I. Five days in September
Between 14 and 18 September 2026, five European governments moved at once, and none of them coordinated the timing publicly.
On 14 September, a Russian frigate fired two flares at a Danish Fennec helicopter conducting a routine photographic mission in international waters off Gedser, one of them passing close to the aircraft. Copenhagen summoned Russian ambassador Vladimir Barbin; Defence Minister Jeppe Bruus said there had been no warning or radio contact beforehand. On 15 September, NATO aircraft shot down a drone that entered Lithuanian airspace from the direction of Belarus.
On 17 September, Donald Tusk addressed the Sejm. He said he was presenting the most probable scenario for the coming months, and that late autumn and winter would be the most critical phase of the war so far. He warned that Russia intends to send drones or missiles into NATO territory and then claim the incidents were accidental, in order to demonstrate that Article 5 exists only in theory. He was explicit about his sourcing: intelligence from NATO, Ukrainian and US services, including the CIA.
On 18 September, two things happened in parallel. In Bern, the Federal Council adopted the 2026 Security Policy Strategy, with ten objectives and 46 measures, prioritising three axes: resilience, protection, and defence capability.
In Paris, Macron convened the leaders of every party represented in Parliament, alongside their 2027 presidential candidates.
And on 18 to 20 September, Russia held its State Duma elections, the second national vote since February 2022. That overlap is worth noting, though nothing in the open record ties the two calendars together.
II. What the services actually said
This is the part most commentary gets wrong, so it is worth being precise.
According to the Élysée, the briefing to party leaders was delivered by the heads of the DGSE, DGSI, DRM, the SGDSN, and the director general for energy. Macron's own account of what they presented is on the record. He said the nature of Russian aggression in Europe is changing, and listed the evidence: a drone attack on a passenger train out of Kyiv, the failed attack at Leipzig airport, the flare incident near the Danish frigate, airspace incursions in several European countries, and a general multiplication of hostile acts.
Note what he did not say. He did not announce an imminent attack on France. Asked directly about concrete threats on French soil, he answered that France has already been subject to information and cyber attacks, that several were documented and attributed, and that the threat level has been raised. Asked about a physical attack, his answer was about warning time rather than probability: there will be no advance notice, and there was none before Leipzig.
Tusk was equally careful. He stressed that there is nothing to suggest an invasion.
The Swiss text applies the same logic. The strategy explicitly prioritises measures against the most likely threats, which it names as hybrid and remote attacks, plus organised crime domestically, while building the capability to counter an armed attack over a longer horizon. Preparing for something is not predicting it.
On timelines, the services have been consistent for two years. German Foreign Minister Johann Wadephul has said intelligence services warn that Russia is at minimum creating for itself the option of war against NATO by 2029. Dutch military intelligence, the MIVD, assessed in its annual report that under favourable conditions Russia could build enough combat power for a regional challenge to NATO within a year of fighting stopping in Ukraine. In March 2026, General Dominique Tardif, deputy commander of the French Air Force, told Politico it was possible Russia would test NATO's strength in the 2028 to 2029 window.
III. The real danger is attrition below the threshold
The Leipzig case is the clearest illustration of what Europe is actually facing.
On the night of 4 to 5 August 2026, a drone carrying explosives was found on the grounds of Leipzig/Halle airport near a Ukrainian cargo aircraft, forcing the airport to close.
On 1 September, Interior Minister Alexander Dobrindt attributed the attempt to Russia, citing police findings, the pattern of the operation, and intelligence from German services and partners, and noting that the drone configuration, components, explosive and detonation technology were known from other Russian hybrid operations. Berlin's response included closing Russia's consulate general in Bonn from 18 September, terminating the agreement governing the Russian House in Berlin, tighter entry controls, and proposed EU sanctions. Welt am Sonntag later reported that investigative files linked one of two identified suspects directly to the GRU.
Macron's reading of it at the Élysée was blunt: the operation failed because the GRU device did not work, and the consequences would otherwise have been lethal. What failed was execution, not intent.
The volumes matter more than any single case. The IISS found that Russian sabotage against European critical infrastructure rose 246 percent between 2023 and 2024. A Congressional Research Service report of August 2026 cites at least 151 documented incidents of reported Russian operations between February 2022 and March 2026. German media have cited a federal police assessment counting more than 165 suspected sabotage cases in Germany during 2026 alone, without Russian responsibility established in every case.
For a readership that follows illicit finance, that is the structural point. This is not a war of mobilisation. It is a campaign run through criminal intermediaries, shadow-fleet shipping, cut-outs and cash, priced to stay below the threshold at which a treaty obligation triggers.
IV. The second strait, and the gap
There is a second crisis running underneath the first, and for Europeans it is currently the more expensive one.
At the same press conference, Macron said the Strait of Hormuz remains almost entirely blocked following the US and Israeli strikes on Iran, with no agreement in place to reopen it and transit degraded further in recent weeks. The Saudi workaround, the pipeline running to Yanbu on the Red Sea, had been moving the equivalent of several million barrels a day until Houthi attacks on Yanbu cut those volumes sharply. French diesel averaged 2.39 euros a litre on the day of the meeting.
This is the vulnerability the Swiss text names in the abstract and the French one names in euros. Bern's stated aim is to reduce critical dependencies, on the reasoning that interconnected critical infrastructure is more vulnerable. Neutrality does not insulate a grid, and it does not guarantee delivery. Macron announced the same conclusion operationally: a G7 convened on energy stocks, a request to the Commission on gas storage and refining flexibility, and bilateral supply deals with Saudi Arabia, Iraq, Qatar, the UAE, Nigeria and Canada.
The gap is in the timelines. The European Drone Defence Initiative, formerly the drone wall, was launched in Q1 2026, with initial operational capacity expected by end 2026 and full functionality by end 2027; Eastern Flank Watch is not expected to be fully functional until end 2028. NATO's Operation Eastern Sentry, activated in September 2025 after Poland invoked Article 4, currently covers the eastern flank with assets from Denmark, France, Germany, Italy, the UK and Spain.
Set those dates against the intelligence assessments and the arithmetic is uncomfortable. The services point at 2028 to 2029 as the window in which Russia acquires the option. Europe's protective infrastructure arrives, on paper, in roughly the same window. There is no margin, and paper schedules have a poor record of surviving procurement.
The honest conclusion.
What happened this week is not evidence of an imminent event. It is evidence that several governments concluded independently, and within days of each other, that their publics and their parliaments needed to be told where the threat level now sits. In France the trigger was electoral as much as strategic: Macron framed it as a transparency exercise owed to candidates ahead of 2027. That does not make the underlying assessment theatre. It means the assessment and the politics arrived at the same moment, and readers should be able to tell the two apart.