Europe Rearms for a 'Shadow War': How Russian Sabotage Is Driving Record Defense Spending

This shift is already visible in national balance sheets. Poland plans to allocate 4.8% of its GDP to defence in 2026, while Germany’s defence budget has reached €117.2bn. The scale of this spending points to a fundamental change in European thinking: the threat is no longer measured solely by the number of troops Russia might send across a border, but by the vulnerability of the everyday systems on which the continent relies.

There is no need to predict an imminent Russian attack on NATO territory to see why this matters. The harder problem is a prolonged confrontation in which individual incidents remain limited, but the effort required to prevent the next one keeps growing.

The difficulty of proving an attack

Europe has already seen how exposed its infrastructure can be. Railway networks in the Netherlands and Poland, energy facilities near Amsterdam, a commercial centre in Vilnius and Germany's Leipzig/Halle airport have all featured in reports of incidents linked to the broader threat of Russian sabotage. Damage to Baltic subsea cables and pipelines has raised further concerns.

Yet attribution is rarely straightforward. Investigations into cable damage involving the Yi Peng 3 and Eagle S, for example, have considered accidental anchor dragging. A broken cable is evidence of a problem, not necessarily proof of a deliberate operation.

For governments, that distinction has practical consequences. An intentional attack may call for intelligence cooperation, criminal investigation and a coordinated political response. An accident requires repairs and, potentially, changes to maritime safety. Confusing the two could waste resources or create a diplomatic crisis. Failing to recognise deliberate interference carries its own risks.

This is where hybrid warfare becomes particularly difficult to counter. Authorities may suspect a connection between separate incidents without having enough evidence to establish one publicly. Meanwhile, infrastructure operators still have to keep services running, repair damage and pay for additional security.

The burden accumulates. A railway company cannot wait for a geopolitical investigation to finish before addressing a vulnerability. Energy providers and telecommunications operators face similar choices. Each incident can generate new costs even when the identity and intentions of those responsible remain uncertain.

The 152 cases identified by the European Parliament provide a measure of the problem, although the figure does not mean that every unexplained disruption across Europe was Russian-directed. The important point is the sustained pressure on systems that were not designed to operate under a permanent risk of hostile interference.

Rearmament is becoming part of ordinary government spending

Poland's planned allocation of 4.8% of GDP to defence reflects the security concerns of a country close to Russia and central to NATO's eastern flank. Germany's €117.2bn defence budget shows how far the shift extends beyond the states most directly exposed to Russian military activity.

The money is needed for conventional deterrence, but the requirements have changed. European militaries must also improve their ability to detect and intercept drones, defend airspace and protect installations whose disruption could have consequences far beyond a single location.

For Poland and the Baltic states, these are not separate tasks. Military infrastructure, transport routes and energy networks form part of the same strategic environment. A weakness in one area can complicate the defence of another. Finland also has a direct interest in the security of Europe's northern approaches.

The growing emphasis on layered air defence and counter-drone systems is one response. Another is closer cooperation between intelligence services, armed forces and civilian authorities. NATO's Block, Blunt, Break framework addresses the deterrence of conventional aggression, while the expanding range of hybrid threats requires continuous monitoring and coordination.

This is a more demanding model of defence than simply buying additional weapons. Governments must protect fixed installations, prepare for disruption and make sure that different national systems can work together. Civilian operators need to know what to do when an incident occurs, and military planners must account for vulnerabilities that may lie outside their direct control.

There is also a financial trade-off. Defence contracts can run for years, while the benefits of better protection are often difficult to measure. A system that prevents an attack leaves little visible evidence of what the money achieved. Yet waiting until damage occurs can prove more expensive.

For European governments, the question is how to maintain these investments without treating every new incident as a reason for an unplanned spending surge.

Putin cannot assume that Russians are untouched by the war

The Kremlin is facing pressure on the home front as well. Former Russian journalist Alexandra Prokopenko, who fled to Germany in 2022, has described growing disillusionment among Russians, while accounts from inside the country point to mounting economic strain.

The war's costs are not confined to government balance sheets. Military mobilisation threatens to disrupt individual lives, and fears of nuclear escalation add to the sense that the conflict could become much worse. Some Russians are trying to avoid conscription or expressing opposition quietly rather than openly challenging the authorities.

That distinction matters in a country where dissent can carry severe prison penalties and state propaganda shapes the public information environment. The absence of mass demonstrations cannot be taken as evidence of widespread enthusiasm for the war. But neither does private dissatisfaction necessarily translate into organised opposition capable of threatening Putin's rule.

The economic pressure is also uneven. Some members of the elite continue to profit from the conflict and have little incentive to support a change of course. Others must contend with the effects of a war that consumes resources and exposes the economy to mounting strain.

The damage caused by Ukrainian counter-strikes adds a more tangible dimension. Oil refineries have been hit, while warehouses have been set ablaze. Such attacks do not establish that the Russian state is approaching collapse, but they make it harder to present the war as something taking place entirely beyond the country's borders.

Domestic discontent and military pressure may restrict the Kremlin's room for manoeuvre. They do not necessarily make its behaviour easier to predict. A government under strain might seek to reduce its commitments; it might also tighten political controls and continue its confrontation with the West.

European policymakers cannot safely base their plans on the assumption that economic hardship will force Moscow to retreat.

The danger lies in a miscalculation

The deterioration of arms control creates another source of uncertainty. New START expired in 2026, removing an important part of the framework governing strategic nuclear forces between Russia and the United States. Its expiration does not make nuclear war inevitable, but it weakens the arrangements that previously helped place limits on strategic competition.

That matters when military activity and infrastructure incidents occur in an atmosphere of deep mistrust. In the Baltic Sea, where subsea networks sit alongside sensitive maritime routes and military interests, the consequences of a mistaken judgement could extend beyond the original incident. Kaliningrad adds to the sensitivity of the region.

An unexplained disruption may initially appear minor. The difficulty begins when officials must decide whether it was accidental, criminal or part of a coordinated campaign. A response that seems proportionate to one government may look like escalation to another. Conversely, an absence of consequences may encourage further attempts to test the limits of Europe's response.

The challenge for NATO is to make the costs of deliberate attacks clear without treating every ambiguous event as an act of war. Better intelligence sharing and more resilient infrastructure can reduce the room for uncertainty, although neither can eliminate it.

The loss of arms control mechanisms makes that discipline more important. When governments have fewer reliable arrangements for managing strategic competition, they must be especially careful not to mistake a local confrontation for evidence of a wider military move.

A war of attrition beyond Ukraine

Russia's campaign against Ukraine remains the central military conflict, but its consequences increasingly shape security decisions across Europe. The effects are visible in procurement plans, infrastructure protection and the budgets governments are prepared to commit over several years.

The Kremlin may hope that repeated disruption will force European countries to divert resources, exhaust public patience and argue over the appropriate response. Yet the same pressure is encouraging NATO members to strengthen their defences and take vulnerabilities more seriously.

For European businesses, the adjustment means higher costs for security and contingency planning. For governments, it means accepting that defence can no longer be confined to the armed forces. Transport, energy and communications networks have become part of a broader security calculation.

The political challenge is less straightforward. Voters can see the cost of rearmament in public budgets, but the danger it is intended to prevent may remain invisible. An isolated incident may not justify a dramatic response; dozens of incidents over several years can still change the way a country operates.

Russia's economic difficulties offer no reliable timetable for the end of this confrontation. Nor is there a clear point at which European governments can declare their infrastructure sufficiently protected. The security burden is likely to remain even if the intensity of individual incidents fluctuates.