Denmark’s military intelligence warns of rising risk of Russian attack on NATO

Denmark’s Defence Intelligence Service dropped a sobering assessment on September 24: Russia may be willing to launch a limited military attack against a NATO country. Not a full-scale invasion, not tanks rolling across borders, but something more surgical and arguably more destabilizing, like drone strikes on infrastructure or small troop deployments designed to test the alliance’s cohesion.

The assessment, presented by DDIS Director Thomas Ahrenkiel, marks a notable escalation in how one of NATO’s member states views the threat landscape. The key shift is not about capability but about willingness. Russia’s risk tolerance, according to Danish intelligence, has meaningfully increased.

What a limited attack could look like

The DDIS report draws a clear line between two scenarios. A full-blown invasion of a NATO member state remains unlikely and would require at least six months of visible military buildup, the kind of troop movements and logistics chains that satellites and intelligence services would spot well in advance.

A limited operation is a different animal entirely. Think drone strikes or missile launches targeting supply chains that support Ukraine. Or small, deniable troop deployments conducted under false pretexts. The goal would not be to occupy territory but to drive wedges between NATO members and test whether Article 5, the alliance’s collective defense clause, actually holds when the provocation falls in a gray zone.

The assessment also flags an intensification of hybrid warfare tactics. Destructive cyberattacks against critical infrastructure, sabotage operations, and information campaigns are all expected to carry greater consequences for targeted countries than previous rounds of Russian hybrid activity.

Recent provocations set the tone

The Danish warning does not exist in a vacuum. On September 14, a Russian frigate fired flares at a Danish military helicopter.

Denmark’s security service has separately warned about potential sabotage preparations targeting Danish defense companies.

Previous DDIS assessments from 2025 had already outlined a troubling trajectory. Those reports suggested that if the conflict in Ukraine were to stabilize or conclude, Russia could rebuild sufficient military capacity for localized regional conflicts within months.

Danish officials have been careful to note that a direct military attack on Denmark specifically is not anticipated. But the broader message is unmistakable: the security environment across NATO’s northern and eastern flanks has deteriorated, and the alliance needs to operate with heightened vigilance.