Escalation, Step by Step: How X+1 Can Become a War Nobody Planned

The most dangerous scenario for a direct confrontation between Russia and NATO does not have to begin with a decision to start a war. It can begin with a decision that, at the moment it is made, appears limited, rational and safe.

On 14 September 2026, an Italian fighter jet operating on a NATO mission shot down a drone that had entered Lithuanian airspace from Belarus. The aircraft was initially suspected to be a Russian Geran-2. Subsequent reporting raised the possibility that it was a Gerbera, a cheaper design used by Russia, among other purposes, as a decoy against Ukrainian air defences. Lithuanian authorities investigated its origin, equipment and the circumstances of the airspace violation. The interception itself did not establish whether the flight over Lithuania had been intentional.

At almost the same time, Denmark reported a separate incident. According to the Danish armed forces, on 14 September a Russian frigate fired two flares towards a Danish Fennec helicopter conducting routine surveillance of the vessel over international waters near Gedser. One flare passed close to the aircraft. Russia disputed Denmark’s account and accused the helicopter crew of provocative manoeuvres.

In the following days, Poland scrambled military aircraft and raised the readiness of its ground-based air-defence systems in response to Russian strikes on Ukraine. Following operations on 17 and 19 September, the Polish military reported that Polish airspace had not been violated.

None of these events, taken on its own, means that Russia and NATO are at war. Nor does any one of them necessarily indicate a deliberate Russian attempt to provoke a crisis. They do, however, illustrate the conditions in which Russian and NATO forces operate in close proximity. They are armed; some decisions must be made quickly; and neither side has complete knowledge of the other’s intentions, orders or operational constraints.

Under these conditions, asking whether Russia or NATO wants a war remains important, but it is no longer enough to assess the risk. An equally important question is whether both sides retain the ability to stop the process before the consequences of earlier actions begin to narrow the choices available when the next decision must be made.

Si vis pacem, para bellum

In everyday language, escalation often means an increase in violence. In strategy, the concept is broader. It encompasses changes in the intensity, scope, character or conditions of a confrontation that can alter the other side’s assessment of costs, risks and possible gains.

Escalation may involve using greater force, expanding the geographical area of a conflict, entering a new domain, raising military readiness or employing a capability that had previously been deliberately withheld. It is also possible to escalate without directly increasing the level of violence, by increasing the risk that the confrontation will develop further in ways that neither side can fully control. Moving armed forces closer to an opponent, shortening reaction times or adopting more aggressive rules of engagement can make the next incident harder to contain, even when nobody plans an attack at the time those measures are taken.

It is therefore useful to distinguish between two mechanisms that often operate simultaneously in a real crisis. The first is deliberate: one participant intentionally increases pressure by moving forces, raising readiness, expanding operations or demonstrating a new capability in order to influence the other side’s behaviour.

The second does not require an intention to escalate. More troops, aircraft, ships and weapons systems operating near one another create more opportunities for an error, malfunction, misinterpretation or decision by a local commander to produce a problem that requires intervention at a higher level.

The two mechanisms can reinforce one another. A state may deliberately increase pressure to achieve a political or military objective while also — without intending to — increasing the number of events whose subsequent course it will no longer fully control.

Crucially, escalation does not have to be intended to start a larger war. It may be used precisely to prevent one: to raise the cost of the opponent’s continued actions until withdrawal, a change of course or negotiations appear safer than further confrontation.

This is not merely a Western theoretical construct. In their analysis of Russian military thought for CNA, Michael Kofman, Anya Fink and Jeffrey Edmonds describe a Russian model of strategic deterrence developed over several decades and understood more broadly than nuclear deterrence alone. It encompasses demonstrations of force, heightened readiness, troop deployments, threats of strikes and the possibility of imposing costs incrementally in order to influence an opponent’s behaviour, limit escalation or end a conflict on acceptable terms. The authors also caution against reducing the entirety of Russian strategy to the popular slogan “escalate to de-escalate.”
Source: CNA: Russian Strategy for Escalation Management

The mechanism works, however, only if pressure produces the desired response. If the opponent responds to pressure with an increase of its own, the process begins to change the conditions under which both sides make their next decisions.

A Boundary You Cannot See Until You Cross It

There is no need to guess Vladimir Putin’s psychology in order to examine Russia’s willingness to take risks. We can study its actions, strategic documents and earlier cases in which the Russian leadership used military force, or the threat of it, as a political instrument.

In his speech at the Munich Security Conference in 2007, Putin openly challenged the post-Cold War security order, criticising, among other things, the dominance of the United States and NATO enlargement. The speech was not itself an announcement of future wars, but it publicly articulated an increasingly confrontational Russian interpretation of Europe’s security arrangements.
Source: Putin’s Munich speech, 2007

A year later, war broke out with Georgia. Its immediate origins require careful description because subsequent political narratives have often simplified the responsibility of one side or the other. Abkhazia and South Ossetia had remained unresolved conflicts since the dissolution of the Soviet Union. Russia was simultaneously a patron of the separatist authorities and a formal participant in peacekeeping arrangements. Throughout 2008, incidents and provocations increased on both sides.

An independent international fact-finding mission established by the European Union concluded that Georgian shelling of Tskhinvali during the night of 7–8 August initiated the large-scale phase of open warfare, and that the use of heavy artillery did not meet the requirements of necessity and proportionality. The report also emphasised that the attack was the culmination of a prolonged period of mounting tensions, incidents and provocations, and that responsibility for the conflict as a whole could not be reduced to a single night. Russia’s response rapidly extended far beyond South Ossetia: Russian forces advanced deep into Georgian territory, and the scale of some subsequent operations likewise lacked justification under international law.

A six-point ceasefire plan was agreed on 12 August through European Union mediation. Shortly afterwards, Russia recognised the independence of Abkhazia and South Ossetia. The European Union continues to regard both territories as parts of Georgia under Russian control.

Georgia illustrates an important distinction between the date on which an open war begins and the beginning of the process that leads to it. The first can be identified relatively precisely. The second consists of many earlier decisions, provocations, changes in readiness and mistaken assessments of the other side’s intentions.

Uncertainty as a Tool

Following the flight from Kyiv of Ukraine’s then-president Viktor Yanukovych in February 2014, soldiers without identifying insignia appeared in Crimea. On 27 February, they seized, among other sites, the buildings of the parliament and government of the Autonomous Republic of Crimea. The European Court of Human Rights subsequently found that Russia had exercised effective control over the peninsula from that date.

Under the control of forces whose presence had fundamentally changed the political situation on the peninsula, the Crimean parliament appointed a new government and accelerated preparations for a referendum on Crimea’s future status. The vote took place on 16 March. Voters were offered two options: joining the Russian Federation or restoring Crimea’s 1992 constitution while remaining part of Ukraine under altered arrangements. There was no option to retain the existing status quo.

The UN General Assembly subsequently adopted Resolution 68/262, declaring that the referendum had no validity and could not form the basis for any alteration of the status of Crimea or Sevastopol. On 18 March, Russia signed an agreement incorporating the peninsula into the Russian Federation.
Source: UN: Territorial Integrity of Ukraine, Resolution 68/262

At the same time, the crisis was spreading to eastern Ukraine. In Donbas, pro-Russian armed formations seized administrative buildings and additional territory. The European Court of Human Rights later established beyond reasonable doubt that Russian military personnel had been present in Donbas from April 2014, that Russia had supplied separatists with weapons and equipment on a substantial scale, and that a large presence of regular Russian forces existed by August at the latest. The Court found that areas controlled by the separatists had been under the effective control of the Russian Federation since 11 May 2014.
Source: ECHR: Ukraine and the Netherlands v. Russia

From the perspective of escalation, the initial ambiguity was particularly significant. Before a state under attack can decide how to respond, it must first establish what has actually happened and what action it is responding to. In Crimea, this was not simply a matter of identifying armed men. Decision-makers had to assess whether they were dealing with a local rebellion, externally supported formations, a Russian military operation or some combination of these; who was issuing orders; how extensive Russia’s involvement was; and whether the operation had a limited objective or was the beginning of something larger.

This ambiguity has strategic significance because it delays the point at which an opponent can develop a coherent assessment and agree on a response. Different participants in the crisis possess different fragments of information and may interpret the same events differently. The government of the state under attack must avoid two errors at once: responding too weakly to a genuine operation by an opponent, and responding too forcefully to an event whose character it does not yet understand.

This creates a military grey zone: a space in which armed forces, military capabilities or the threat of their use are employed in ways that make it difficult to establish clearly who is responsible, what kind of operation is taking place, or where pressure ends and open warfare begins. The actor conducting the operation can observe the opponent’s reactions, adjust its own actions, increase or decrease their intensity, and exploit the time the other side needs to establish what is happening. Ambiguity does not make such actions cost-free, but it can delay a consolidated political and military response.

This does not mean that the 2008 war with Georgia, the seizure of Crimea and Russian involvement in Donbas in 2014, and the full-scale invasion of Ukraine in 2022 were successive stages of a single plan drawn up by Putin in advance. They were actions undertaken in different circumstances, with different immediate objectives and different instruments.

The common element lies elsewhere. In each case, the Russian leadership was prepared to use military force, the threat of force or ambiguity about the extent of Russian involvement to compel a change in an existing political or security situation.

In late 2021, Russia combined a major concentration of troops around Ukraine with demands for far-reaching changes to Europe’s security system. NATO rejected restrictions on states’ right to choose their own alliances and arrangements that would effectively create two categories of Alliance members. It nevertheless proposed talks on arms control, the transparency of military exercises, incident prevention, and military and civilian communication channels.
Source: NATO: Written proposals conveyed to Russia, January 2022

A useful model of Russian decision-making therefore does not have to begin with the question, “Does Putin want a war with NATO?” A more analytical question is: Could the Russian leadership conclude that, by increasing costs and risks incrementally, it can induce an opponent to behave in a way that diplomacy alone could not achieve?

We can look for an answer by examining Russian actions, strategic documents, earlier responses to resistance and the ways in which Moscow adjusted pressure in previous crises. That does not require us to guess what Putin thinks about before he goes to sleep.

Red Lines Are Not Lines

A strategy based on gradually increasing pressure has a fundamental weakness. To know how far it can go, one side must correctly assess the boundary beyond which its opponent will regard further restraint as more dangerous than responding.

That boundary is rarely known precisely in advance. Sometimes an opponent deliberately conceals it. Sometimes it cannot declare it precisely because its response will depend on the circumstances of a future crisis. And sometimes it does not itself know where the boundary lies until it faces a specific situation.

States deliberately leave many of their red lines imprecise. If NATO told an opponent that it would tolerate every action up to an exactly defined point, it would also provide instructions for operating just below that point. Too much ambiguity, however, creates the opposite risk: an opponent may assume that the next step, too, will fail to provoke a decisive response.

An action that does not produce the expected response therefore becomes information used in planning the next one. It does not prove that the next step will also be safe — the situation, perception of the threat and political tolerance of the opponent may all change — but it may encourage decision-makers to revise their assumptions about acceptable risk.

This is where brinkmanship, a concept developed by the American economist and strategic theorist Thomas Schelling, becomes especially useful. The starting point is the problem of making a threat credible. If carrying it out would also mean catastrophe for the side issuing it, an opponent may reasonably doubt whether the threat would actually be fulfilled.

Schelling pointed out, however, that coercion need not depend on a credible promise to start a catastrophe deliberately. A state can create a situation in which the probability increases that further developments will no longer depend entirely on a single, calm political decision made at a later stage. More forces are placed on alert, commanders receive broader authority, reaction times shorten, opportunities for accidents or misinterpretation increase, and political pressure makes it harder to retreat from earlier declarations.

Schelling described this as a threat that leaves something to chance. “Chance” does not mean that war becomes automatic. Even after an accident, false alarm or unauthorised action, people still make decisions. The uncertainty arises because, as the crisis develops, no participant controls all the variables affecting the next choice.

Risk itself can therefore become an instrument of coercion. One side is no longer presenting its opponent solely with the choice, “Concede, or I will do X.” It may instead create a situation in which continued refusal to concede forces both sides to operate within an increasingly unpredictable system, where the consequences of an error become progressively greater.

The Cuban Missile Crisis is a particularly useful case because it allows us to examine this mechanism not as an abstract theory but as a series of actual decisions made by two nuclear-armed powers.

Cuba: A [Not So] Simple Crisis

In the simplified version of the story, the Soviet Union placed nuclear missiles in Cuba, the United States discovered them, US President John F. Kennedy stood up to Soviet leader Nikita Khrushchev, and Moscow eventually backed down.

That account contains true elements, but hindsight gives the events a degree of order they did not possess for those making decisions in October 1962. Kennedy and Khrushchev did not know how the crisis would end. They lacked complete information about their opponent’s forces, did not control every action of their own military organisations and could not be certain how the next move would be interpreted.
Source: US Department of State: The Cuban Missile Crisis

After the Soviet missiles were discovered, the Kennedy administration considered several significant courses of action, each carrying serious costs or risks. It could tolerate the missile deployment and respond politically or by further strengthening deterrence. It could launch an air strike against the installations without knowing whether all of them had been located or would be destroyed. A wider air operation would also mean attacking Soviet air defences and would probably kill Soviet personnel. An invasion of Cuba was considered as well. It offered the greatest prospect of physically removing the threat, but also created the greatest risk of direct war with the Soviet Union.

Kennedy chose an intermediate option: a maritime “quarantine” of Cuba. The United States deployed ships along interception lines and announced that vessels approaching the island would be stopped to prevent further deliveries of offensive weapons. A ship carrying such cargo would be turned back. This was not a comprehensive blockade cutting Cuba off from all trade; initially, it was limited to offensive military equipment. The term “quarantine” also had legal and political significance: Washington avoided the word “blockade”, traditionally associated with an act of war.

The choice is particularly interesting from the perspective of escalation management. The quarantine was a real military action intended to impose a restriction, but it did not immediately determine whether a direct clash would occur. To a significant extent, the next decision passed to the Soviet side: its ships could continue and risk interception, stop, or turn back.

The quarantine did not remove the missiles already in Cuba and did not resolve the crisis by itself. It did, however, change its pace. Unlike an air strike, it did not immediately kill Soviet soldiers or require Moscow to decide within minutes how to respond to an American attack. It created pressure while leaving time for communication and the possibility of changing course without immediately entering an open war.

The essence of controlled escalation in this case was not the mildness of the action. It was an attempt to increase pressure while preserving an alternative to military retaliation for the opponent. The United States raised the cost of continuing the Soviet operation and retained the option of further escalation, but did not deprive Khrushchev of the possibility of stopping the ships, beginning negotiations or seeking another solution.

Black Saturday

On 27 October, the day later known as “Black Saturday”, an American U-2 reconnaissance aircraft was shot down over Cuba. Its pilot, US Air Force Major Rudolf Anderson, was killed. The decision to open fire was not the result of a direct order from Khrushchev as part of a plan to escalate the crisis. Meanwhile, preparations for a possible attack on Cuba were continuing in Washington.
Source: US Department of State: The Cuban Missile Crisis

On the same day, American vessels attempted to force the Soviet submarine B-59 to surface using small signalling charges. Conditions aboard the submarine were extremely difficult: communications were poor, batteries were running low, and the temperature inside was very high. B-59 was equipped with a nuclear-armed torpedo.

Its commanding officer, Captain Second Rank Valentin Savitsky, interpreted the situation as a possible attack, and the preparation of the nuclear torpedo for use was considered. Also aboard was Captain Second Rank Vasily Arkhipov, chief of staff of the 69th Submarine Brigade. He played an important role in persuading Savitsky that the American actions were intended as signals to force the submarine to surface, rather than as the beginning of a war. The popular claim that “one man saved the world” simplifies a more complex decision-making process, but the documentary record confirms that the possibility of using the nuclear torpedo was taken seriously.

American planners also did not know how much tactical nuclear weaponry was already present in Cuba. The Soviet deployment plan included, among other weapons, 80 warheads intended for FKR-1 cruise missiles. Documents released after the Cold War indicate that some warheads were moved to units on 26 October and that the weapons were ready for use the following day. American intelligence did not know that these warheads were present during the crisis.

This changes how the crisis should be understood. A possible American invasion would not simply have led to a conventional clash after which the leaders of both powers could calmly decide whether to move to the next level. It could have set in motion events about which one side knew nothing and over which the leaders in Washington and Moscow did not have full control.

Each participant was therefore making decisions on the basis of a different fragment of the same reality. Missing elements were replaced with assumptions about the opponent’s intentions, capabilities and likely responses.

The Crisis’s Second Channel

At the same time as the public confrontation, talks were taking place out of public view. On the evening of 27 October, US Attorney General Robert F. Kennedy — the president’s brother and one of his closest advisers — met Soviet Ambassador to the United States Anatoly Dobrynin.

Kennedy conveyed that time to resolve the crisis was running out. The conversation also addressed American Jupiter missiles deployed in Turkey. Washington would not agree to a public “Cuba for Turkey” exchange that would appear to be a concession extracted by Soviet pressure. Privately, however, Moscow was told that the Jupiters would be removed within a few months, provided that this did not become part of the public agreement.

On 28 October, Khrushchev announced that the Soviet missiles in Cuba would be dismantled. The United States publicly pledged not to invade the island, and the Jupiters were subsequently removed from Turkey.
Source: US Department of State: The Cuban Missile Crisis

Public pressure and the search for a compromise through back channels were not contradictory strategies. They served different purposes. The first was intended to maintain the credibility of a position and the ability to apply further pressure. The second made it possible to establish the real limits of concessions more precisely and find a solution that neither side had to present to its own public as capitulation.

Be Silent When You Speak

This does not mean that a secret communication channel necessarily exists during every contemporary Russia–NATO crisis, even if we know nothing about it. The absence of public information is not evidence that back-channel talks are taking place. Nor is it evidence that they are not. During a crisis, states may limit their public statements while exchanging information, warnings or proposals through diplomats, military commanders, intelligence services or informal intermediaries.

Such communication does not have to be aimed at negotiating an agreement. Sometimes its purpose is much narrower, but equally important: explaining that a particular military movement is defensive; communicating where a planned operation is intended to end; establishing whether an incident was deliberate; or making sure a warning has reached someone able to influence subsequent actions. Not every exchange brings positions closer together. It can nevertheless reduce the risk that one side will make a decision based on a mistaken understanding of the other’s intentions.

The Cuban Missile Crisis provides an example of communication conducted not only away from the cameras, but also outside the ordinary channels of official negotiations. On 26 October 1962, Aleksandr Fomin, an official at the Soviet embassy in Washington, met John Scali, a journalist with the American television network ABC. Fomin outlined a possible resolution: dismantling Soviet missile installations in Cuba in exchange for an American commitment not to invade the island. Scali passed the proposal to American officials and then returned to Fomin with a signal that Washington saw a possibility for talks, but that very little time remained. Surviving documents show that Fomin asked whether the response came from a senior level and that Scali confirmed it did.

This channel did not replace the official letters exchanged by Kennedy and Khrushchev or Robert Kennedy’s later meeting with Dobrynin. It did, however, allow the possibility of a compromise to be tested before either side committed itself publicly to a particular position. In a crisis, that exploratory function has value in its own right: a proposal can be clarified, rejected or modified without immediately turning it into a public ultimatum. At the same time, an informal intermediary creates a problem of its own — the other side must assess whether that person really is conveying the position of officials authorised to make a decision.

Military communication serves a different function. Its purpose may not be to resolve the wider conflict, but to prevent an unintended clash. In March 2022, after the beginning of Russia’s full-scale invasion of Ukraine, the Pentagon confirmed that a bilateral line had been established to prevent incidents between US and Russian forces. The US Department of Defense said that the line was being tested regularly and that the Russian side was answering calls. This did not amount to a political agreement or acceptance of Russia’s actions in Ukraine. It meant preserving the technical ability to speak if the operations of the two forces risked bringing them into direct contact. It was a US–Russia channel, not a line operating on behalf of NATO as a whole.

In October that year, then-US Secretary of Defense Lloyd Austin spoke by telephone with Russian Defence Minister Sergei Shoigu. According to the Pentagon’s published account, Austin warned against using pretexts for escalation and emphasised the importance of maintaining communication during the war. The fact that the conversation took place does not establish that the sides reached an agreement on any issue. It does show, however, that conveying a warning to an opponent and preserving the possibility of further contact can be considered necessary even when the underlying political and military conflict remains unresolved.

Georgia provides another example. Along the administrative boundary line with South Ossetia, an Incident Prevention and Response Mechanism, supported by the European Union Monitoring Mission and the OSCE, is accompanied by a hotline managed by the EU mission. The line allows rapid contact over security matters and incidents affecting residents of the areas near the boundary. Meetings of the mechanism have addressed, among other issues, detentions, restrictions on freedom of movement and the activities of security personnel. Mission statements have stressed the importance of rapid information exchange through the hotline in clarifying incidents and reducing tensions.
Source: European Union Monitoring Mission in Georgia

Here, the purpose is neither secret diplomacy between major powers nor negotiating an end to the conflict. It is the ability to ask a straightforward question before a local event acquires greater significance: What happened to the detained person? Why did armed security personnel appear? Has the situation on the ground changed? Not every answer will be satisfactory. The ability to make contact quickly nevertheless reduces dependence on rumours, one-sided statements and worst-case assumptions.

NATO officially declares that it remains prepared to maintain channels of communication with Moscow to reduce risk and prevent escalation, despite the severe deterioration in relations following Russia’s invasion of Ukraine. This does not establish whether, when or with what result particular non-public conversations take place during a given incident. Nor should channels maintained by individual Allied states be confused with communication conducted on behalf of NATO as a whole.
Source: NATO: Relations with Russia

For an outside observer, the most difficult aspect is that successful back-channel communication may leave no immediate public trace. The sides may clarify their intentions, limit a planned action or agree on how to end an incident without announcing that a conversation has taken place. They may also talk and achieve nothing. Public silence is therefore not a measure of the actual room for de-escalation. It is a limit on what we know about it.

For THRESHOLD, this leads to a specific methodological rule: we must distinguish between confirmed existence of a communication channel, confirmed contact between the parties, and a confirmed outcome of that contact. These are three different pieces of information. We cannot infer a back-channel agreement merely because tensions subsided after an incident. Nor can we treat the absence of a public conversation as proof that the parties have lost the ability to exchange signals.

When Knowledge Arrives Too Late

Ambiguity gives time to the side making a move, but takes time away from the side trying to understand how to respond. The problem becomes especially serious when the time needed to obtain sufficient information exceeds the time available for a military decision.

The incident in Przewodów in November 2022 illustrates this well. An explosion on Polish territory killed two people while Russia was conducting a large-scale missile attack against Ukraine. The first task was not to select an immediate NATO response, but to establish what had actually fallen on Polish territory. The following day, NATO’s then-secretary general Jens Stoltenberg said that the preliminary analysis pointed to a Ukrainian air-defence missile and that there was no indication of a deliberate Russian attack against NATO.
Source: NATO: Explosion in eastern Poland, November 2022

The distinction is fundamental. Information about what happened is not yet complete information about why it happened. The origin of an object, the intention behind its use, the knowledge available to the command structure, the nature of a malfunction or interference, the number of similar incidents and the conduct of the parties afterwards can lead to very different assessments of the same physical outcome.

Under uncertainty, every response is also a message. Inaction may be read as caution or weakness. A limited response may be interpreted as an attempt to restore a boundary or as the beginning of a larger operation. Heightened readiness may look like a defensive measure or preparation for a strike. The less information an opponent has, the greater the role played by its pre-existing assumptions about our intentions.

X + 1 ≠ X₊₁

THRESHOLD describes this dynamic through the X → X+1 mechanism. It is not a prediction that a specific event will automatically be followed by another. The point is different: each X changes the conditions under which both sides will interpret the next event and choose their response.

Imagine a Russian drone entering deep into the airspace of a NATO member state and being shot down. During the first hours, it is not yet known whether its presence resulted from a planned flight, a navigation error, electronic warfare interference or a deliberate attempt to test the Alliance’s response.

NATO does not have to respond by attacking Russia. It may take steps intended to reduce the risk of a repeat incident: deploy additional air-defence systems, increase patrols, change interception procedures, move aircraft or shorten the time required to scramble fighters on alert.

Each of these actions can reasonably be justified as defensive. The problem is that intention and military capability are two different things. A Russian military headquarters cannot directly observe NATO’s intentions. It observes more aircraft, new defensive systems, altered procedures, higher readiness and shorter reaction times near Russian operations.

Moscow must therefore decide how to interpret these changes. It may regard them as a limited defensive response and leave its own behaviour unchanged. It may, however, conclude that NATO is developing the ability to act against Russian forces more quickly and effectively — and that, given uncertainty about the Alliance’s further intentions, raising its own readiness would be safer.

NATO then faces exactly the same problem. Russian systems move to a higher state of readiness, some units change position, and air or air-defence activity increases. The Alliance cannot determine from these movements alone whether Russia is preparing another provocation, protecting itself against an anticipated NATO attack or merely responding to a change in NATO’s posture.

This is one of the most important properties of escalation: an action can be defensive in the intention of the side taking it while increasing the offensive capabilities perceived by its opponent. Both sides can therefore truthfully claim that they are reacting to the other. The problem does not require deception or a conscious search for a pretext for war. It is enough for each side to make decisions under uncertainty and adopt a cautious assumption about what its opponent might do.

X does not, therefore, lead mechanically to X+1. X changes the probability, cost and interpretation of possible X+1 events. After the first incident, a higher level of readiness that would previously have looked like escalation may come to be regarded as sensible precaution. After readiness has been raised, however, the next incident will be assessed by a military system operating faster, with more armed platforms available and prepared to use force in situations in which it might not have done so the day before.

Escalation as De-escalation

A war developing through this process does not require a series of irrational decisions. The particular problem is that successive decisions may be rational under the conditions created by earlier decisions.

After an incident, NATO may conclude that the absence of a visible response would increase the likelihood of its repetition. Russia may subsequently conclude that retreating under pressure from NATO’s response would encourage the Alliance to increase that pressure further. Each action places more forces in close proximity, raises their readiness and shortens the time available to assess the next event.

At the same time, the political cost of withdrawal changes. If a government has publicly promised to respond to a particular action and its opponent takes that action anyway, failing to respond is no longer a return to the situation that existed before the crisis. It becomes a new decision, one that the opponent, the government’s own public and its allies may interpret in light of the earlier declaration.

This is why the escalation-ladder metaphor is useful only up to a point. A physical ladder retains all its rungs regardless of how high we climb. A political and military crisis works differently. Some decisions remove earlier options; others raise the cost of returning to them; still others create new commitments to a state’s own public, military or allies.

Once we have climbed higher, a route down may still exist, but it need not consist of the same choices that were available earlier.

From the Military Grey Zone to the Brink of War

The ladder below is neither a forecast nor a description of the most likely scenario. It is not an official NATO model or an attempt to reconstruct a Russian war plan. It is a THRESHOLD analytical model intended to show how a decision that appears reasonable at one stage can change the conditions under which the next decision is made.

Rungs may be skipped, the process may stop or reverse, and the same event may be assigned to different levels by the two sides. The starting point is Russia’s ongoing war against Ukraine. Ukraine is not a NATO member. The Alliance coordinates substantial elements of assistance and training, including through NSATU, which operates on Allied territory. NATO states that such support does not make it a party to the conflict and that one of its declared objectives is to prevent the war from expanding beyond Ukraine.
Source: NATO: Relations with Ukraine

Level 0. Hybrid Pressure

Russia is waging war against Ukraine and NATO is supporting Ukraine, but Russian and NATO forces are not conducting direct combat operations against one another. At the same time, a broad range of activity exists below the threshold of open war: cyberattacks, sabotage, influence operations, interference with navigation systems, intelligence activities and other forms of pressure. NATO attributes some such actions to Russia, but not every suspicious event in Europe can automatically be treated as part of a single Russian operation.
Source: NATO: Relations with Russia

The Russian leadership may conclude that it can increase the cost of Western support for Ukraine without triggering a NATO military response. Every Allied reaction also provides information about which actions produce costs and where the boundary of tolerance might lie.

NATO responds primarily by strengthening resilience, counterintelligence, cyber defence and the protection of its eastern flank. Following Russian airspace violations over Poland in September 2025, the Alliance launched Eastern Sentry, reinforcing air and counter-drone defence on its eastern flank. From NATO’s perspective, this is a defensive response. Russian military planners, however, also observe its physical result: new capabilities and higher readiness.

At this level, there is considerable room for de-escalation. Russia can limit actions without publicly acknowledging that it conducted them. NATO can retain some protective measures without attacking Russia. A warning conveyed through back channels may be considerably more precise than a public declaration.

Level 1. Intensified Grey-Zone Activity

Incidents become more frequent or more dangerous. During a Russian attack on Ukraine, a missile or armed drone crosses a NATO border and causes casualties or damage.

The first problem is not yet choosing retaliation, but establishing the facts. Was the object Russian? Was its flight intentional? Did it deviate because of a malfunction or electronic warfare? Did the command structure know its trajectory? Were there other similar incidents at the same time?

Przewodów in 2022 demonstrates why this stage matters. Two people died on NATO territory during a major Russian attack against Ukraine, but the preliminary findings pointed to a Ukrainian air-defence missile, and NATO found no indication of a deliberate Russian attack.
Source: NATO: Explosion in eastern Poland

Article 4 of the North Atlantic Treaty can initiate formal consultations if a member considers its territorial integrity, political independence or security to be threatened. It is not a “milder Article 5”; it is a consultation mechanism.

The most important de-escalatory instrument at this stage may be establishing a shared minimum of facts. The parties do not have to agree politically. But the less disputed the physical reconstruction of an event, the lower the risk of responding to something each side understands differently.

Level 2. The First Fatalities on NATO Territory

A second similar incident would be harder to treat as an isolated occurrence. If the evidence suggested that Russian systems had functioned correctly, the question would begin to shift from “Was it deliberate?” towards “What would be the consequences of treating this as another accident?”

Moscow might conclude that NATO places an exceptionally high value on avoiding direct confrontation and that limited use of force does not produce a cost sufficient to change Russian behaviour. That conclusion need not be correct. It is enough for Russian decision-makers to regard it as plausible.

The Alliance would have a broad range of responses between inaction and a strike against Russia: sanctions, cyber operations, further defensive reinforcement, public presentation of evidence, force movements and precise warnings conveyed through back channels. Every warning, however, creates a later credibility problem if the boundary it identifies is crossed again.

De-escalation remains possible through an observable change in behaviour. If Russia stops the actions and NATO retains its defensive measures but refrains from the next step, both sides can in practice restore a boundary without publicly agreeing on a common interpretation of the earlier events.

Level 3. A Limited Attack That Is Difficult to Deny

Now imagine an unambiguous, limited Russian attack on NATO territory that cannot credibly be explained by a malfunction or a deviation from course. It still need not be the beginning of an invasion or a sustained military campaign.

The Russian leadership may assume that a limited attack will meet a limited response. NATO may conclude that it must challenge precisely that assumption if deterrence is to remain credible.

The North Atlantic Council would have to assess not only the attack itself but also Russia’s likely political objective. A limited response might restore deterrence if Moscow is indeed testing the Alliance’s credibility. The same move might worsen the situation if the Russian leadership interprets it as the beginning of a much wider operation.

A route down at this stage requires a conscious political decision. One possible message, conveyed through back channels, would be that NATO considers the episode closed provided no further action is taken. Allowing an opponent to present such an outcome without public humiliation is not necessarily a sign of weakness. It can be a safety mechanism.

Level 4. The First Direct Russia–NATO Clash

At some point, Russian and NATO forces may deliberately use force against one another for the first time. In strategic terms, this would be a fundamental change. Under international humanitarian law, the threshold may be lower still: an international armed conflict can arise from a single hostile use of force attributable to one state against another. No particular intensity or duration of fighting is required. An accidental event, however, does not automatically constitute such a conflict; its character and circumstances matter.

For strategy, the more important question is whether the clash will be treated as a closed episode or the beginning of a series of actions. If NATO carries out a limited strike in response to an earlier attack, the Russian leadership must decide whether to accept the end of the exchange or respond in the name of its own credibility and the deaths of Russian personnel.

The mechanism that previously operated on NATO’s side now appears on Russia’s. Moscow may regard one controlled act of retaliation as a way to close the exchange. NATO, however, will see an attack on its own forces.

One side’s X+1 thus becomes the other side’s new X.

Level 5. Russian Retaliation Against NATO Forces

Following Russian retaliation and the deaths of NATO personnel, the confrontation acquires a very different political structure. This is where a common public simplification often appears: “NATO activates Article 5.” In reality, Article 5 is not an automatic button that triggers a predetermined military response.

The Treaty provides that an armed attack against one member is considered an attack against them all, and that each Ally takes such action as it deems necessary, including the use of armed force. NATO also explains that the collective-defence obligation requires an armed attack and a request for, or consent to, collective action by the attacked member. The assistance provided need not be identical across all Allies.

NATO decisions are made by consensus, not majority vote. That does not mean the process must be slow: Alliance structures are prepared to operate under severe time pressure. The use of NATO forces under collective command requires political authorisation by the North Atlantic Council.

The only case to date in which Article 5 has been invoked — following the attacks of 11 September 2001 — illustrates the process, but does not allow us to predict the speed of a response to an overt state attack. On 12 September, the Alliance determined that Article 5 would apply if the attack was found to have been directed from abroad. After information establishing that condition was presented, NATO considered it fulfilled. On 4 October, the Allies agreed eight specific measures in support of the United States, including intelligence sharing, access to ports and airfields, and the use of AWACS aircraft.

In a Russia–NATO crisis, the decision-making process itself would become part of the crisis. Moscow would observe force deployments, public statements and the degree of Allied unity. NATO would simultaneously interpret Russian movements. A delay caused by consultations could be misread as a lack of resolve; a rapid deployment could be read as proof that a larger operation had already been decided upon.

If both sides want to stop after a single exchange of retaliation, they need more than a pause. They need some confidence that the other side understands the pause in a similar way. Otherwise, one side’s contingency preparations may be interpreted by the other as preparations for the next attack.

At this level, de-escalation itself becomes an operation requiring coordination.

Level 6. Limited Conventional War

If reciprocal strikes continue, Russia and NATO member states are engaged in an actual conventional war, even if both sides attempt to limit its geography, objectives and means.

The problem is that limits adopted by one side may not be visible to the other. NATO may regard a particular Russian radar, command post or air-defence system as a necessary target in a conventional operation. The Russian leadership may assess the same system in terms of its significance for strategic deterrence.

Modern command, intelligence and weapons systems do not always divide neatly into “conventional” and “nuclear” categories. A strike intended to improve the conventional battlefield situation may therefore be interpreted as an attempt to weaken the ability to conduct strategic retaliation.

A limited war does not automatically have to become an unlimited one. The parties can communicate — publicly or through back channels — restrictions on targets, geography and means. Such self-restraint works, however, only if the opponent can recognise it and regards it as credible.

Level 7. Nuclear Signalling

As the situation deteriorates, Russia may increase the role of nuclear signalling through rhetoric, exercises, changes in force deployments or heightened readiness.

In November 2024, Russian President Vladimir Putin approved revised Basic Principles of State Policy of the Russian Federation on Nuclear Deterrence. The document broadened the declared circumstances in which nuclear weapons might be used. Whereas the 2020 version included a conventional threat to the “very existence of the state”, the 2024 version also refers to conventional aggression against Russia or Belarus creating a “critical threat” to their sovereignty or territorial integrity. The final decision to use nuclear weapons remains the Russian president’s decision; the doctrine is not an automatic algorithm.
Source: Kremlin: Revised nuclear-deterrence policy, 2024

This creates a difficult interpretive problem for NATO. If every Russian nuclear threat automatically halts Allied action, the threat becomes an effective instrument of coercion. If every threat is dismissed as a bluff, a genuine change in readiness may be missed.

It therefore becomes important to observe whether different signals converge: changes in deployment, command systems, readiness, the nature of communication and the behaviour of different elements of Russia’s forces. A single political statement is not sufficient to establish that nuclear use is being prepared.

At this level, de-escalation requires a message more complex than “nothing will happen”. One side may simultaneously warn that nuclear use would have grave consequences and signal that refraining from it leaves open the possibility of limiting the conflict.

Level 8. Expanded Conventional War

The conflict involves increasing numbers of forces, states, geographical areas and targets, while the nuclear dimension is now openly present in both sides’ planning. Unlike the earlier limited war, every major action must also be assessed in terms of whether the opponent might regard it as a threat to its strategic capabilities or the survival of the state.

Time becomes the most important resource. Intelligence may detect the movement of a system, but not the intention behind it. Heightened readiness does not, by itself, reveal how that readiness will be used. A dual-use system may participate in either a conventional or a strategic operation.

Waiting for complete certainty therefore carries a cost if an attack really is being prepared. Responding before certainty is achieved carries a cost if it is not.

This is the same problem that appeared in 1962 in a much less technologically complex environment: the parties do not necessarily need to possess incorrect data. It is enough for correct data to leave the most important question unanswered — what does the opponent intend to do next?

Level 9. Strategic Crisis

At this level, the analogy with Cuba becomes useful not because the military situation would be identical, but because the structure of the decision-making problem becomes similar. Both sides possess the ability to inflict catastrophic losses, operate with incomplete information and must interpret their opponent’s movements under time pressure.

An action that increases one side’s security may decrease the other side’s sense of security. Dispersing forces increases their chances of survival, but may look like preparation for an attack. Raising readiness shortens one’s own reaction time, but also shortens the time the opponent believes it has to make a decision.

At this level, moving to the next rung may no longer require a new attack. It may be enough for one side to interpret information as suggesting that an attack is imminent. The information may be true, partly true or false, but a decision may be required before that distinction can be resolved.

A route down still exists: direct talks between leaders, a back-channel compromise, a mutual pause, the withdrawal of particular systems or verifiable measures. Every such mechanism must, however, answer two questions: will the opponent recognise our decision to stop as a decision to stop, and do we know what it will do if we stop?

Level 10. Two Paths

One path leads down. The leaders of both sides conclude that further military or political gains are not worth the growing risk of catastrophe. A formal or informal agreement, a pause, the withdrawal of some forces or a control mechanism emerges. This does not mean that all the causes of the conflict have been resolved. Russia and NATO may remain adversaries, while the war in Ukraine requires a separate resolution.

The other path leads further. One side concludes that it can no longer safely wait. A nuclear weapon is used, or an action is interpreted as the beginning of a strategic attack, and the other side must make its decision after the nuclear threshold has already been crossed.

This is where THRESHOLD’s detailed scenario should end. The further we attempt to describe a hypothetical nuclear exchange as a sequence of predictable rungs, the more we create the false impression that we know how a system will develop when one of its defining characteristics is a sudden loss of predictability.

The most important information lies earlier.

The Ladder: More Than Up and Down

Levels 0 through 9 describe increasing intensity of confrontation, but something else changes at the same time: freedom of decision-making.

At lower levels, many responses remain available. As casualties, earlier declarations, alliance commitments, military plans, time pressure and nuclear signalling accumulate, some options become more difficult to use politically, militarily or within the time available.

This does not mean that every higher rung automatically makes de-escalation more difficult. A clearly limited response may restore a boundary that was previously violated. A new communication channel may reduce the risk of misinterpretation. A back-channel agreement may create a way out that did not exist before escalation.

Alongside the question “Which rung are we on?”, THRESHOLD should therefore ask another: “How many routes down remain open?”

That does not yet have to mean a second numerical index. A qualitative assessment matters more: can the parties simply stop acting; do they need a mutual agreement; can forces withdraw safely; are communication channels functioning; are red lines understood; is there a solution that allows both sides to avoid public humiliation; and is there enough time left to use these possibilities?

This is the room for de-escalation.

The Thermostat Problem

A strategy of gradually increasing pressure can be compared to trying to regulate temperature with a very inaccurate thermostat. The Russian concept of escalation management assumes that costs can be calibrated to induce an opponent to change its behaviour. CNA identifies precisely this role for the incremental imposition of costs in Russian strategic thought.
Source: CNA: Russian Strategy for Escalation Management

The problem is not merely choosing the correct amount of pressure. It is the quality of the feedback.

An opponent may deliberately conceal its red line. It may not know precisely where that line lies. Deaths can change the politically available range of responses within hours. A coalition of states may respond differently from what the Russian decision-making model anticipated. What was intended as a precisely calibrated signal may be read as preparation for another action.

Russia’s decision-making system adds another variable. It should not be reduced to a caricature in which Putin personally issues every order. Russia has extensive state, military and intelligence institutions. At the same time, analyses of its political system identify strong personalisation of major strategic decisions and limited autonomy for other centres of power. We have no basis for claiming exactly what information Putin would receive during a future crisis, but the quality and selection of information reaching the highest level are legitimate variables in assessing risk.

NATO faces a different problem. A larger number of participants may provide more independent sources of information and more opportunities to challenge a mistaken assessment. At the same time, a decision must be coordinated among many states.

Both systems nevertheless face the same fundamental difficulty: the answer to whether we have crossed the opponent’s actual boundary may become completely clear only after we have crossed it.

The Mirror of Deterrence

NATO’s deterrence requires Russia to regard the crossing of certain boundaries as costly. At the same time, the Alliance wants to avoid unnecessary escalation. These two objectives cannot always be achieved through the same signal.

If a response is too weak, Russian decision-makers may conclude that a similar action can be repeated. If it is too strong, they may conclude that NATO intends to use the incident as the beginning of a much wider confrontation.

There is no single formal line separating “peace” from “NATO war”. Article 4 provides for consultations. Article 5 concerns collective defence following an armed attack, but does not prescribe one automatic type of response. States may also take national, bilateral or coalition action. NATO decisions require consensus, but consensus itself can be reached quickly.

This provides flexibility, but it also increases the number of possible interpretations available to the opponent.

The Butterfly Effect

The next stage of a crisis is not played out under the same conditions as the previous one. Once people have died, governments respond not only to their opponent, but also to their own societies, parliaments, militaries, allies and earlier public declarations.

An action that would have been politically unacceptable before the crisis may therefore come to be regarded as the minimum necessary response after X+2. Conversely, an action that would previously have been enough to calm the situation may be considered insufficient after fatalities.

The military structure of the crisis changes as well. Forces are more ready, more often deployed forward, procedures are faster, and commanders are prepared for scenarios that were previously only planning contingencies. The time available to interpret the next event may therefore shrink precisely as its consequences become more serious.

In this sense, war can be produced by a process. Not because the process has a will of its own, but because earlier decisions change the set of options available later.

Good Intentions Do Not Stop Bombs

The phrase “a war nobody wanted” requires clarification. It need not mean a war started by accident — a false alarm, a system malfunction or a single person pressing the wrong button. A more interesting scenario from the perspective of escalation is one in which war results from a series of conscious decisions, even though starting a war was not either side’s original objective.

After the first incident, both sides may still want to avoid conflict while regarding some form of response as necessary. If the next action causes casualties, both the military situation and the political cost of restraint change. Raising readiness then becomes a responsible precaution against the possibility of another attack. To the opponent, the same change may look like preparation for an attack of its own.

Successive decisions are thus made under conditions different from those that existed when the first decision was taken. Available information, force deployments, time pressure, Allied expectations, public opinion and assessments of what the opponent will do if it meets no response all change.

At some point, a leader may make an entirely conscious decision to use greater force — not because that leader sought war from the outset, but because, in the situation shaped by earlier actions, the alternatives have begun to appear even more dangerous.

The Cuban Missile Crisis demonstrates precisely this problem. Kennedy and Khrushchev had strong reasons to avoid nuclear war and ultimately made decisions intended to prevent it. Their preferences did not, however, eliminate the risks created by incomplete information, the actions of subordinate forces, political pressure and the possibility of misinterpreting the opponent’s behaviour. The desire to avoid war was therefore an extremely important condition, but it did not, by itself, guarantee control over the crisis.
Source: US Department of State: The Cuban Missile Crisis

...Just Don’t Ask How High We Are

For THRESHOLD’s methodology, this means that the intensity of Russian actions alone is not enough to assess the risk of escalation. It is equally important to observe whether the participants’ ability to control the subsequent course of the crisis is diminishing.

We should therefore track not only the frequency and severity of incidents, but also their pace, the geographical proximity of forces, levels of readiness, the time available for decisions, the quality of information, the functioning of communication channels, casualties and the reversibility of successive actions.

Reversibility is particularly important. Moving a squadron of aircraft can be undone relatively easily. A public ultimatum is harder to withdraw without political cost. Deaths cannot be undone. The use of a nuclear weapon cannot later be redefined as an ordinary signal.

The height reached on the ladder is therefore only one part of the picture. The other concerns whether a route down still exists and how many decisions must be coordinated with the opponent in order to use it.

Cuba: Peace with War on the Table

The secret understanding concerning the Jupiters illustrates another problem with observing crises from the outside. The public outcome may not reflect the full negotiating process. What appears to the public to be a unilateral concession may be part of a broader exchange, elements of which cannot be disclosed at the time without making compromise politically impossible.
Source: US Department of State: The Cuban Missile Crisis

The significance of this history is therefore not reducible to deciding who “won” the Cuban Missile Crisis. It reveals a set of conditions needed to interrupt escalation. The desire to avoid war is not enough. Decision-makers need sufficiently reliable information, time to assess it, functioning communication channels and a political solution that also allows the other side to regard a halt to escalation as acceptable.

This is the sense in which THRESHOLD uses the X → X+1 → X+2 model. It is not a forecast of future events and does not assume that one incident inevitably leads to another. Its purpose is to show how each event changes the conditions under which the next decision is made.

After X, force deployments, readiness, interpretations of the opponent’s behaviour, the political cost of failing to respond or the time available to prepare a response may all change. X+1 is therefore chosen under different conditions from X. If the process continues, successive actions may simultaneously raise the stakes and reduce the number of safe, politically feasible and mutually intelligible ways to stop it.

That is why the question “Does Putin want a war with NATO?” remains important but does not describe the whole risk. War may become possible even if the Russian and NATO leaderships would still prefer to avoid it, because earlier decisions have changed the situation to such an extent that further restraint begins to be perceived by one or both sides as more dangerous than the next escalatory step.

For assessing risk, the question of control over the process therefore becomes as important as intentions: how much time decision-makers have, how reliable their information is, what political or military commitments have already been made, whether the parties can communicate their boundaries, and how many real routes to de-escalation remain open.

The Cuban Missile Crisis does not prove that a similar process must end in war. It shows something more useful for contemporary analysis: even leaders determined to avoid a catastrophic conflict can create a situation in which the possibility of avoiding it depends not only on their intentions, but also on information, time, the behaviour of the organisations under their command and the opponent’s response.

Escalation is therefore worth watching not only when it begins to resemble war, but when it begins to reduce the possibilities of avoiding one.