I read the Danish intelligence warning twice.

The first sentence was almost reassuring. Denmark’s Defence Intelligence Service, known as FE, still considers an outright Russian invasion of a NATO country unlikely. Then came the sentence that changed the meaning of the assessment. FE now sees a low but growing risk that Russia could carry out a limited military attack against a NATO country even while its war in Ukraine continues.

Those two judgments are not contradictory.

They describe two very different kinds of war.

From Karachi, thousands of kilometres from NATO’s eastern frontier, the distinction may look academic. It is not. Europe’s security architecture rests heavily on the assumption that an attack on one NATO member becomes a problem for all of them. Russia would not necessarily have to defeat that system militarily to damage it.

It might only have to make NATO governments disagree about what just happened and how they should respond.

That is what makes Denmark’s new assessment more important than the alarming headlines about a possible Russian “invasion.”

Denmark Is Warning About Something Smaller

On 24 September 2026, Denmark’s Defence Intelligence Service published an unclassified assessment of the threat from Russia.

Its conclusions were carefully separated.

FE expects Russia to intensify its hybrid campaign against NATO and the West in the coming months. It assesses a low but increasing risk of limited military attacks against a NATO country. An outright invasion remains unlikely, although Danish intelligence says it can no longer completely exclude that possibility.

That distinction matters.

According to Reuters’ reporting on the assessment, intelligence chief Thomas Ahrenkiel described possible limited attacks that could include isolated drone or missile strikes against infrastructure supporting Ukraine.

Another possibility would be a false-flag operation involving Ukrainian-made drones.

These are not scenarios involving Russian armoured divisions driving deep into Western Europe.

They are smaller, politically complicated operations.

And that may be precisely the point.

Ahrenkiel said the objective of such action could be to divide NATO rather than seize territory.

I find that distinction much more consequential than the word “invasion.”

An invasion is relatively easy to identify. Tanks cross a border. Territory is occupied. Governments know that a major military event has occurred.

A limited strike creates harder questions.

Who carried it out? Was it deliberate? Does it constitute an armed attack? Should NATO respond militarily? How far should that response go?

Those questions lead directly to Article 5.

What Article 5 Actually Says

Article 5 is often described in public discussion as if NATO possesses an automatic switch.

Attack one member and every other member immediately goes to war.

The treaty is more carefully written.

According to NATO’s official explanation of collective defence and Article 5, an armed attack against one member is considered an attack against them all. Every ally then has an obligation to assist the country that was attacked.

But NATO also explains an important qualification.

Each ally takes “such action as it deems necessary.”

That assistance can include armed force, but NATO explicitly says it does not necessarily have to.

This wording was deliberate. NATO’s historical account of the treaty negotiations shows that its drafters debated whether collective defence should create something closer to an automatic military commitment. They settled on language that left the form of each member’s response to its own judgment.

That does not make Article 5 weak.

It makes it politically dependent on alliance cohesion.

NATO has invoked Article 5 only once, after the September 11, 2001 terrorist attacks against the United States.

For more than seven decades, therefore, the power of Article 5 has depended largely on deterrence. An adversary is supposed to believe that attacking one NATO member risks confronting the combined power of the alliance.

The Danish assessment raises a disturbing strategic question.

What happens if an adversary tries to discover where the boundary lies?

A Missile Is Easier to Understand Than Ambiguity

Imagine an isolated drone strike against a railway facility moving military equipment to Ukraine.

Suppose investigators suspect Russia.

Moscow denies responsibility.

Perhaps evidence appears slowly. Perhaps the weapon contains Ukrainian components or has been deliberately configured to obscure attribution.

The physical damage might be limited.

The political damage could be much larger.

Governments would have to decide whether the incident constituted an armed attack. Intelligence agencies would compare evidence. Political leaders would calculate the risks of escalation.

Public opinion would enter the discussion.

A limited operation could therefore impose a decision on NATO without requiring Russia to launch a conventional war.

This is why attribution matters so much in hybrid conflict.

Denmark’s domestic security service, PET, says hybrid measures can combine political, information, military and economic methods. They can be used to pressure governments, divide populations and undermine trust in institutions.

Physical sabotage fits inside that spectrum.

And Denmark is already worried about it.

Denmark’s Warning Did Not Appear From Nowhere

Earlier this month, PET disclosed that it had observed what it described as concrete Russian planning and preparation for sabotage directed at Denmark.

The agency said the activity primarily concerned defence companies and businesses connected with military support for Ukraine.

There is an important qualification.

PET did not say that it knew of an imminent attack at a particular place or time. Its statement specifically warned against making that inference.

That qualification matters because intelligence assessments are easily converted into headlines predicting events that the intelligence service itself has not predicted.

PET went further on 24 September after FE released its new assessment. It said Russia’s increased willingness to accept risk could raise the threat of influence operations, espionage and sabotage in Denmark. Potential targets could expand to critical infrastructure and other essential social functions if Russia intensifies its hybrid campaign.

So there are two overlapping security problems.

One concerns military deterrence at NATO’s borders.

The other is already inside European societies: cyber operations, suspected sabotage, intelligence activity and pressure against infrastructure supporting Ukraine.

The boundary between them may become increasingly uncomfortable.

The Baltic Region Makes the Problem Concrete

Look at the map.

Russia shares borders with several NATO countries, including Finland, Norway, Estonia and Latvia. Lithuania and Poland border Russia through the Kaliningrad exclave.

The Baltic region contains exactly the kind of infrastructure that becomes strategically important during confrontation.

Lithuania is already building additional physical protection into a major electricity substation planned near Kaliningrad. Reuters reported that the facility will include measures designed to resist sabotage and explosive drones. The project sits in the strategically sensitive area around the Suwałki Gap linking Poland and Lithuania.

Its designers are thinking differently now.

Infrastructure once designed mainly against accidents and natural hazards increasingly has to consider deliberate attack.

That tells us something about how European security has changed since Russia launched its full-scale invasion of Ukraine in February 2022.

The front line is no longer understood purely as a trench or national border.

A railway can become strategically important.

So can an electricity substation.

The same applies to communications systems and defence factories.

Hybrid Pressure Can Prepare the Political Ground

The term “hybrid warfare” sometimes becomes so broad that it loses analytical value. Almost every hostile act short of conventional war gets pushed into the category.

The Danish assessment is more useful when read as an escalation ladder.

At the lower end, influence operations or cyber activity can create disruption without conventional military engagement.

Sabotage raises the physical stakes.

A limited military strike moves higher again.

An outright invasion sits much further up the ladder.

The important point is that an adversary does not necessarily have to jump directly from peace to invasion.

It can move between levels.

France is confronting similar concerns. President Emmanuel Macron said on 18 September that the Russian hybrid threat facing France and other European states had intensified. He ordered his government to prepare additional measures to protect critical infrastructure from drone and cyber threats. Russia rejects European accusations that it conducts such hybrid attacks.

That Russian denial belongs in the discussion.

Moscow has repeatedly rejected allegations that it is conducting sabotage operations across NATO countries or preparing a confrontation with the alliance. Russia’s embassy in Denmark also rejected the Danish assessment, accusing Western governments of increasing tensions surrounding Ukraine.

Intelligence assessments are assessments, not proof that a particular future operation has been ordered.

That distinction should remain visible.

The Real Test Would Be Political

Military alliances are made from aircraft, soldiers and weapons.

They are also made from promises.

Article 5 works because potential adversaries are expected to believe that NATO members will honour the collective-defence commitment when it matters.

A deliberately limited attack would create a peculiar strategic problem.

If it were too large, it could unite NATO.

If it remained sufficiently limited or ambiguous, however, it could force governments to debate attribution and proportionality before deciding how to respond.

That debate would not automatically mean NATO had failed. Consultation is built into alliance decision-making, and Article 5 deliberately permits allies to determine what assistance they consider necessary.

But uncertainty itself can become strategically useful to an adversary.

Denmark’s intelligence service appears concerned about precisely that possibility. Reuters reports that FE sees a risk if Russia concludes NATO countries would not respond collectively, particularly if Moscow believes the United States could not or would not support European allies in a confrontation.

The credibility of deterrence therefore rests on more than weapons.

It rests on Moscow’s expectations about political behaviour inside NATO.

“Coming Months” Does Not Mean an Attack Is Coming

One phrase in the Danish assessment needs special care.

FE says a limited military attack, like intensified hybrid operations, could potentially occur in the coming months.

That is not a prediction that Russia will attack NATO within months.

The agency simultaneously describes the probability of such a military attack as low, although growing.

Both parts of the assessment must remain together.

Remove “low risk” and the story becomes alarmist.

Remove “coming months” and the warning loses some of its urgency.

The same caution applies to an outright invasion. FE says it sees no indication that Russia is currently preparing one. A major force buildup would require months of preparation and would be difficult to conceal.

Denmark also does not expect a conventional Russian attack against Danish territory.

The intelligence warning is therefore narrower than some headlines suggest.

Yet narrow does not mean insignificant.

NATO’s Hardest Question May Arrive in a Small Package

When I first read the Danish warning, the word “invasion” caught my attention.

After reading the assessment more closely, it became the least interesting part.

A Russian invasion of NATO territory would create an enormous military crisis, but relatively little uncertainty about the nature of the event.

The more difficult scenario is smaller.

One drone. One missile strike. A short incursion. An act whose attribution is deliberately obscured.

Then twenty or more governments begin examining the same evidence through different political systems and different perceptions of risk.

Article 5 would still exist.

The question would be how the allies applied it.

That is why Denmark’s warning deserves attention without exaggeration. FE is not telling Europeans that Russian tanks are about to cross NATO borders. It is describing a security environment in which Moscow may become more willing to accept risk and in which hybrid operations could move closer to limited military action.

The distinction is uncomfortable.

It is also the point.

Russia would not necessarily need to invade NATO to test the alliance.

It would need to create an incident serious enough to demand a response, yet ambiguous enough to make NATO governments argue about what that response should be.

For an alliance built on collective defence, the argument itself could become part of the battlefield.