Something changed in how U.S. intelligence agencies read Vladimir Putin, and the shift is significant enough that officials are now briefing it openly to selected outlets. The updated assessment, described by multiple officials familiar with the matter, holds that Putin's risk calculus has moved — that he is now more willing than he was even a few months ago to authorize actions that bleed onto NATO territory, even knowing those actions carry escalatory risk.

The operational picture being sketched is deliberately below the threshold of Article 5. Hybrid operations, cyberattacks, sabotage of infrastructure, and other deniable measures are the currency here — not tank columns crossing Polish borders. The strategic logic, as intelligence officials frame it, is that NATO's collective defense guarantee was written for conventional war, and Putin appears to be probing whether the alliance has the coherence and political will to treat gray-zone aggression with the same unity it would reserve for an overt invasion.

That question about NATO unity is not abstract. The alliance has spent three years managing internal fractures over Ukraine funding, weapons transfers, and burden-sharing — fractures that are visible in public voting records, parliamentary debates, and the stated positions of elected heads of government. If you are sitting in Moscow reading those same public signals, the calculus for a calibrated provocation looks different than it did in February 2022, when Western solidarity surprised nearly everyone, including Western governments themselves.

The timing of the revised assessment matters. It arrives as the war in Ukraine has ground into a phase of attritional stalemate, with front lines largely static and Ukrainian forces operating under significant ammunition constraints that their own senior military leadership has described in public testimony and published assessments. A frozen or slowly deteriorating front does not signal to Moscow that Western resolve is hardening — it signals the opposite.

Drones are already part of the evidentiary record. An unidentified drone was tracked in proximity to a Ukrainian military aircraft operating in German airspace, and a separate incident involved a bomb-carrying drone detected near a German airport — incidents that German and allied security services are actively investigating for Russian operational involvement. These are not confirmed Russian state operations in the official public record, but they fit a documented pattern of deniable probing that Russian military doctrine, specifically the publicly available literature on so-called non-linear warfare, describes as a legitimate instrument of statecraft.

Estonia's own defense intelligence directorate — which has a strong track record on Russia assessments dating back years before the 2022 invasion — has published its view that the risk of Russian military action against a NATO member state is a real planning scenario within a multi-year horizon, not a theoretical abstraction. The Baltic states have been making this argument in NATO councils for longer than most alliance members were willing to hear it. They are being heard somewhat more seriously now.

What the intelligence community appears most concerned about is not a single dramatic incident but a sequence: a provocation, a muddled or divided NATO response, another provocation calibrated slightly higher, and a ratchet effect that tests whether the alliance's red lines are real or rhetorical. The value of that experiment, from Moscow's perspective, is informational — it tells Putin what he can actually get away with before the alliance coheres around a hard response.

The honest caveat is that intelligence assessments about adversary intentions are exactly that — assessments, not intercepts of an operational order. The history of such warnings includes cases where the assessment was right and cases where it reflected institutional threat inflation. What distinguishes this cycle of warnings is that they are being given more specificity than in previous years — not just that Russia poses a threat, but that the threat window is narrowing and the methods are being named. Whether that specificity reflects genuine signal or is partly a tool to pressure alliance members into faster rearmament decisions is a question the documents themselves cannot answer.

What is not in dispute is that NATO member states are now spending real money on the assumption that this threat is credible. Defense budgets across Northern and Eastern Europe have moved in ways that are visible in parliamentary appropriations records and NATO burden-sharing data. Governments do not reallocate those sums on the basis of theoretical threat modeling alone. Someone in those capitals believes the assessment.