The timeline of a Russian war against NATO, according to Danish intelligence

The security situation has deteriorated further. Russia has stepped up its use of sabotage and destructive cyber-attacks and is targeting sites in Europe with drones. Hybrid warfare is escalating. A telling example is the foiled drone attack on Leipzig-Halle Airport: according to the German authorities, it had been planned by Russia over a period of several months. Moscow has become more willing to take risks. Russian drones and, in some cases, even missiles have struck NATO countries bordering Ukraine. In Denmark, the Security and Intelligence Service (DDIS) has publicly warned that Russia is planning and preparing acts of sabotage on Danish soil against defence companies. Russian forces are behaving increasingly aggressively towards NATO military units in the Baltic Sea region. The incident on 14 September 2026, when a Russian frigate in the waters off Gedser fired signal flares at a Danish military helicopter, is the most recent and most serious of its kind involving Danish military units.

Russia is under greater pressure than at any other point in the war against Ukraine. The long-range attacks carried out continuously by Ukraine are causing increasingly widespread damage deep within Russian territory. Moscow is suffering heavy losses in the face of marginal territorial gains in Ukraine. At the same time, the Russian economy is on the brink of a serious crisis, driven by military spending, international sanctions and Ukrainian attacks on Russian energy infrastructure. Western economic and military support for Ukraine is essential if the country is to contain Russian forces and increase the cost to Russia of continuing the war.

Over the next six months, there is no prospect of Russia achieving any significant breakthroughs in the war against Ukraine. At the same time, it is highly unlikely that Russian President Vladimir Putin will be willing to compromise on the fundamental objectives of the conflict. Meanwhile, Moscow believes that Europe will gradually develop an autonomous military capability which, by 2030, will pose a growing threat to Russia. For Moscow, therefore, the coming years represent a window of opportunity, during which Putin might conclude that it is worth taking the risk of radically altering the European security order. Consequently, it is likely that Putin will seek to alter the current trajectory.

Until recently, Russian hybrid attacks against Western targets were primarily aimed at sowing fear and undermining public support for aid to Ukraine. Increasingly, however, Moscow is seeking to directly prevent aid from reaching Kyiv, for example through acts of sabotage against defence companies or against the rail transport of military equipment destined for Ukraine. The DDIS assesses that Russia will intensify its hybrid warfare, with more frequent attacks against the West and NATO and with more serious consequences for the affected countries than in the past. This could include destructive cyber-attacks capable of paralysing essential functions of society, as well as acts of sabotage carrying a high risk of casualties.

At the same time, there is a low but growing risk that Russia might launch a limited military attack against one or more NATO countries bordering its territory. This could happen even if Russia continues the war in Ukraine and has not built up the military capabilities necessary for a regional war. A limited military attack would be a desperate move on Moscow’s part and, like the escalation of hybrid attacks, could occur as early as the coming months. The aim would be to divert European resources away from support for Ukraine and to sow division within NATO, should the Alliance fail to agree on a collective response.

An attack of this kind could consist of isolated strikes, using long-range weapons, against infrastructure vital to supporting Ukraine. In such a case, Russia might claim that the weapons struck NATO territory solely because they had been disrupted by Ukrainian jamming systems. It could also be a false-flag operation, in which Russia uses Ukrainian-made drones to attack a NATO country. Russia could also deploy a limited number of military forces, perhaps without national insignia, in neighbouring NATO countries. Before such a deployment, however, it would most likely build up regular forces near the border in order to be able to counter any NATO response. Such a build-up of forces would require several months of preparation and would be difficult to conceal.

The DDIS continues to see no evidence that Russia intends to launch a full-scale invasion of one or more NATO countries. Even if it were to decide to invade a NATO country, Russia would in all likelihood need at least six months to prepare and deploy the necessary forces. Although a Russian invasion is highly unlikely, it cannot be ruled out. It is likely that Russia will carry out military attacks only if it believes they will not trigger a war due to a collective military response from NATO. However, Moscow is probably uncertain as to what might trigger such a war. There is therefore a risk that it may assess that NATO countries will not react collectively, particularly if it believes that the United States is unable or unwilling to support European NATO countries in a potential war against Russia.

On 9 February 2025, the DDIS published an assessment of the threat posed by Russia to the Kingdom of Denmark, which expanded on some of the analyses of the Russian threat contained in the Intelligence Outlook 2024. In that February 2025 assessment, the DDIS estimated when Russia might be ready for various types of war. The timeframes indicated depended on whether the war in Ukraine ended or turned into a frozen conflict; on whether Russia’s conventional military capabilities continued to grow whilst the West failed to strengthen its own at the same rate; and on whether Russia believed that the United States was unable or unwilling to support European NATO countries in a potential war against Moscow.

Within approximately six months, Russia will be capable of waging a local war in a neighbouring country. Within approximately two years, Russia will pose a credible threat to one or more NATO countries and will therefore be ready for a regional war against several countries in the Baltic Sea region. Within approximately five years, Russia will be ready for a large-scale war on the European continent. The timeframes indicated remain valid for the three types of war mentioned. However, this updated assessment concerns Russia’s willingness and capability to escalate the conflict with the West in the coming months, either through more frequent and more serious hybrid attacks or through limited military attacks against one or more NATO countries bordering Russia. Moscow could do so even if the war in Ukraine continues and Russia is not ready for a regional or full-scale war against NATO.