European security officials are increasingly focused on the likelihood of hybrid attacks from Russia, rather than a large-scale conventional military invasion, even as NATO members bolster defense spending. This assessment comes amid continued Russian probing of NATO airspace and a broader pattern of destabilizing activity, according to recent analyses.
While a full-scale Russian offensive remains a concern, experts suggest that Moscow, weakened by its ongoing war in Ukraine, is more likely to employ subversive tactics targeting critical infrastructure and societal cohesion. Professor Tormod Heier of the Norwegian Defence College believes that Norway and Europe are “rusting themselves for the wrong war,” prioritizing military build-up over preparing for more insidious threats. Heier suggests that the most probable form of attack against Europe will be hybrid sabotage actions.
These hybrid threats include potential attacks on undersea cables, disruption of power grids, and sabotage of oil installations. Equally concerning are influence operations designed to polarize societies and erode trust in institutions. According to Heier, these types of threats are best handled by police forces, but currently, those forces are “not at all equipped for crisis management below the threshold of war.”
The shift in focus comes after a series of Russian incursions into NATO airspace in September and October 2025. These incidents, which involved brushes with Estonian borders, brief crossings into Romanian and Polish airspace, were viewed by many European capitals as deliberate probes to test NATO’s resolve after nearly four years of conflict in Ukraine.
Despite the diminished capacity of the Russian military following its involvement in Ukraine, the potential for disruption remains significant. A report from the European Council on Foreign Relations indicates that Russia’s fighting power has been reduced, and it currently lacks the capabilities to mount a successful traditional military offensive or a hybrid attack. However, the recent airspace incursions demonstrate a continued willingness to challenge NATO’s defenses.
NATO Secretary General Jens Stoltenberg acknowledged in December 2024 that while there is no imminent military threat to the alliance’s 32 member states, NATO is undergoing a transformation to ensure its continued safety. Defense spending has increased across the alliance, but some officials argue that the focus needs to be refined to address the evolving nature of the threat.
Norway’s Defence Chief, Eirik Kristoffersen, partially agrees with Heier’s assessment, stating that many of these threats fall outside the traditional purview of the military. “Our task is primarily to defend against military attacks in Norway, to secure Norwegian freedom and territorial integrity,” Kristoffersen told NRK. He emphasized that these threats require a response from other agencies and authorities.
The assessment of the threat landscape also comes as European governments increasingly refer to Russian actions as “hybrid warfare” or “hybrid threats.” This characterization reflects the blurring lines between traditional military tactics and more subtle forms of aggression, including cyberattacks, disinformation campaigns, and economic coercion.
Estonia, a small, post-Soviet nation with a Russian-speaking minority and a direct border with Russia, is often cited as a potential target for Russian aggression. However, the country has developed a three-pronged defense concept based on traditional artillery, air defense, and a well-drilled societal response. European NATO members, including Estonia’s neighbors, are also in a stronger position to assist Estonia against potential aggression.
Despite these improvements, officials warn that it will take Russia approximately 5-10 years to fully refit and rearm after the conclusion of the war in Ukraine. This timeframe underscores the need for continued vigilance and investment in defense capabilities, even with limited assistance from the United States. The need for increased spending was reiterated by Stoltenberg in December 2024, stating that increased investment is necessary “to prevent war.”
The focus on hybrid threats extends beyond the Baltic region. A recent study highlighted the vulnerability of the Norwegian petroleum sector to hybrid attacks, emphasizing the need for enhanced security measures to protect critical energy infrastructure. This underscores the broader European concern that Russia may seek to exploit vulnerabilities in key economic sectors to exert pressure and destabilize governments.
Lithuania’s Interior Minister, Agnė Bilotaitė, has also voiced concerns about hybrid threats, highlighting the need for coordinated efforts to counter Russian influence operations. The evolving threat landscape demands a comprehensive approach that integrates military, intelligence, law enforcement, and cybersecurity capabilities.
As of , the situation remains fluid, and European governments are actively working to adapt their defense strategies to address the evolving threat posed by Russia. The emphasis on hybrid threats reflects a growing recognition that the future of conflict may be less about traditional battles and more about subtle, insidious forms of aggression designed to undermine stability and erode trust.
