Denmark expects sabotage, doubts Russian invasion

Denmark's military intelligence service said on 24 September that it expects Russia to step up attacks below the threshold of war, such as sabotage and cyberattacks, against NATO and the West in the coming months (FE). It rates the risk of a limited Russian military strike on a NATO country as low but rising, and still judges a full invasion unlikely. For Europe, the danger in the months ahead is more frequent, deniable attacks on the services societies depend on, not tanks at the border.

What Denmark expects soon

The service, known by its Danish initials FE, calls this hybrid warfare. It means pressure through sabotage, cyberattacks, espionage and hired intermediaries rather than open military force. Danish reporting on the assessment describes operations becoming more frequent, including destructive cyberattacks on essential services (Politiken). These are scenarios in FE's forecast, not attacks already carried out.

Denmark's domestic security service, PET, has already seen preparation on Danish soil. On 5 September it reported Russian planning for sabotage against Danish defence companies and against links supporting Ukraine (PET).

PET also said it had no information on a specific target or timing. The warning is concrete about intent and silent on the next move.

A limited strike is a different gamble

A limited attack would be a localized use of force, not an attempt to seize territory. Reporting on FE's briefing gives one possible form: an isolated long-range strike on infrastructure that helps Ukraine (Reuters). Beyond the physical damage, such a strike would test whether NATO members answer together.

According to French reporting on the assessment, Moscow might take that risk if it believed NATO would not respond as one, and doubts about American support feed that calculation (Le Figaro). This is FE's reading of Russian incentives, not a disclosed plan. The service attaches no probability to "low but rising", and its public summary does not show the classified evidence behind the change.

An invasion sits at the far end of the scale. FE sees no signs that Russia is preparing one, and estimates that preparation would take at least six months and be hard to hide (RTÉ).

Countries closer to Russia draw the same line between sabotage and invasion. In February 2026, Estonia's foreign intelligence service judged that Russia had no intention of attacking a NATO member in the following year (EFIS). Latvia's president said he saw no troop buildup pointing to an invasion, while taking sabotage and a small special-forces incursion seriously (LSM).

What NATO would have to decide

NATO's founding treaty offers two routes. Article 4 lets an ally that feels threatened call consultations. Article 5 commits allies to collective assistance after an armed attack. The treaty does not automatically classify ambiguous events (North Atlantic Treaty).

A cut cable or an unclaimed drone strike falls into that gap. Allies would first have to agree on who was behind it before choosing a route. Secretary General Mark Rutte said on 24 September that NATO's responses to hybrid activity may stay out of public view and need not mirror the original act (NATO). Europeans may therefore see the sabotage without seeing the answer to it.

FE has changed an expert risk judgment. It has not revealed an attack plan. Its forecast puts hybrid escalation within months and reports no sign that Russia is preparing an invasion. If that assessment holds, the near-term work for European governments is defensive. They would need to protect the services and supply routes to Ukraine most exposed to sabotage, and, when an attack comes, agree quickly on who is responsible.