Denmark

Denmark's spy agency now says a limited Russian attack on NATO is a low but rising risk

Baltic Security Monitor | Material Update
24 September 2026 · verification cutoff 24 September 2026, 17:02 UTC

---

Denmark's Defence Intelligence Service (FE/DDIS) published a new unclassified Russia assessment on 24 September, adding a position it did not previously hold: a low but growing risk that Russia could carry out a limited military attack against one or more NATO countries bordering Russia while the war in Ukraine continues. FE still calls a full-scale invasion of NATO territory "highly unlikely," but says it can no longer be ruled out.

---

What happened

FE chief Thomas Ahrenkiel presented the assessment at a press conference on 24 September, saying: "There is a low but growing risk that Russia will launch a limited military attack against one or several NATO countries bordering Russia." He described any such move as "a desperate move" that would need at least six months of preparation, and stressed force build-ups of that kind are difficult to conceal. On invasion, Ahrenkiel put it plainly: "It is unlikely that Russia will initiate an actual invasion of a NATO country, but we cannot rule it out." Defence Minister Jeppe Bruus said the assessment does not concern a potential attack on Denmark itself.

FE separately assesses that Russian hybrid operations are shifting emphasis: from activity mainly intended to spread fear and erode public support for Ukraine, toward operations meant to physically disrupt European assistance reaching Kyiv — including sabotage against defence companies and against rail transport carrying military equipment. Denmark's domestic security service, PET, has separately warned of increased Russian willingness to plan and prepare sabotage against Danish defence firms and organisations supporting Ukraine militarily. FE said future hybrid operations could include destructive cyberattacks against critical infrastructure and sabotage carrying a high risk of casualties, pointing to the foiled drone plot against Leipzig/Halle airport in Germany as an example of Russia's growing willingness to act against targets in Europe.

The account is consistent across multiple independent outlets reporting on the same 24 September press conference and assessment document — Bloomberg, Euronews, the Copenhagen Post, Kyiv Independent, Euromaidan Press and others all reproduce the same "low but growing risk" language, the same invocation of the Leipzig/Halle case, and the same distinction between hybrid escalation and invasion risk. This is consistent secondary reporting of one official Danish assessment, not independent corroboration of Russian intent — FE itself says it has no indication Moscow is preparing an attack.

BSM analysis: The load-bearing new fact is not that Russia is running hybrid operations — Danish intelligence has said that for over a year — but that FE now explicitly assigns a probability, however low, to limited conventional military action against a NATO member while the Ukraine war is still open. That is a new category of statement, not a restatement of the hybrid-threat picture.

Why it matters

FE's previous unclassified assessment, from October 2025, rated the hybrid threat to Denmark and NATO as high but rated the threat of a conventional military attack on Denmark as none, and did not describe any probability of limited Russian military action against NATO territory. The new assessment keeps invasion in the "highly unlikely" category but adds, for the first time in FE's public assessments, a named — if low — probability of a limited attack against NATO states bordering Russia, such as Estonia, Latvia, Lithuania, Poland, Finland and Norway.

That shift matters most for the states directly named in the scenario: a limited confrontation would force them to weigh redirecting surveillance, air-defence and other military resources toward territorial defence at the same time Europe is trying to sustain Ukraine's war effort. The hybrid-operations shift compounds this: FE is now describing sabotage against defence-industrial and rail-transport targets not as generalised disruption, but as activity aimed at interrupting the physical flow of military assistance to Ukraine — logistics and defence-industrial capacity rather than only public morale.

BSM analysis: FE is careful to separate the two claims — hybrid escalation is assessed as likely and already under way; limited military action is assessed as low-probability and prospective. Conflating them would overstate what Copenhagen is actually saying. The assessment is a shift in what Danish intelligence is willing to say publicly, not evidence that Russian preparations for an attack on NATO territory are under way.

What to watch

Corroborating assessments from other NATO intelligence services; any observable Russian force build-up or logistics activity near NATO's eastern flank; a documented sabotage incident against a defence company or a Ukraine-bound rail shipment; or a change in NATO force posture or readiness that responds directly to this assessment.

---

Baltic Security Monitor