The Debrief: Inertia, the real threat to Europe

Going into 2026, the European Union’s vulnerabilities lie more exposed by inaction on several strategic fronts, including radar and cyber defense systems, rather than geographical weak spots.

On a Saturday night last September, one of Europe’s busiest airports was thrown into a brief moment of chaos. For nearly an hour, the Polderbaan runway at Amsterdam’s Schiphol Airport was shut down over a drone sighting. By the time the airport resumed normal operations, the Royal Netherlands Marechaussee had determined it was not a drone, likely a balloon, although neither were located in the aftermath.

It was clear that Europe was on edge. That same week, on September 22, 2025, drones were spotted near Copenhagen airport, causing a four-hour-long closure. Years of perceived and real inertia in multiple sectors, including security, exposed much of the bloc’s vulnerabilities last year. Over the past year, the European Union (EU) grappled with unauthorized drones and contraband-carrying balloons shutting down airports, blasts disrupting railways, damaged undersea cables, an occupation on its eastern flank and a new threat to an EU-linked territory to its north. By all accounts, this non-traditional warfare will be an expanding threat to the bloc in 2026 but the bloc’s response has come across as less than united or decisive.

By the end of 2025, Germany said it recorded more than 1,000 suspicious drone flights, some disrupting flights at megahubs in Berlin and Munich, and others over military installations. Classified reports put that number closer to 2,000. The German federal police chief said it could not be assumed with “100 percent certainty” that all of those are guided by Russia, despite evidence of Kremlin-activity in the country with the arrest of an alleged spy with German military ties. Finland’s defense command warned Russia will keep persisting in its attempts to damage Baltic Sea telecoms infrastructure after seizing a vessel from St. Petersburg on New Year’s Eve.

“All of this comes under the heading of what has been broadly called, on a number of occasions by European politicians, Russia’s hybrid-war effort in Europe,” Factal Editor James Morgan said. “Probably the largest case would be the explosion that happened on the railway line between Warsaw and Lublin in Poland in October of last year, and the Polish authorities came straight out essentially and said that it was an act of terrorism that could be traced back to the Russian Federation.”

“In terms of hybrid activities in the coming year, I would flag the Hungarian election as a big vulnerability and a potential target for Russian sabotage.”
Factal Editor James Morgan

With hybrid warfare, malign states can isolate orders from action, so the evidence never directly connects back to them. Recent damage to undersea cables in the Baltics, Morgan pointed out, is difficult to trace back to Russia.

“You could include interference in elections as part of this kind of sabotage effort that a lot of European countries can trace back to the Russian Federation,” he said. “And last year, I would say that the Moldovan parliamentary elections would probably be the biggest candidate in terms of evidence that could be traced back to Russia.”

While Moldova is not in the EU, its trajectory into the bloc is closely tracked by Russia which sees ex–Soviet states close to Europe as natural extensions of its boundaries and launchpads for chaos on the bloc’s borders.

Moldova, in the run up to parliamentary elections in September, traced an organized crime network coordinating vote-buying schemes, social media disinformation campaigns and a Ddos attack on election day back to Russia. The pro-EU party ended up winning with a clear majority, but Moldova’s Russian-backed breakaway flank of Transnistria and propaganda problems can still throw up obstacles in that path.

“In terms of hybrid activities in the coming year, I would flag the Hungarian election as a big vulnerability and a potential target for Russian sabotage. And I’m not sure what measures the Hungarian government is pursuing in order to minimize that sort of Russian interference, because it would play in the favor of Orban, who’s the current Prime Minister of Hungary,” he said.

All members of the EU are promised the collective defense bestowed by Article 5 of NATO, but a hybrid war doesn’t constitute an armed attack. The response to member states facing sabotage of infrastructure and disruption of airspace has been somewhat underwhelming and not collective.

“I think, in terms of immediate response, it’s very much country based,” Morgan said. “At the end of last year, you had Germany passing a law which effectively allowed the police force to shoot down drones that they believe represent a threat to critical infrastructure.”

A state of emergency in Lithuania also granted authorities extra powers to down weather balloons, after a series of incidents at its airports.

“The biggest collective measure that has been undertaken was in response to the massive Russian drone incursion into Poland in October last year off the back of a huge barrage that targeted Ukraine overnight, and NATO jets were scrambled in response,” Morgan said.

On September 9, 2025, for the first time since World War II, Poland mobilized troops to respond to an enemy threat after some 20 drones violated its airspace. Some were shot down with the help of NATO.

NATO scrambling jets simply cannot be filed under European Union response to sabotage if the drones erroneously strayed off their flightpath into Poland during a Russian barrage attack on Ukraine, Morgan explained. “There’s often a couple of drones across the border into Romania, a couple of drones across the border into Poland.”

On the flip side, if Russia was testing Europe’s readiness, the bloc failed as several drones travelled several hundred miles into Polish territory despite NATO scrambling to intercept.

“What good is a drone shield that covers Europe’s eastern border if the drones are being launched within European borders?”
Factal Editor James Morgan

The European Commission has mocked up a defense readiness roadmap for 2030 that focuses on the eastern flank and references a drone wall that might be ready by 2027, Morgan said.

“Again, it’s a very nebulous idea,” he said. “And the main problem with that is the drones that caused so much disruption in Germany, Belgium, Denmark, are believed to have been launched from civilian vessels in the Baltic Sea. So it begs the question, what good is a drone shield that covers Europe’s eastern border if the drones are being launched within European borders?”

Analysts and outsiders argue the EU needs to adopt a more offensive approach to threats, whether by Russia, or by U.S. President Donald Trump, who is angling for control over Greenland. And the EU holds some big cards, including some $240 billion-worth in growing Russian Central Bank assets as part of sanctions over the Ukraine war.

“The use of the frozen Russian assets, which was left undecided at the end of last year, is a big chip that Europe has to play with,” Morgan said. “Obviously there’s been a lot of disagreement amongst the Europeans on that front, but that’s something that they could potentially threaten the Russian Federation with if things start to escalate again.”

Even if Europe chooses not to fight fire with fire, it is widely believed it can do more of what it showed in Moldova, countering Russian threats with the deployment of a rapid foreign interference response team ahead of elections and access to its cyber attack response services.

With Russia trying to ingratiate itself with Trump during the Ukraine peace talks, the United States has been decoupled from the West to allow more finger pointing at the EU, Morgan said.

“So I guess, the answer to [the] question, ‘what is Europe doing,’ I would say, is not enough to combat the hybrid threat, because throughout the course of last year, essentially what these incidents did is to reveal huge vulnerabilities in European infrastructure that Russia is really taking advantage of.”

Written by Halima Mansoor. Edited by Jillian Stampher.

Top photo: Polish Homar-K rocket launchers and soldiers were hosted by Finland during the Northern Strike 25-2 joint artillery exercise at the Rovajärvi training center in Lapland on Nov. 17, 2025, some two months after a large drone incursion into Polish airspace. (Photo/NATO JFCBS)

Further reading: