Baltic Security Monitor | Analytical Brief Snapshot: 5 October 2026, 20:00 (Europe/Tallinn) · Material OSINT Update

NATO says all the time that it can defend itself. It almost never says how. Now a document has surfaced that lays it out in sequence: stop the attack, gain freedom of manoeuvre, break the adversary's command system. Drones and AI are not decoration in it, they are part of the core model.

Assessment

What happened

Bloomberg obtained an unclassified version of a document titled "Theory of Victory," being developed under NATO's Supreme Allied Commander Europe, Gen. Alexus Grynkewich. According to the outlet, he is due to present the strategy in Poland on 12 October. The document is meant to explain how the alliance would respond to a possible invasion of NATO territory, and stresses a collective response to hybrid threats and demonstrating readiness so that an adversary concludes victory is impossible.

If NATO were attacked, the alliance would, as described, first halt the incursion with a combination of ground forces and capabilities developed under the Eastern Flank Deterrence Initiative, which relies on low-cost drones, minimally crewed systems and AI-enabled targeting. Grynkewich's spokesman, Col. Martin O'Donnell, declined to give details but confirmed the core idea: the theory of victory is simple, maintain NATO's advantage. He also stressed that the alliance is exclusively defensive.

According to ANSA, which separately reviewed the internal document, and as relayed by Ukrainian outlets, once the incursion is halted NATO would gain freedom of manoeuvre, strike the adversary's command, control and intelligence architecture (C5ISRT) with kinetic and digital means, and if necessary use conventional aviation and missile fires against its combat system.

Confirmed versus outstanding

BSM analysis: what this means and what it doesn't

First, the limits. The "Theory of Victory" is a SACEUR-level conceptual document, not an approved operational plan. What has surfaced is an unclassified version, and Bloomberg itself notes that while NATO's broad principles of warfare are known, details of how the alliance would operate are rarely made public. So the news is not that a secret strategy exists but that its logic has been described openly for the first time.

Second, the sequence of halt, gain freedom of manoeuvre, destroy command and control, defeat the remaining combat system matters more than the technology layer, because it determines what procurement and exercises are aimed at. The technologies, cheap drones, minimally crewed platforms, AI-enabled targeting and multilayer defence, are meant to work alongside conventional ground forces, not replace them.

BSM analysis: Ukrainian experience is no longer just being studied, it is visibly entering the alliance's operating model. Cheap expendable assets against expensive targets, fast sensor-to-shooter links, digital strikes on command systems: these are things Ukraine has been refining for years. The document also has a political purpose. As described, it is meant to push European allies to raise defence investment and operational readiness. In part, it is an argument in the budget debate.

Context matters here too. Secretary General Mark Rutte has previously said he sees no sign that Russia is preparing a conventional attack on NATO members. The document does not contradict that: it describes how to respond, not that an attack is expected. It is classic deterrence by demonstrating readiness.

The Estonia link

This morning's BSM update described Estonia moving its main combat brigade to Jõhvi and defending "from the first metre." The "Theory of Victory" shows the same turn at alliance level: do not hand Russia an initial territorial fait accompli. The Estonian version is a national implementation, the SACEUR document a general framework. Whether the two are formally linked is not publicly known, so BSM records only the overlap in logic.

What it means for the Baltic states and Ukraine

The Baltic states and Poland are most directly implicated in eastern-flank planning. For them the question is practical: which force requirements, procurement and exercises follow from the document if it becomes a plan.

For Ukraine it is recognition that its experience now shapes how NATO approaches its own defence, and not only the other way around.

Checking other items from today

The Estonia/Jõhvi development was already covered as the 14:00 MATERIAL UPDATE and is not duplicated here.

The Vilnius unidentified-object and Kasparov items produced no new verification that would meet the threshold.

Conclusion

For the first time the alliance has publicly shown the logic by which it intends to act if its eastern flank is attacked. It is not yet an approved plan, but it is more than general words about deterrence.

Next checks: Grynkewich's presentation in Poland on 12 October; whether the document gets formal NATO status; whether it turns into regional plans, force requirements, procurement and exercises; whether the stages after the first are confirmed openly.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security on NATO's northeastern flank. All OSINT assessments are produced by an automated monitoring system using open sources.