Individually, many of these incidents appear minor: a drone crash here, a brief fighter incursion there, a missile discovered only after the fact.

But taken together, I believe the numbers tell a far more troubling story.

To get a full picture of the scale of violations, I conducted a systematic review of Russian airspace violations against NATO members from 2022 through the end of 2025.

It reveals not just an increase but a sharp acceleration accompanied by rising severity and widening geographic scope. In 2025 alone, NATO members recorded 18 confirmed Russian airspace violations – three times as many as in 2024 and more than half of all incidents recorded over the four-year period. This was not a gradual escalation; it was a dramatic change.

Picking up pace

I identified airspace violations through a systematic review of international news media coverage, corroborated with official NATO press releases and cross-validated against operational assessments and geospatial reporting from the Institute for the Study of War. Included were violations of airspace by drones heavily suspected to be Russian but that could not be 100% confirmed.

Between 2022 and 2024, the annual number of violations rose steadily but modestly. There were four incidents in 2022, five in 2023 and six in 2024.

That corresponds to year-on-year increases of roughly 25% and 20%. In 2025, the count jumped from six to 18, a 200% increase in a single year. And that pace has continued into 2026 – as of Feb. 18 there have been at least two violations of NATO airspace by Russia.

Such a surge is statistically and strategically significant. It strongly suggests that Russian airspace violations are no longer episodic spillovers from the war in Ukraine, but part of a sustained pattern of pressure directed at NATO itself.

The character of these incidents has also changed. In 2022, all four violations were what I classify as low-intensity events: brief incursions into Swedish airspace by Russian fighters, the crash of an Orlan-10 reconnaissance drone in Romania and the later discovery of a Russian cruise missile in Poland. These incidents were serious but short-lived and geographically limited.

By 2023, violations had become more repetitive. Romania alone experienced multiple drone incursions and debris discoveries over several months, often triggering fighter scrambles. All five incidents that year fell into a midrange severity category: more persistent than before but still largely confined to border regions.

The transition toward higher-intensity incursions became clearer in 2024. Of the six violations that year, half involved high-severity characteristics such as deeper penetration of a NATO country or broader geographic exposure.

A Russian cruise missile crossed into Polish airspace, drones entered Romania on multiple consecutive nights, and a Russian drone crashed well inside Latvian territory. These incidents expanded both the depth and the geographic footprint of violations.

Then came 2025. Of the 18 violations recorded that year, a clear majority qualify as high-severity events. These include a Russian drone that penetrated nearly 60 miles (100 kilometers) into Polish territory before crashing near Osiny without prior radar detection; a drone that remained inside Romanian airspace for approximately four hours, crossing multiple counties before crashing in Vaslui; and a massive 21-drone swarm over Poland on Sept. 9-10 that forced the closure of major civilian airports in Warsaw, Rzeszów and Lublin.

Manned aircraft also returned in force. Russian MiG-31 interceptors flew over Estonia for about 12 minutes with transponders – onboard devices that automatically respond to radar signals by transmitting an aircraft’s identity and altitude, enabling air traffic control and air defense systems to track it – switched off. In October, a Russian Su-30 fighter accompanied by an Il-78 refueling tanker violated Lithuanian airspace – an unmistakable signal of endurance and deliberate mission planning.

In December, suspected Russian drones were shot down and later recovered in Turkey on multiple dates, indicating a persistent provocation rather than a one-off incursion.

Perhaps most strikingly, Western Europe was seemingly no longer exempt. On Dec. 4, 2025, five unidentified drones flew over France’s Île Longue naval base, home to the country’s nuclear ballistic missile submarines. French personnel reportedly fired at the suspected Russian drones.

Just weeks later, on Christmas Day, Polish fighters intercepted a Russian reconnaissance aircraft over the Baltic Sea.

Grey-zone tactics

Severity and frequency are not the only dimensions that changed. Geographical reach has, too.

In 2022, Russian violations affected three NATO members. By 2024, that number had grown to four. In 2025, it expanded to six: Romania, Poland, Estonia, Lithuania, Turkey and France.

Pressure was applied simultaneously in the Black Sea region, the Baltic states and Western Europe.

This widening scope matters because it undermines the idea that these incidents are localized accidents. Instead, they resemble a distributed pattern of Russia probing across NATO’s eastern and southern flanks and into its strategic core.

NATO’s political response reflects this shift. For the first time since the war began, members invoked Article 4 of the North Atlantic Treaty, the mechanism for collective consultation when a member feels its security is threatened.

Poland did so after the September 2025 drone swarm, and Estonia followed after the MiG-31 incursion later that month. Although only two of the 18 incidents triggered Article 4, their timing is revealing: No such invocations occurred in the previous three years combined.

From a strategic standpoint, the danger lies less in any single violation than in their cumulative effect. Airspace incursions sit in a grey zone between peace and open conflict. They impose operational and psychological costs, test air defense systems and provide valuable intelligence on NATO’s detection thresholds and response times, all while staying below the legal threshold of armed attack.

Testing NATO’s resolve

The data from 2025 and early 2026 show that this grey-zone activity has intensified dramatically. A threefold increase in one year, coupled with a shift toward deeper, longer and more disruptive incidents across multiple theaters, points to a deliberate campaign rather than accidental spillover.

For NATO, the implication is clear. Monitoring individual incidents is no longer sufficient. What now matters is the rate of acceleration, the severity profile and the geographic dispersion of violations.

If current trends persist as the war in Ukraine enters its fifth year, the alliance’s greatest challenge may not be responding to a single dramatic breach but managing the mounting pressure created by many smaller ones – each calibrated to test resolve without triggering open conflict.

Frederic Lemieux, Professor of the Practice and Faculty Director of the Master’s in Applied Intelligence, Georgetown University

This article is republished from The Conversation under a Creative Commons license. Read the original article.