On September 24, 2026, the Danish Defense Intelligence Service (FE) released a nine-page threat assessment outlining a specific shift in Moscow's strategic posture toward Europe. The agency concluded that the likelihood of Russia launching a "limited military attack" against one or more NATO countries is increasing, with such an event possible within the next six to twelve months.[1][4]

The assessment explicitly separates this scenario from a full-scale conventional invasion, which the FE notes Russia currently lacks the military capacity to execute while its forces remain committed to the 31-month-old war in Ukraine. Instead, the intelligence service describes a calculated operation designed "not to seize a country, but to split NATO."[4]

By initiating a localized kinetic strike—potentially targeting military infrastructure or border outposts along the alliance's 1,340-kilometer frontier with Russia—Moscow would aim to force a crisis over the Article 5 mutual defense clause. If the 32-member alliance disagrees on whether the limited damage warrants a unified military response, the resulting political paralysis would achieve Russia's primary objective of undermining the Western security umbrella.[1]

The Danish warning aligns with a broader pattern of escalating sub-threshold activity across the continent. The FE report forecasts that Russian hybrid attacks, including sabotage, cyber operations, and targeted disruptions of critical infrastructure, are "likely to increase in coming months."[5][7]

This assessment of hybrid escalation is corroborated by recent operational intelligence. The Institute for the Study of War noted on September 25 that Russian intelligence networks have been actively expanding their capacity to conduct sabotage operations within European borders, utilizing both state operatives and recruited local proxies to target defense logistics.[3]

NATO leadership has publicly acknowledged the Danish findings. A senior NATO commander backed the FE's assessment of the growing Russian threat, noting that the alliance is actively monitoring the shift in Moscow's risk calculus. The acknowledgment reflects a growing consensus among European defense ministries that the timeline for potential Russian aggression against NATO territory has compressed from previous estimates of three to five years down to a near-term window.[1][2][6]

The strategic logic behind a limited strike relies on exploiting the threshold between hybrid interference and conventional war. The FE analysis suggests that Russian military planners perceive a window of opportunity to test NATO's political resolve before the alliance can fully implement its new regional defense plans and integrate the expanded defense industrial capacity currently being built across member states.[2][4]

The Danish intelligence report serves as a formal indicator to allied governments that the security environment has transitioned from theoretical long-term planning to immediate operational readiness. The focus now shifts to how NATO's eight forward-deployed multinational battlegroups and political leadership will calibrate their deterrence posture to ensure that even a limited incursion carries an unacceptable cost for Moscow.[1][6]