On 23 September, a Russian Mi-8 helicopter flying from Kaliningrad crossed into Polish airspace north of the town of Braniewo, penetrated roughly 300 metres and stayed for 42 seconds before turning back. Polish fighter jets were scrambled, ground-based air defences went on standby, and Poland’s Operational Command concluded that Russia was once again testing the readiness of its air defences. By any measurable standard, it was a non-event. No shots were fired, nothing was damaged and nobody was hurt. That is exactly why it matters.

Twelve days later, the head of Germany’s foreign intelligence service told the Bundestag that Russia is waging a “shadow war” against Germany. Within days, the Atlantic Council published a report arguing that years of reinforcing NATO’s eastern flank have done little to discourage Russian sabotage, cyberattacks and drone incursions. The convergence is notable. European intelligence services, the EU’s defence commissioner and a leading Washington think tank are now describing the same problem in almost identical terms. NATO has become very good at deterring a war Russia is not currently trying to fight, and remains poorly equipped for the one it is fighting.

A conflict without a threshold

Hybrid warfare is not a new concept, and neither is the vocabulary used to describe it. What has changed is its texture. A US Helsinki Commission study grouped Russian operations inside NATO territory into four categories: attacks on critical infrastructure, violence campaigns, weaponised migration, and election interference and information operations. The Atlantic Council’s Agnia Grigas adds a more troubling observation: these operations increasingly carry a kinetic component and are persistent rather than episodic, forming a continuous pressure campaign rather than a series of isolated provocations.

Poland’s recent months illustrate the pattern. In July, a Russian Kh-101 cruise missile entered Polish airspace and came down in a field in the east of the country. On 15 September, an unidentified drone approached the US ballistic missile defence base at Redzikowo. Two days later, Prime Minister Donald Tusk warned of a real risk that drones or missiles could fly into eastern-flank states and cause destruction. Then came the helicopter, which appears to be the first publicly reported case of a Russian military helicopter crossing Poland’s land border. In Germany, the intelligence chief Martin Jäger pointed to an attempted Russian drone attack on Leipzig airport on 31 July.

None of these incidents, taken individually, comes close to triggering Article 5. That is the design. Each is calibrated to sit beneath the threshold at which collective defence is invoked, while remaining visible enough to probe defences, signal intent and impose costs: scrambled jets, closed airspace, diverted resources and political anxiety. The cumulative effect is to normalise a higher baseline of risk. What would have been a crisis in 2021 is a routine Wednesday in 2026.

Moscow rejects this characterisation entirely. Its embassy has insisted that Russia poses no threat to NATO and has no intention of confronting it. Attribution in individual cases is sometimes contested, and analysts should resist folding every incident into a single narrative. But German, Danish and Polish authorities have assessed the pattern independently, and their conclusions are consistent enough that the burden of explanation has shifted.

Built for the wrong war

NATO’s conventional posture has been transformed since 2022. Defence budgets have risen, eastern-flank battlegroups have expanded, and Poland is building a network of bunkers, barriers, sensors and potential minefields along its borders with Belarus and Kaliningrad, with similar work under way in Estonia, Latvia and Lithuania. The Atlantic Council estimates that Russia maintains around 40,000 ground troops in the wider Baltic region, a figure it believes could be raised to roughly 100,000 by shifting forces from western Russia.

That investment is not wasted. A credible conventional defence is the reason a large-scale invasion remains unlikely, and Jäger himself said the BND sees no signs that Russia is preparing one. But this is where the asymmetry lies. Deterring conventional formations is now well resourced; countering persistent grey-zone pressure remains fragmented. The alliance’s decision-making is built around a binary, attack or no attack, with Article 5 as the hinge. Russia’s strategy is to operate permanently in the space between.

There is an uncomfortable irony here. The more credible NATO’s conventional deterrence becomes, the more rational it is for Moscow to shift pressure downward, into the domain where acting is cheapest and punishment is hardest. Success on one rung of the escalation ladder pushes the contest onto another.

The case for making Moscow pay, and why it is harder than it sounds

Grigas’s prescription is straightforward. Allies must persuade the Kremlin that hostile action carries predictable, material costs, using a pre-agreed menu of options: targeted sanctions, restrictions on Russian and Belarusian travel, trade and transit, large-scale diplomatic expulsions and cyber operations. Future drone incursions, attempted assassinations and sabotage, she argues, should prompt responses that are proportionate, coordinated and pre-agreed rather than mere condemnation. The EU’s defence commissioner, Andrius Kubilius, has said answers to hybrid attacks should be as painful as the attacks themselves. Kurt Volker, a former US ambassador to NATO, has asked openly where the line is that Russia would have to cross to provoke a response.

The argument has obvious appeal. Predictability is the core of deterrence, and Russia arguably exploits ambiguity in NATO’s responses more than ambiguity in its own actions. Yet the proposal runs into three problems that its advocates tend to understate.

The first is attribution. Hybrid operations are built for deniability, and Jäger has warned that Moscow may use false-flag operations designed to conceal the real perpetrator and complicate the response. An automatic response requires an agreed standard of proof, and 32 governments with different intelligence capacities and risk tolerances will not easily converge on one. A mechanism that fires on contested attribution hands Moscow a propaganda victory. One that waits for certainty is not automatic.

The second is consensus. The costs of retaliation fall unevenly. Restricting transit to Kaliningrad is borne disproportionately by Lithuania; measures against Belarus land hardest on Poland and Latvia. A menu agreed in Brussels must be executed in capitals with very different exposures, and some governments in both NATO and the EU have repeatedly shown reluctance to sign up to new measures against Russia.

The third is escalation. Part of the logic of the grey zone is that it allows both sides to avoid a war neither wants. A published schedule of penalties raises the cost of provocation, but it also hands initiative to whoever defines the triggers, and gives Moscow a map of exactly where to operate just beneath them. NATO Secretary-General Mark Rutte’s insistence that the alliance has response options that are not always public and not always tit for tat is often read as complacency. It can equally be read as a judgement that strategic ambiguity is itself a deterrent. That position deserves more serious engagement than its critics usually give it.

Germany moves to the front line

The most significant shift in this week’s debate is geographic. For years, “front line” in European security discourse meant the Baltic states, Poland and Romania. Jäger’s testimony relocated it. He said that no other country poses such a direct, comprehensive and concrete threat to Germany than Russia, which he argued is imposing the confrontation on Berlin because of its support for Ukraine and the Baltic states. He also warned that it would be a great illusion to assume the conflict with Russia will end when the war in Ukraine does.

That last point is the analytical core of the issue. If the shadow war is not a by-product of the war in Ukraine but a durable feature of Russian–European relations, then treating it as a crisis to be managed until a ceasefire is a category error. It becomes a permanent condition to be governed, through infrastructure resilience, investigative and prosecutorial capacity, intelligence sharing and the political willingness to name perpetrators publicly. European authorities are growing bolder in publicly identifying the states and organisations they hold responsible, which is a necessary first step.

It also raises an institutional question that the debate tends to skip: who owns this problem? Much of what Russia targets, including airports, rail networks, energy grids, undersea cables and elections, falls within national law enforcement and EU competences rather than NATO’s military remit. The alliance can deter armoured divisions; it cannot investigate a sabotage cell in Leipzig. The EU holds the regulatory, sanctions and legal tools, while NATO holds the military signalling. The deterrence gap persists partly because neither institution fully owns it.

What closing the gap would actually require

A credible response is less likely to come from a single new doctrine than from tightening the seams between existing ones. That means a shared attribution framework that allows faster, coordinated public attribution; sanctions packages drafted in advance and held in reserve, so that speed does not depend on fresh negotiation among 27 or 32 governments; infrastructure resilience treated as a core component of defence spending rather than an afterthought; and a clearer division of labour between NATO and the EU on hybrid threats.

None of this is as dramatic as “making Moscow pay”, and none of it will end the campaign. The realistic objective is not to stop hybrid operations altogether, which no deterrence posture has ever achieved against a determined state, but to raise their cost and lower their yield until they stop being a cheap substitute for war.

Conclusion

The 42-second flight over Braniewo will not be remembered, and that is precisely its function. The shadow war works by being individually forgettable and collectively corrosive: each incident too small to justify a response, the sum too large to ignore. NATO’s challenge is not a lack of capabilities. It is that its decision-making architecture was designed for a moment of rupture, and Russia has chosen to deny it one. Until the alliance and the EU build the political machinery to respond to persistence rather than only to rupture, Europe will remain well defended against the war it fears, and exposed to the one already under way.