Russian Incursions and Hybrid Warfare: Europe Under Aerial Pressure

Since early September 2025, several Russian incursions into European airspace, notably in Poland, Romania, Estonia, Denmark and also Norway, have cast a security threat over the continent. While the origins of some of them are not yet proven, these short-lived violations nevertheless bring their share of challenges: Moscow may be in the process of testing the limits of Europeans’ capacities for decision, action and more broadly defence. While Europe seems disunited and weakened by the gradual withdrawal of its American ally, how should these incursions be understood? What is their geopolitical and strategic scope, and above all, how should they be answered? Louise Souverbie, research fellow at IRIS, specialising in European defence issues and the armaments industry, discusses this.

How can we define and interpret the security threat currently weighing on Europe?

These recent violations of European airspace – incursions of 19 drones in Poland, one in Romania, several aircraft in Denmark, as well as three Russian Mig-31s in Estonia – occurring within the space of two weeks, reveal an intensification of the security pressure on Europe. The aircraft were quickly escorted back towards Russian airspace and it seems that the drones were not armed: these were reconnaissance drones and decoys (unarmed versions of drones that are usually armed). The temporal proximity of these various incidents and the context in which they occurred nevertheless seem to indicate an overall strategy aimed at testing European defences, collecting intelligence and exploiting the ambiguity characteristic of hybrid actions.

Investigations aimed at the formal attribution of the incursions are still ongoing. However, in the Polish case, their origin from Ukraine in the context of a massive Russian attack and from Belarus likely indicates intentional action by Moscow. Likewise, in Denmark, the characteristics of the operation and the capacities employed point at the very least to a “capable” actor (to use the term employed by the authorities), potentially state. The body of evidence thus converges towards Russia, without this removing the need for investigative procedures for official attribution (which will not necessarily be possible).

These actions have been described as “hybrid” by several observers and by Danish political leaders. This qualification is not meant to relativise the threat, but to designate a particular mode of operation. In general, hybrid actions share several characteristics:

• They make it possible to maximise political and psychological destabilisation at lower economic, military and diplomatic cost;
• They exploit thresholds of response – notably the threshold of armed aggression and that of NATO’s Article 5 – by turning ambiguity into a strategic instrument, slowing decision-making, dividing public opinions and paralysing reaction;
• They rest on a logic of plausible deniability, or rather implausible deniability, multiplying contradictory signals to sow doubt. Some works on hybrid warfare stress that it is less about concealing responsibility than about “unacknowledged intervention as performance”, which makes it possible to send a strategic signal as well as “to introduce calculated uncertainty into international relations” (Cormac & Aldrich, 2018).

In the case of the September incursions, Russian objectives could have been multiple: testing NATO’s reactions (both of the member states concerned individually and of the alliance as a whole), assessing European capacities to neutralise this type of attack and collecting intelligence. These actions form part of a broader strategy of intimidation against European governments and populations, with the underlying objective of deterring the continuation of support for Ukraine. The countries targeted are indeed among Kyiv’s key supporters. Finally, they occur in the context of discussions relating to security guarantees for Ukraine, in which Europe is called upon to play a central role.

These aerial incursions must therefore be placed in the wider framework of the hybrid war waged by Russia (which rejects the use of this term and instead applies it to “the West”), aimed at weakening the Euro-Atlantic alliance and the European Union. This strategy combines kinetic means (such as drones and aircraft) and non-kinetic means such as information campaigns, articulated to maximise destabilisation. The Polish example is revealing in this respect: Moscow sought to attribute responsibility for the violations to Ukraine, illustrating a disinformation strategy intended to divide allies and to weaken European solidarity.

The Baltic area is particularly concerned by this context. Russia indeed seeks to contest NATO’s superiority there by strengthening its capacity for operation on critical underwater infrastructures and by creating confusion between civilian and military means. The method of projection of the drones that targeted Denmark illustrates this latter trend, with some reports suggesting the use of Russian civilian vessels in the Baltic Sea and the North Sea. Furthermore, the interception of Russian aircraft in Baltic airspace has become almost routine for NATO’s air policing mission (300 cases recorded in 2023 according to NATO figures). The prolonged duration of the latest incursion in Estonia (12 minutes) and its context nevertheless reinforced its seriousness.

Finally, these incidents highlight the growing dynamic of the “dronisation” of conflicts, for which Europe still seems insufficiently prepared. The massive and varied use of drones allows, on the one hand, the saturation of air defences through the simultaneous sending of devices, including decoys such as those observed in Poland, which mobilise defensive resources; and, on the other hand, the capacity to strike in depth at lower cost, by targeting for example critical infrastructures (transport networks, energy installations, etc.).

Faced with the multiplication of incidents, how should we interpret the dissonance of reactions on the manner of responding between the different European partners but also the United States, NATO members?

The diversity of reactions can be analysed according to two temporalities (immediate response and short-term reaction) and three registers (operational, economic/technological, political/strategic). They must also be considered in relation to the different types of actions to which they respond, the key word being proportionality.

Considering first the immediate reaction, the Estonian case seems to demonstrate a mastery of the situation by the allies present within the framework of NATO’s air policing mission. The Russian Mig-31s were escorted out of Baltic airspace, apparently in accordance with the rules of engagement of this mission in peacetime. The gradation of possible responses – radio warning, interception and escort, radar lock, manoeuvre, warning shot – makes it possible to manage each situation without systematically resorting to the use of force.

Poland and Denmark constitute two other key cases, characterised by the use of reconnaissance drones and decoys. Poland shot down four of the 19 drones, while Denmark is said not to have neutralised any. The appropriateness of these reactions can be assessed in light of three main dimensions:

• Operational: shooting down devices over inhabited areas or areas frequented by civil aviation creates a significant risk linked to falling debris. Decision-making therefore weighs the threat represented (are the drones armed?) against the risks posed by their fall.
• Economic and capability-based: the cost asymmetry is significant between an attack carried out with drones worth a few thousand or tens of thousands of euros, and defence based on interceptors costing several millions. Other, less costly means nevertheless exist and would also have avoided the problem of falling debris, notably in the field of electronic warfare, which raises the question of European capacities faced with these new threats.
• Strategic: the choice to neutralise or not the drones also corresponds to a strategic signal. On this point, it is important to take into account the difference in strategic cultures and thus in frames of reference between the sender and the receiver of the message (Eken et al., 2025): restraint may be perceived in Europe as proof of mastery, but interpreted in Russia as a manifestation of weakness.

Next, the deferred reaction combines declaratory elements and operational measures. The first aspect was marked by the firmness of Baltic, Polish and Nordic leaders. Polish Foreign Minister Radoslaw Sikorski stated at the UN Security Council, in the presence of the Russian ambassador, that Warsaw would not hesitate to shoot down the next devices, even if debris were to fall on Alliance territory. Prime Minister Donald Tusk and his Danish counterpart Mette Frederiksen also displayed a firm stance, the latter declaring that Europe is in a state of hybrid war.

In addition, Poland and then Estonia activated Article 4 of the NATO Charter, which provides for consultations between allies when “in the opinion of any of them, the territorial integrity, political independence or security of any of the parties is threatened.” These consultations were followed up with the rapid operationalisation of the allied response: Operation Eastern Sentry. A few days after the incursions of Russian drones in Poland, two Danish F-16s, four German Eurofighters and three French Rafales thus joined the eastern flank. European NATO members are therefore taking the lead in the allied response. The possible reading is twofold: the assertion of increased European responsibility in the protection of its eastern flank is a positive signal which should strengthen the credibility of European forces and their deterrent capacities vis-à-vis Russia; on the other hand, the absence of the United States will not go unnoticed in Moscow.

As regards the American posture over the whole sequence, it was at the very least muted. Present in Poland both bilaterally and as a NATO framework nation, the United States apparently did not take part in the interception of Russian drones. Moreover, their non-participation in Operation Eastern Sentry reinforces the idea that Washington is leaving Europeans with primary responsibility for their security and is potentially seeking to avoid bilateral tensions with Moscow.

What responses can there be to these threats?

Responses must combine an immediate correction of possible security gaps around critical infrastructures, a short- and medium-term strengthening of the continent’s deterrence by denial, and a structural adaptation to hybrid threats.

Securing and strengthening critical infrastructures appear today as a priority. The recent drone incursions, notably in the Danish case, highlighted persistent vulnerabilities concerning key sectors (energy networks, transport, airports or even digital infrastructures), which represent privileged targets within the framework of Russia’s hybrid strategies.

Next, Europe is engaged in strengthening its anti-drone capacities. Since 2024, the Baltic States have been advancing the so-called drone wall project, taken up and supported by the President of the European Commission in September 2025 in the context of the violations of Polish airspace. This system provides for the establishment of sensor networks combined with an integrated command and control system, allowing real-time operational vision across the whole border. Added to this is the use of automated interceptor drones, capable of neutralising hostile devices. Europe must also invest in early warning systems and a multi-layered air defence capable of countering the saturation of its defences by swarms of drones. Counter-measures also include the use of electromagnetic jamming devices, anti-drone drones or even emerging technologies such as lasers. This type of response falls within a logic of “defence and deterrence by denial”, consisting of making any attack costly and uncertain for the adversary and thus reversing or at least limiting any form of advantage to attack. Beyond the issue of drones, adaptation also requires a broader strengthening of defence capacities aimed at making the European posture credible and ensuring effective conventional deterrence vis-à-vis Moscow.

The debate over establishing a no-fly zone over western Ukraine remains pending. Such a measure, which would involve NATO intercepting and shooting down any aircraft entering this space, would constitute a major political and military leap that the Allies do not seem ready to take. Poland, for its part, has launched an accelerated legislative procedure to authorise its armed forces to shoot down Russian devices over Ukrainian territory without prior NATO approval.

Finally, in the context of the strengthening hybridity of threats, the European response cannot rely solely on an increase in military means. Hybrid strategies indeed aim to exploit both capability vulnerabilities and societal fragilities, relying notably on disinformation campaigns. Preparation must therefore also include reflection on the resilience of European societies.