I. The thesis: a continental war with a hybrid interior
For three decades after 1991, European security was organised around the assumption that large-scale interstate war on the continent was an artefact of the past. That assumption is gone. Russia's full-scale invasion of Ukraine in February 2022 did not merely open a war on the eastern marches; it has progressively pulled the rest of Europe into a lower-intensity confrontation conducted by sabotage, undersea-cable cutting, satellite-navigation jamming, arson and airspace violation. The Institut Vidocq's reading is that two fronts now coexist: a conventional, attritional front inside Ukraine, and a hybrid front that runs through the interior of the European Union and NATO, through harbours, fibre-optic cables, airport approach corridors and logistics hubs. The two are not separate wars. They are the same contest fought at two different temperatures.
The conventional front is in Ukraine. The hybrid front is everywhere Europe keeps its lights on, moves its data and lands its aircraft.
This note proceeds from sourced fact to institutional analysis, and is explicit about where the picture is moving too fast for confident assertion, above all on the state of the line of contact, which we report only as dated estimates.
II. The state of the war, reported as dated estimates, not fixed fact
This section carries the heaviest health warning. The line of contact moves, claims are contested, and any "map" is a snapshot. As of early 2026, Russian forces were reported to have captured the Donetsk logistics town of Pokrovsk together with neighbouring Myrnohrad, having first entered Pokrovsk in November 2025 [1]. Yet the operational return on that effort appears modest: in February 2026 the Institute for the Study of War assessed that Russia had been unable to translate the seizure of Pokrovsk into operationally significant advances further west, contradicting Kremlin claims of a breakthrough opening the rest of Donetsk Oblast [1]. The Center for Strategic and International Studies assessed in January 2026 that the Russian advance through Pokrovsk had been slower than the Allied advance at the Somme in 1916, a deliberately deflating comparison to one of history's most grinding offensives [1]. Fighting in the same period concentrated around Kostiantynivka, Kramatorsk and Sloviansk, the last major Ukrainian-held cities in Donetsk [1].
This subject is unusually volatile. The Institut Vidocq treats every territorial claim as (a) attributed to a named assessor, ISW, CSIS, national defence ministries, and (b) bound to a date. Where Russian and Ukrainian official claims diverge, we flag the divergence rather than splitting the difference. A research note that states an undated front position as settled fact is, on this subject, committing an error of method. Readers should treat the figures in Section II as the situation as reported on the cited date, and assume movement since.
The strategic point survives the volatility of the map. Whatever the exact line, the war has settled into attrition, Russian gains have been slow and costly, and the conflict's primary effect on European security now operates off the battlefield.
III. The hybrid front: sabotage and the shadow campaign
The clearest evidence that the war has crossed into Europe is the documented surge in sabotage attributed to Russian intelligence. The Center for Strategic and International Studies, in a March 2025 study by Seth G. Jones, counted Russian attacks against European targets rising from 3 in 2022 to 12 in 2023 to 34 in 2024, nearly tripling year-on-year [2]. By that dataset, more than a quarter of targets were transportation, a quarter government and military, with critical infrastructure and the defence industry each around a fifth; roughly a third of attacks used explosives or incendiaries [2]. Targets clustered on NATO's eastern flank and among states arming Ukraine, Estonia, Finland, Latvia, Lithuania, Poland, Germany, the United Kingdom and others, while countries with closer ties to Moscow recorded none [2].
The named incidents are no longer hypothetical. Lithuanian prosecutors described the May 2024 arson of an IKEA store in Vilnius as an act of terrorism linked to Russian military intelligence [3]. Polish investigators concluded that the May 2024 fire that destroyed the Marywilska 44 shopping centre in Warsaw was arson coordinated by Russian services, with evidence pointing to a GRU officer [3]. Incendiary devices disguised as ordinary parcels ignited in DHL logistics hubs in Germany and the United Kingdom, an episode European officials treated as a near-miss against air cargo [3]. The operational signature is consistent: coordination by Russian intelligence, execution by locally recruited, often criminally connected proxies hired through encrypted channels and paid in cryptocurrency [3].
Europe is being attacked at a tempo and on a geography that no longer fit the word "peacetime", yet below the threshold that would trigger collective defence. That gap is the strategy.
IV. The seabed and the sky: cables and GPS
Two domains illustrate how civilian infrastructure has become contested terrain. In the Baltic Sea, roughly ten subsea cables have been damaged since 2022, with seven cuts concentrated between November 2024 and January 2025 [4]. On 17 November 2024, cables linking Sweden–Lithuania and Finland–Germany were severed; suspicion fell on the Chinese-flagged carrier Yi Peng 3 [4]. On 25 December 2024 the EstLink 2 power cable and several data cables between Finland and Estonia were cut after the Russia-linked tanker Eagle S dragged its anchor for some 100 kilometres; Finland boarded and seized the vessel [4][5]. Attribution remains legally unresolved, in October 2025 a Finnish court dismissed the case against the Eagle S crew, ruling that intent had not been proven and that the alleged acts fell outside Finnish jurisdiction [5]. That outcome is itself instructive: the grey zone is engineered to defeat courtroom standards of proof.
In the air, satellite-navigation interference has become routine. Reporting indicates roughly 123,000 flights over Baltic airspace were affected by GNSS jamming in the first four months of 2025, with interference touching an estimated 40% of European air traffic in affected corridors [6]. Lithuania recorded over 1,000 interference cases in a single month of 2025, more than twenty times the prior year; Latvia logged 820 cases in 2024 against 26 in 2022 [6]. In 2024 a jet carrying the British defence secretary lost satellite signal near Russian territory, and a Finnish carrier suspended service to Tartu, Estonia, over interference [6]. Finland and Estonia formally blamed Russia at the ICAO assembly on 3 October 2025, and on 9 September 2025 the European Commission announced anti-spoofing authentication and an interference-monitoring service [6].
V. The drones over the flank, a 2025 inflection
The most dangerous escalation arrived in the air over NATO itself. On 9–10 September 2025, at least 19 Russian drones violated Polish airspace in the largest such breach since 2022; NATO members shot down drones for the first time since the war began, and some craft penetrated roughly 250 km toward the Rzeszów logistics hub that channels Western aid to Ukraine [7]. Several recovered drones were identified as low-cost Gerbera decoys modelled on the Iranian Shahed design, consistent with probing and saturating air defences [7]. On 14 September 2025 Romania reported a Russian drone in its airspace [7]. Poland invoked Article 4 of the North Atlantic Treaty [7]. NATO's answer was Eastern Sentry, launched on 12 September 2025 to reinforce air defence from the Baltic states through Poland, Romania and Bulgaria, with aircraft pledged by allies including France, Germany, Denmark and Czechia [8]. This sits alongside Baltic Sentry, launched in January 2025 to protect undersea infrastructure with frigates, patrol aircraft and naval drones [4].
A drone that costs a few thousand euros and forces a NATO state to scramble fighters and invoke Article 4 is not a weapon. It is a price-discovery mechanism for Europe's air defence.
VI. The money: the steepest re-armament since the Cold War
Here the figures are firm, because they come from SIPRI and NATO with dates attached. According to SIPRI's April 2026 release, world military spending reached $2,887 billion in 2025, up 2.9% in real terms on 2024; spending outside the United States rose 9.2%, while US spending fell 7.5% to $954 billion [9]. Europe spent $864 billion in 2025, a 14% rise [9]. That follows a 2024 in which, by SIPRI's April 2025 data, European spending (including Russia) jumped 17% to $693 billion, the sharpest regional increase and the highest level since the Cold War, with every European state but Malta raising its budget [10].
The national figures track the same curve. Germany's military spending reached $114 billion in 2025, up 24% and equal to 2.3% of GDP, after a 28% rise to $88.5 billion in 2024 that made it the biggest spender in Western and Central Europe [9][10]. Poland spent $38.0 billion in 2024, up 31% and equal to 4.2% of GDP [10]. Russia spent $190 billion in 2025, up 5.9%, at a military burden of 7.5% of GDP; Ukraine spent $84.1 billion, up 20%, consuming 40% of its GDP [9].
The political ceiling rose with the budgets. At the Hague summit on 25 June 2025, NATO allies committed to 5% of GDP by 2035, at least 3.5% on core defence and up to 1.5% on security-related spending such as critical-infrastructure protection and resilience, with annual plans and a review in 2029 [11]. In 2025 every ally met or exceeded the old 2% benchmark, against just three in 2014 [11]. In parallel, the European Commission's White Paper for European Defence, Readiness 2030 and the ReArm Europe plan, presented on 19 March 2025, framed up to €800 billion of additional defence investment, including the €150 billion SAFE loan instrument adopted by the Council in May 2025 [12].
VII. The eastern flank thickens, from tripwire to brigade
The posture on the ground is shifting from symbolic tripwire to standing combat power. NATO maintains eight multinational battlegroups from Bulgaria to Estonia; several are scaling to brigade size [13]. In July 2024 Latvia became the first to stand up a brigade-level formation, with Canada as framework nation [13]. Germany inaugurated its 45th Panzer Brigade "Litauen" in Lithuania in May 2025, the first permanent German combat brigade stationed abroad since the Second World War, with around 1,000 troops to be permanently subordinated by February 2026 and a target of roughly 5,000 by 2027 [13].
Behind the posture sits a contested threat timeline. In late 2025, German Defence Minister Boris Pistorius and senior officers cited intelligence estimates that Russia could reconstitute enough force to threaten NATO's eastern flank by 2029, while the head of the BND, Bruno Kahl, judged that Russia could be capable of a limited operation, such as against the Baltic states, by the end of the decade, with the timing tied to how and when the Ukraine war ends [14]. These are estimates, not predictions, and German officials paired them with calls not to panic [14]. The Institut Vidocq treats 2029–2030 as a planning horizon Europe has chosen to take seriously, not a date certain.
VIII. Conclusion, Europe is at war below the threshold, and finally paying for it
The honest summary is uncomfortable. Europe is not at peace. It is in a sustained, deniable, sub-threshold conflict on its own territory, in the Baltic, in its skies, in its warehouses, while a conventional war grinds on in Ukraine. The decisive shift of 2024–2026 is that European governments have stopped treating this as episodic and started funding a structural response: a 14% real spending rise in 2025 on top of 17% in 2024, a 5% NATO ceiling, an €800 billion EU framework, permanent brigades on the flank, and standing missions over the Baltic seabed and the eastern sky.
Three judgements follow. First, the centre of gravity of European security has moved decisively east and onto the home front simultaneously; the relevant question is no longer "will Europe be involved" but "is Europe's interior defensible." Second, the grey zone is winning on attribution, the Eagle S acquittal shows that legal proof and strategic certainty have diverged, and that deterrence must rest on resilience and consequence rather than conviction. Third, money is necessary but not sufficient: budgets have turned, but the test is whether Europe converts 5% pledges and €800 billion frameworks into deployable mass, integrated air and drone defence, and protected infrastructure before the 2029–2030 horizon that its own intelligence services keep naming. The front has moved west. Europe has noticed. Whether it has moved fast enough is the open question of the decade.