Signals from the North: What Nordic and Baltic Intelligence Assessments Reveal About Russia

The experience of recent years illustrates a persistent challenge in European security debates: warnings emerging from the geographic front line are not always fully integrated into broader strategic thinking.

The lesson of 2022 was that the countries closest to Russia often had the clearest view of the threat. The intelligence assessments emerging from northern Europe suggest that those same services continue to see a future defined not by a return to stability, but by a prolonged period of strategic confrontation with Moscow—one that much of Europe is still only partially internalising.

In the years before Russia’s full-scale invasion of Ukraine in 2022, threat assessments from Nordic and Baltic intelligence services were often treated with scepticism elsewhere in Europe. Warnings from Tallinn, Riga, and Vilnius, in particular, were often dismissed in parts of western Europe as the predictable anxieties of states shaped by geography and historical experience rather than as sober intelligence analysis.

The events of February 2022 demonstrated how misguided that view was. Intelligence services in northern Europe had, in many cases, provided some of the clearest assessments of Russia’s trajectory and its willingness to use force to revise the European security order.

Europe’s Northern Signals

That lesson remains relevant today. Each year, intelligence and security services across northern Europe publish public threat assessments that outline their understanding of the evolving security environment. Read individually, these reports reflect national priorities and domestic context. Read together, however, they reveal something more significant: a striking convergence in how the Nordic and Baltic intelligence communities interpret the strategic challenges facing Europe. Although produced for national audiences, these reports are widely read across European policy and intelligence communities, and their growing analytical convergence has increasingly shaped discussions within NATO and EU security institutions. These assessments provide one of the clearest publicly available pictures of how Europe’s frontline intelligence services understand the trajectory of Russian power.

Nordic and Baltic assessments provide one of the clearest publicly available pictures of how Europe’s frontline intelligence services understand the trajectory of Russian power

The growing convergence between Nordic and Baltic intelligence assessments has gradually narrowed these earlier perception gaps, reinforcing the credibility of warnings emerging from Europe’s northern security community.

Taken together, these assessments function as a set of converging strategic signals—analytical signals produced by the intelligence services of states closest to Russia and most exposed to its pressure. They offer a valuable lens on the trajectory of Europe’s security environment. In effect, Europe’s strategic warning increasingly arrives from its northern frontier: a distributed intelligence perspective formed by countries that observe Russian behaviour not episodically, but continuously.

Across the most recent public assessments from Estonia, Latvia, Lithuania, Finland, Sweden, Norway, and Denmark, several consistent signals emerge.^[1] The experience of 2022 demonstrated that when intelligence services across northern Europe speak with unusual clarity about Russia, European policymakers should listen carefully. A review of these assessments reveals several consistent themes.

Signal 1: Russia Is Preparing for Long-Term Confrontation

Perhaps the most consistent conclusion across the Nordic and Baltic assessments is that Russia has entered a period of sustained confrontation with the west. The services describe a Russian state that has adapted its political, military, and economic systems to support prolonged conflict. Moscow is portrayed not as seeking a rapid return to pre-war conditions but as preparing for an extended period of geopolitical rivalry with Europe and the US.

Even if the intensity of the war in Ukraine fluctuates, the broader strategic competition with Russia is likely to persist

Several reports highlight the structural militarisation of the Russian state. Russia’s economy, defence industry, and political mobilisation increasingly reflect wartime priorities, suggesting that the Kremlin is willing to absorb significant costs in order to sustain its confrontation with Ukraine and the west. The implication for European security is clear: even if the intensity of the war in Ukraine fluctuates, the broader strategic competition with Russia is likely to persist.

For example, Latvia’s Constitution Protection Bureau (SAB) notes that the Russian economy has been increasingly reorganised around military production, with Moscow planning to devote 38–41% of its federal budget expenditures to defence-related needs in the coming years.^[2] The report assesses that the militarisation of Russia’s economy will continue even after the war in Ukraine ends, sustaining Moscow’s ability to expand military capabilities and pose a long-term threat to European security.

Several Nordic and Baltic assessments also note a striking shift in the timeframe used to evaluate potential Russian military threats. Earlier reports often suggested that Russia would require a decade or more to rebuild the capacity for large-scale operations against NATO. Recent assessments increasingly compress that window to as little as one to two years following a reduction in the intensity of the war in Ukraine. ^[3] This shift reflects a growing recognition that Russia’s wartime mobilisation and defence-industrial expansion may enable it to regenerate military power far more quickly than previously assessed.

Estonia’s Foreign Intelligence Service (VLA) reaches similar conclusions, assessing that the Kremlin increasingly portrays the war against Ukraine as part of a broader confrontation with the west.^[4] According to VLA, Russia’s leadership now frames the conflict not simply as a regional war but as part of a long-term geopolitical struggle with Europe and the US—an outlook that reinforces Moscow’s willingness to sustain confrontation even at significant economic and military costs.

Sweden’s Military Intelligence and Security Service (MUST) reaches a similar conclusion, warning that Russia is already preparing to rebuild and expand its military capabilities despite the heavy losses suffered in Ukraine.^[5] The report assesses that once the intensity of the war decreases, Moscow will likely prioritise reconstituting its armed forces in order to restore its capacity to threaten neighbouring states and challenge the European security order.

Signal 2: Hybrid Pressure Has Become the Baseline

Another striking theme across the reports is the persistence of hybrid activity directed against European states. Nordic and Baltic services point to cyber operations, influence campaigns, sabotage, and interference with critical infrastructure as continuing features of the security environment.

Importantly, these activities are no longer described as episodic incidents but as part of a continuous pattern of pressure. The assessments highlight a wide spectrum of actions—from cyber operations and disinformation campaigns to GPS disruption and covert influence operations aimed at undermining social cohesion and political stability.

The Danish Defence Intelligence Service (FE), for example, describes Russian intelligence services hiring intermediaries—often through social media—including individuals with no previous connection to intelligence activity who are recruited with reconnaissance, sabotage preparation, or influence operations through seemingly mundane assignments.^[6] These intermediaries are tasked to conduct espionage and sabotage operations across Europe, sometimes without the operatives themselves realising they are working for Russian intelligence. Other assessments note the increasing use of hybrid tools such as cyberattacks, influence campaigns, and the jamming of GPS signals affecting civilian and military navigation across the Baltic Sea region.^[7]

Hybrid confrontation has become a normal condition of European security rather than a temporary phenomenon associated only with wartime escalation

Norway’s Police Security Service (PST) likewise warns that Russian intelligence services are increasingly interested in mapping and potentially targeting critical infrastructure in Europe.^[8] The service highlights growing concern about surveillance and preparation activities directed at energy infrastructure, communications systems, and transport networks—an indicator that sabotage and disruption may form part of Russia’s broader toolkit for exerting pressure on European states.

This suggests that hybrid confrontation has become a normal condition of European security rather than a temporary phenomenon associated only with wartime escalation.

Signal 3: Societal Resilience Is Now National Security

One of the most notable shifts in recent years is the growing emphasis on societal resilience within intelligence reporting. Nordic and Baltic services increasingly address their societies directly, warning citizens about the risks posed by disinformation, foreign influence, and hostile intelligence activity.

This evolution reflects the recognition that modern security challenges extend beyond traditional military threats. Information manipulation, technological disruption, and social polarisation can undermine democratic institutions and weaken national resilience. As a result, the line between internal security and external defence has become increasingly blurred.

The reports, therefore, emphasise the importance of public awareness, media literacy, and institutional resilience as components of national defence. In doing so, they illustrate a broader transformation in how democratic societies conceptualise security in the twenty-first century.

Signal 4: China Appears Primarily as a Technological and Intelligence Challenge

While Russia remains the dominant concern in most Nordic and Baltic assessments, China appears increasingly across the reports as a strategic competitor in areas such as technology, research cooperation, and economic influence.

Unlike Russia, however, China is generally not framed as an immediate military threat to the region. Instead, the reports focus on issues such as technology transfer, intellectual property acquisition, and attempts to gain access to sensitive research and infrastructure.

For instance, Lithuania’s State Security Department (VSD) and Second Investigation Department (AOTD), which jointly produce Lithuania’s national threat assessment, warn that Chinese institutions actively pursue technological cooperation with western universities and research centres as a means of acquiring advanced knowledge and innovation.^[9] These partnerships—often framed as academic exchanges or joint research projects—may ultimately contribute to the development of China’s civil and military technology sectors.

This distinction reflects a broader European understanding of China as a long-term strategic challenge, particularly in areas related to technological competition and economic security.^[10]

Signal 5: Strategic Miscalculation Remains a Risk

Several assessments also highlight concerns about the internal dynamics of decision-making in Moscow. Intelligence services warn that Russian leadership may operate within increasingly isolated informational environments, where distorted threat perceptions and ideological narratives shape strategic choices.

Latvia’s intelligence assessment notes that Russian strategic decisions—including the 2022 invasion of Ukraine—appear to have been shaped by distorted threat perceptions within the Kremlin—both of western resolve and of Russia’s own success in its decade-long hybrid campaign against Ukraine—and the growing isolation of Russia’s political leadership, increasing the risk that Moscow may misinterpret western actions and escalate tensions.^[11]

Such conditions raise the risk of miscalculation. If Russian leaders interpret western policies through distorted lenses, they may take actions that escalate tensions or create new crises. This concern reinforces the importance of maintaining credible deterrence while avoiding misperceptions that could unintentionally escalate tensions—while avoiding misperceptions that could unintentionally escalate tensions—while recognising that recent experience has more often shown the opposite risk: that restraint, ambiguity, and delayed responses can invite further Russian risk-taking rather than dampen it.

Listening to the Signals

Annual intelligence assessments are often treated as technical documents intended primarily for domestic audiences. Yet they also serve another function: they signal how professional intelligence communities understand the evolving security environment.

The convergence across Nordic and Baltic assessments reflects not only shared geography but also decades of intelligence integration within NATO and among European partners

Intelligence professionals are accustomed to reading signals not only from adversaries but from one another. Public threat assessments, particularly among Allies, serve as a form of strategic signalling—indicating how national analytic communities interpret risk. When multiple services converge in their judgments, that convergence itself becomes an analytic signal.

Another important dimension of these reports is what they reveal about the strength of Allied intelligence cooperation itself. The convergence visible across Nordic and Baltic assessments reflects not only shared geography but also decades of intelligence integration within NATO and among European partners. When intelligence services operating under different political leadership, institutional cultures, and national priorities arrive at broadly similar conclusions about the strategic environment, it suggests that the Alliance possesses something valuable: a shared analytic understanding of the threats confronting it.

The Nordic and Baltic assessments reveal such convergence. Together, they describe a European security environment characterised by sustained confrontation with Russia, persistent hybrid pressure, increasing technological competition, and the growing importance of societal resilience. These examples reflect a broader pattern visible across the Nordic and Baltic intelligence assessments published in recent months.

For policymakers elsewhere in Europe and across the Atlantic, these reports offer a valuable perspective. The countries producing them sit on the geographic and strategic front line of Europe’s security environment. Their intelligence services have long monitored Russian activities closely, and their societies have experienced hybrid pressure firsthand. The lesson of 2022 was not only that the countries closest to Russia had the clearest view of the threat—but that much of Europe failed to act on those warnings in time. The annual intelligence assessments emerging from northern Europe suggest that those same services continue to see a future defined not by a rapid return to stability, but by a prolonged period of strategic competition with Moscow.

These assessments represent more than national reporting requirements. Taken together, they form a distributed system of strategic insight produced by intelligence services operating closest to Russian power. The convergence visible across these reports is not subtle. The question is no longer whether Europe has access to a clear warning—it is whether it is prepared to act on it.

^[1] Estonian Foreign Intelligence Service, International Security and Estonia 2026 (VLA, 10 February 2026); Constitution Protection Bureau of the Republic of Latvia, Annual Public Report 2025 (SAB, 26 January 2026); State Security Department of the Republic of Lithuania and Second Investigation Department, National Threat Assessment 2026 (VSD, AOTD, 6 March 2026); Finnish Security and Intelligence Service (Supo), National Security Overview (Supo, 13 February 2026); Swedish Military Intelligence and Security Service, MUST Annual Report 2025 (MUST, 29 December 2025); Norwegian Intelligence Service, Focus 2025: The Norwegian Intelligence Service’s Assessment of Current Security Challenges (NIS, 10 February 2025); Norwegian Police Security Service, National Threat Assessment 2026 (PST, 12 February 2026); Danish Defence Intelligence Service, Intelligence Outlook 2025 (FE, 18 December 2025).

^[2] SAB, Annual Public Report 2025.

^[3] FE, Intelligence Outlook 2025.

^[4] VLA, International Security and Estonia 2026.

^[5] MUST, MUST Annual Report 2025.

^[6] FE, Intelligence Outlook 2025.

^[7] Henrik Praks, “Russia’s hybrid threat tactics against the Baltic Sea region: From disinformation to sabotage,” European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), 30 May 2024.

^[8] PST, National Threat Assessment 2026.

^[9] VSD and AOTD, National Threat Assessment 2026.

^[10] European Commission and High Representative of the Union for Foreign Affairs and Security Policy, Joint Communication To The European Parliament, The European Council And The Council On “European Economic Security Strategy” (European Commission, 20 June 2023).

^[11] SAB, Annual Public Report 2025.