Back to analyses
THRESHOLD BriefsUpdated2022 comparisonRussia–NATODeterrence

Are we closer to 2021 or February 2022?

Comparing current Russia–NATO signals with the warning pattern preceding the full-scale invasion of Ukraine.

Published: 2026-09-15Updated: 2026-09-1718 min readConfidence: High

Executive thesis

The current picture resembles sustained confrontation and pressure more than the immediate run-up to February 2022. Most importantly, mass concentration, logistics and combat formation against NATO are absent. [1], [2]

This does not mean a return to low risk. The most plausible path to crisis today runs not through a visible plan for a major invasion, but through a limited incident, mistaken attribution, or a sequence of reciprocal moves under time pressure. [1]

The judgment is therefore twofold: strategic similarity to February 2022 remains limited, while operational risk near NATO borders is real and higher than troop counts alone would suggest. [1], [3]

What we know

The sample contains no equivalent of the months-long, multi-axis force deployment that preceded the invasion of Ukraine. It does not show large numbers of units leaving garrisons alongside forward fuel and ammunition stocks, field hospitals, and aviation aligned to one operational logic. [2]

We do observe elevated hybrid activity, navigation risk, and repeated strikes in western Ukraine. NATO maintains enhanced surveillance and air policing, while Poland periodically raises air-defence readiness. These are material developments, but in the current configuration they remain primarily precautionary and defensive. [1], [3]

We separate observed activity from attributed intent. Russia’s capacity to exert pressure, disrupt, and test responses is not by itself evidence of a decision for war with NATO. [1]

Analytical framework

Facts

No comparable troop concentration is observed. Hybrid activity and incident risk are elevated. NATO posture remains calibrated and defensive.

Assessment

The distinction between capacity for pressure and capacity for invasion is decisive. Today’s signals raise X+1 risk but do not recreate the full 2022 package.

Uncertainties

Intent, the readiness of some units, and classified rules of engagement remain incompletely visible.

What would change this assessment

A large sustained concentration combined with logistics, field medicine, changed aviation posture, and public intelligence warnings.

What it may mean

Russia may regard below-war pressure as simultaneously cheap, reversible, and politically useful. Cyber operations, sabotage, electronic interference, and activity near borders complicate NATO decision-making without requiring an invasion force. [2], [3]

For the Alliance, this means sustaining high situational awareness without automatically treating every episode as a precursor to attack. Overreaction may reinforce Russian escalation narratives; a response that is too slow may invite further testing. [1]

Competing interpretations

The first interpretation sees current activity as controlled coercion: Moscow seeks to raise the cost of supporting Ukraine and probe Alliance cohesion while avoiding deliberate confrontation. The absence of correlated offensive preparation supports this reading. [1], [2]

A second interpretation is that options are being prepared for later use. Routine activity can build familiarity with the operating environment, mask anomalies, and shorten the time needed to move to a higher level. This does not require an escalation decision to have been made. [2]

A third possibility is organisational drift: local decisions, political pressure, and operational-plan momentum may produce a sequence neither side designed as a whole. This is why the assessment considers decision time and reversibility, not intent alone. [1], [3]

Historical comparison

Dimension2021/22Current
ConcentrationMass and multi-axisNo comparable pattern
LogisticsForward and expandingNo correlated surge
Political coverUltimata and justificatory narrativeHostile rhetoric without a new ultimatum
Incident riskRose with preparationsElevated near borders
Intelligence warningsPublic, specific invasion warningsWarnings of risk, not imminent attack

Escalation pathways

The most credible short pathway begins with an event of ambiguous intent: missile debris, an airspace violation, sabotage, or infrastructure disruption. Pressure for rapid attribution may outrun full verification. [3]

The next step depends on casualties, repetition, and visible responsibility. A single incident may be contained through communication and a proportionate response. A series of events or a deliberate strike creates pressure to demonstrate credibility and moves the assessment toward level 2 of the ladder. [1]

The most serious pathway would require an incident to connect with a pre-positioned military capability. That element is not currently visible, which is why full-scale war risk remains below limited-confrontation risk. [1], [2]

Similarity in one signal does not imply similarity in the whole scenario.

Editorial assessment · DEMO

Counterarguments

The absence of mass concentration does not guarantee safety. Russia possesses long-range capabilities, assets in Kaliningrad and Belarus, and non-military tools capable of producing a crisis without a classic ground deployment. [1], [2]

Visible indicators may also emerge later or be partly concealed. The assessment therefore does not say conflict is impossible; it says the available evidence does not currently match the pattern of direct preparation for war seen in 2022. [2]

Uncertainties

Political intent and how leaders would interpret a sudden event involving casualties remain the largest unknowns. Open information reveals equipment movement more readily than decision-makers’ tolerance thresholds. [1]

Visibility is also incomplete regarding stocks, the readiness of some missile systems, rules of engagement, and the quality of deconfliction channels during a crisis. These gaps reduce confidence in precise forecasts without invalidating the structural comparison. [1], [2]

What would change the assessment

The assessment would move materially higher if several signals appeared together: sustained movement of units out of garrisons, forward fuel and ammunition logistics, medical support, aviation concentration, and public warnings identifying specific intent. [1], [2]

A faster change would follow confirmed casualties on NATO territory, repeated deliberate violations, or correlated action from Belarus and Kaliningrad. Conversely, a sustained decline in border and hybrid activity, supported by credible de-escalatory communication, would lower the current assessment. [1], [3]

Sources and notes

Publisher names and original titles remain in their canonical form.

  1. [1]NATONATO’s deterrence and defence posture2026-09-17
  2. [2]OSWOśrodek Studiów Wschodnich — Analizy2026-09-17
  3. [3]ReutersEurope security coverage2026-09-17

Version history / assessment changes

2026-09-17
Updated

Added the significance of compressed warning time in western Ukraine.

2026-09-15
Unchanged

Initial publication of the demo assessment.