What would a Russian test of NATO actually look like?

CIA director John Ratcliffe travelled to Moscow on August 25th for meetings with senior Russian intelligence officials, the first publicly known visit to Russia by a serving CIA director since William Burns went there in November 2021. People familiar with the talks later told Reuters that Ratcliffe had raised the possibility of Russian operations against NATO, although they said this might not have been the main purpose of the trip. Russia’s support for Iran was also discussed. US President Donald Trump downplayed those reports, saying Vladimir Putin would not attack NATO territory and describing Ratcliffe’s visit as routine.

Moscow disclosed little more. Sergei Naryshkin, the head of Russia’s Foreign Intelligence Service, confirmed that he had met Ratcliffe and described their conversation as a working-level exchange on sensitive matters. Ratcliffe did not meet Putin, although the Russian president was briefed afterwards. Subsequent reporting indicated that Ukraine was also on the agenda. Axios said Ratcliffe met FSB director Alexander Bortnikov and discussed reviving negotiations, including the possibility of a meeting between Trump, Putin and Volodymyr Zelenskyy.

The visit has sharpened a question that appears with growing frequency in European security debates without having acquired a settled meaning. Officials and analysts warn that Russia may seek to “test NATO”, but the difficult cases are unlikely to resemble the opening of another conventional war. They are more likely to involve an airspace violation, sabotage, a cyberattack or another limited act whose effects are apparent before governments can establish intent and agree on what should follow.

When does an incident become a NATO test?

Keir Giles, a British specialist on Russian security policy and European security, is an associate fellow with Chatham House’s Russia and Eurasia Programme. He previously worked at the UK Defence Academy on Russian military, defence and security issues and has written extensively on Moscow’s relationship with the West.

Giles believes Russia has already been learning from the hostile activity directed at Europe. Moscow, in his assessment, would have little reason to risk an unmistakable confrontation with NATO unless it first had some confidence that the alliance would fail to respond as one.

“Russia will not move against a NATO country in an overt and unambiguous way unless it is confident that NATO as a whole is not going to respond,” Giles said. “There is only one way of establishing that confidence, and that is by testing.”

Sabotage, arson, drone incursions and other hostile activity can show how governments react, how quickly responsibility is attributed and whether an incident regarded as serious in one capital produces the same urgency elsewhere.

“The consistent sabotage and drone attacks are alarming, but there is no consensus over how to respond,” Giles said. “So in that respect, Russia has already succeeded.”

Claudiu Degeratu sets the threshold higher. A Romanian security and defence expert, he previously served as director general for defence policy and planning in Romania’s defence ministry and headed the defence section of Romania’s permanent delegation to NATO in Brussels.

“It has tested certain aspects militarily and operationally,” Degeratu said. “It has not tested NATO as an alliance at the level of decision-making cohesion.”

Giles and Degeratu differ mainly over the point at which observation becomes a test of the alliance itself. Giles includes what Moscow can learn from repeated hostile activity and the uneven responses it produces. Degeratu places the threshold at an episode that forces the allies to make a difficult political decision together.

What Romania’s drone incidents reveal

Romania provides a particularly visible record of what can be observed before an incident reaches that point. By August 28th, its defence ministry had recorded 43 unauthorised drone entries since the beginning of Russia’s full-scale invasion of Ukraine, including 25 in 2026. Four drones had been shot down this year, while the ministry’s dashboard listed 84 aircraft deployments for air-policing missions since the war began.

Official statements after individual incidents can disclose when an aircraft was detected, where it travelled and when air-policing procedures were activated. Civilian warnings provide another public record. Read across several episodes, Degeratu said, those details allow an observer to reconstruct parts of the response, from detection and tracking times to the speed with which authorities move to protect the population.

Political decisions are visible too. Emergency meetings, official statements and the point at which an incident is taken to NATO offer indications of how seriously a government regards the threat. Degeratu identified consultations under Article 4 of the North Atlantic Treaty as one particularly revealing threshold.

Article 4 allows a member to request consultations whenever, in its judgement, its territorial integrity, political independence or security is threatened. It does not require casualties, physical damage or proof of hostile intent, nor does it prescribe what the alliance must do afterwards.

Poland invoked the provision in September 2025 after Russian drones violated its airspace, followed later that month by Estonia after Russian fighter aircraft entered Estonian airspace. NATO responded to the Polish incident by launching Eastern Sentry, reinforcing air defence and surveillance along the eastern flank, and now says publicly that Russia has been testing its “resolve and responsiveness” in the region for years.

Degeratu is nevertheless reluctant to treat every Russian drone crossing an allied border as deliberate reconnaissance. Some aircraft have been damaged during attacks on Ukraine or travelled uncontrolled after being hit, and he said there was not enough information to establish a pattern in which every incursion had been designed as a test. A drone travelling deep into Romanian territory along a sustained route would raise different questions from one that fell shortly after crossing the border.

Even an accidental incursion leaves a record. Radar tracks the aircraft, fighters may be sent up, civilians can be warned and officials decide what to disclose. Moscow can observe that sequence whether or not the incident was deliberately created to produce it.

The harder judgement begins when the matter moves beyond the state directly involved. Allies may agree that an airspace violation occurred while differing over whether it was deliberate, how much evidence is needed before responsibility is assigned publicly and what kind of response is justified.

Degeratu described an Article 4 discussion in such circumstances as “the psychological moment when the Alliance has to demonstrate a certain degree of cohesion and solidarity”.

A more demanding case, he suggested, might take the form of a major cyberattack that was serious enough to require a collective response but still remained below the threshold of conventional war, leaving allied governments to act before attribution was fully settled.

Why Washington matters most

Among the variables Moscow might try to read, Giles places particular weight on the United States.

“All of those are variables which Russia can play on in order to reduce the probability of a unified NATO response,” he said of attribution, intent and the scale of an attack. “But the biggest variable is the attitude of the United States.”

An overt attack becomes far riskier for Moscow if it expects Washington to respond decisively. Greater ambiguity gives allied governments more room to differ over what happened and what response is warranted.

Ratcliffe’s presence in Moscow attracted Giles’s attention in that context. He suggested one possible explanation: Washington may have wanted to signal that it possessed intelligence about Russian plans or intentions without revealing how that information had been obtained. There is no public evidence that this was Ratcliffe’s purpose or that US intelligence had uncovered a specific Russian operation against NATO. Subsequent reporting has pointed to a broader agenda, including efforts to restart diplomacy over Ukraine. Giles explicitly presented the intelligence explanation as one possibility rather than an established account of the meeting.

European assessments of the immediate danger also differ. Polish Prime Minister Donald Tusk warned on August 28th of signs that Russia was preparing for further escalation and said the coming months could prove critical for Ukraine, Poland and the wider region. Finland’s president, Alexander Stubb, was more cautious a day later, saying he saw no concrete evidence that Moscow was preparing a direct attack on a NATO member. The two were not necessarily describing the same scenario: Tusk spoke of wider escalation, while Stubb addressed the prospect of a direct NATO-Russia war.

Giles disputes the assumption that Russia’s commitment of ground forces to Ukraine leaves it unable to exert pressure elsewhere. He is also sceptical that an eventual ceasefire would automatically make neighbouring countries safer.

“Even when there is a ceasefire in Ukraine, if major combat operations cease, the situation for European countries – particularly those in Ukraine’s neighbourhood – becomes immediately more dangerous, not less,” he said.

Russian forces, he argues, would gain more room to rebuild just as European governments might begin slowing their own defence preparations.

Why ambiguity is harder around the Black Sea

Around the Black Sea, NATO members Romania, Bulgaria and Turkey share a security space with Ukraine at war and Moldova outside the alliance. Degeratu believes the region offers considerable scope for incidents whose security consequences become apparent before Russian intent can be established, pointing to possible crises involving Moldova or Romania’s exclusive economic zone.

A drone may cross a border deliberately or after being damaged or jammed, while a cyberattack can disrupt essential systems before investigators are ready to identify its origin publicly. Activity below the threshold of conventional war becomes particularly difficult to manage, Degeratu argues, when its physical consequences can be established more quickly than the intention behind them.

Moldova faced another such episode before dawn on August 27th during a Russian attack on Ukraine. Border Police patrols reported several drone overflights, also confirmed by Ukraine’s State Border Guard Service. One crossed Moldovan airspace near Palanca at 03:56 before returning to Ukraine; another entered near Căplani three minutes later and disappeared from Ukrainian radar near Carahasani, while a third travelled along the south-eastern border before disappearing near Pervomaisc in the Transnistrian region.

Moldova has none of the consultation or collective-defence mechanisms available to Romania on the other side of the border. Its constitution declares permanent neutrality, while Russian forces remain in the Transnistrian region. Degeratu does not regard neutrality as preventing Moldova from strengthening its national defence or developing military cooperation with partners, but argues that unresolved questions of sovereignty leave the country with a political decision over the defensive posture it is prepared to build.

Giles put the predicament more succinctly.

“Neutrality is a brave choice when you live in a rough neighbourhood.”

Degeratu places the decisive threshold later, when an incident is no longer principally a problem for one radar system, air force or government and the allies have to judge the same event together, with the facts still contested and the consequences of their decision much larger.

“So far, we have not had such a test,” Degeratu said. “I hope we don’t.”

Ana Pisarenco is a journalist based in Moldova. She runs the independent media project eurOpinii.