Does NATO Still Have a Future?

Revisiting my 2020 essay through the lens of hybrid warfare and protective intelligence.

Lord Hastings Ismay, NATO's first Secretary General and Churchill's wartime chief of staff, once distilled the alliance's entire purpose into a single line: to keep the Russians out, the Americans in, and the Germans down. It was a formula that survived seven decades. In 2026, all three conditions have been placed under simultaneous pressure, and not by an external adversary alone. The pressure is coming from both directions at once.

I am not a military officer, a NATO official, or a defence analyst embedded in Brussels. What I am is someone who, through a master's in security studies and international relations, was trained in the tools that matter for reading complex institutions under pressure and is worth naming, because what follows rests on it.

A postgraduate education in this field does not make you an expert in military doctrine or alliance logistics. What it does is something more durable: it teaches you to apply analytical frameworks (realism, liberal institutionalism, securitisation theory, constructivism, systems thinking, comparative analysis, scenario planning, and abductive reasoning) not as ideology but as lenses; to read primary sources and official documents against their political context; to situate current events within comparative and historical pattern; to evaluate competing claims and understand why a source says what it says; to construct an argument that holds under scrutiny and does not collapse when contradictory evidence appears; to identify second and third-order effects before they become headlines; and above all, to distinguish between signal and noise in environments deliberately engineered to produce both.

Laid over two decades of international security work across five continents, three of which I have lived and operated in, speaking four languages fluently, that education produces something specific: the ability to recognise a structural shift while it is still being described as an anomaly. That is the vantage point from which I wrote an essay in December 2020 asking a question that seemed academic at the time: does NATO have a future?

What I argued in 2020

The essay was written during the chaotic US presidential transition, with Biden confirmed as president-elect and the US democratic process visibly under strain. It was an early piece, competent I think but survey-level, and I was under no illusion that it was anything more than a structured analysis of existing pressures rather than a bold original argument.

What it identified, however, was a set of structural vulnerabilities that were real. Russia's assertiveness on the eastern flank was not a temporary provocation but a deliberate strategy of territorial revision. China's rise presented a threat to alliance coherence that NATO was institutionally unprepared to address, partly because member states saw China simultaneously as economic partner and strategic competitor. Disinformation and election interference were already functioning as tools of alliance destabilisation. Mass migration from the Middle East and North Africa was not just a humanitarian challenge but a driver of internal political fragmentation that fed precisely the populist and nationalist movements most hostile to collective defence. Turkey's relationship with Russia was already contradictory enough to constitute a structural problem, not a diplomatic irritant. Climate change and non-traditional security risks had already been securitised by NATO but remained under-resourced in genuine operational planning.

And above all, the burden-sharing deficit was not fundamentally about money. It was about political will: specifically, whether European member states had genuinely internalised the cost of their own security or had, for thirty years, priced it into someone else's budget.

Where the essay was wrong was in its optimism. It assumed Biden would restore the political grammar of collective defence. It trusted, as most institutionalist analysis trusted, that NATO's historical adaptability would absorb whatever pressure came next. It did not adequately model the possibility that the problem was not a US president who misunderstood NATO, but a political realignment inside the United States that viewed alliance commitments as liabilities rather than assets, and that this realignment was durable, not aberrant.

It also did not account for the pace at which artificial intelligence and emerging technology would move from strategic discussion to operational deployment, compressing the timelines of hybrid pressure, amplifying the disinformation environment, and fundamentally changing the scale at which influence operations could be run against alliance cohesion.

The American withdrawal

Trump's return to the presidency in January 2025 produced something qualitatively different from his first term. In 2016 to 2020, his hostility toward NATO was real but largely rhetorical. The institutions held. Allies grumbled and adjusted. The diplomatic infrastructure absorbed the disruption. What 2025 revealed is that the first term was not an anomaly to be managed but a political signal to be read, and that the reading was, for the most part, missed.

The Greenland affair was not a joke. A sitting US president explicitly declared territorial ambitions over the sovereign territory of a NATO ally, a founding democracy, a member state protected by the very collective defence commitment the United States underwrites. The Danish government treated it with appropriate seriousness. Much of Western commentary did not. The strategic logic, however, was coherent: the Arctic is a domain of rising great-power competition, Greenland sits at its centre, and the United States under this administration has decided that alliance etiquette is not a binding constraint on strategic positioning. That is not erratic behaviour. It is a precedent.

The Monroe Doctrine's rehabilitation tells the same story with a wider geographic sweep. Venezuela, Cuba, Mexico, Canada: each has been subjected to a variant of the same logic, that US hemispheric primacy is non-negotiable and relationships will be structured accordingly. Canada, a NATO ally and one of the founding members, has faced tariff pressure framed in terms indistinguishable from those used against adversaries. The rhetorical suggestion that Canada might one day be absorbed has been allowed to circulate without serious retraction. Argentina under Milei has been rewarded with alignment and financial support, with the IMF arrangement functioning in this context less as an economic instrument and more as a signal of which governments will be treated as partners in the new order.

The South Korea episode over the Strait of Hormuz followed a logic now visible across multiple relationships: allies who do not subordinate their foreign policy to US unilateral decision-making are penalised through trade pressure, diplomatic marginalisation, or public rhetoric. The punishment is rapid and the message is clear. Collective decision-making is not the frame. Compliance is.

What Chatham House described in late 2025 as a strategy of cutting deals, hammering Europe, and treading gently around autocrats is not a diplomatic style. It is a doctrine (Chatham House, 2025). And its consequence for NATO is straightforward: the alliance's guarantor has stopped behaving like one.

Then there is Iran. The US entered a military conflict that has consumed an estimated eighty percent of interceptors for a key missile defence system, according to reporting from August 2026 (CNN, 2026). Restocking will take years, as production lines for Patriot and other air defence interceptors cannot be accelerated on a political timetable (Christian Science Monitor, 2026; NPR, 2026). The consequences are not abstract. Patriot batteries that might have gone to Ukraine have gone to the Middle East. European allies whose air defence architecture already had gaps are now competing with an active US war theatre for a depleted inventory. Iran's counter-strikes across the Gulf have deepened the demand well beyond original planning assumptions.

Whether the United States was drawn into this conflict through deliberate strategic choice, through the accumulated logic of regional commitments, or through something more contingent is, at this stage, a question without a publicly confirmed answer. What is analytically observable is the consequence: the US is now simultaneously engaged in a Middle Eastern war that has drained critical munitions, managing a fractious transatlantic relationship, and nominally committed to resolving a conflict in Ukraine that Trump pledged, on the record, to end within twenty-four hours of taking office (Washington Post, 2025). That pledge has since been quietly retired. Zelensky has been pressed toward a settlement that appears to favour territorial concessions. The gap between what was promised and what is being delivered is not merely a political embarrassment. It is a data point that every adversary of the alliance is reading carefully.

The other pressure: Russia inside the perimeter

While transatlantic attention has focused on what Washington is or is not prepared to do, Moscow has been doing something else entirely. Russian sabotage operations across Europe have quadrupled since 2023, according to analysis by the International Institute for Strategic Studies published in August 2025 (IISS, 2025). The operations are not random. They are calibrated to remain below the threshold of a formal military response while accumulating strategic effect across multiple domains simultaneously.

The operational model has shifted significantly from the era of state-directed espionage. Russian intelligence services, primarily the GRU, have developed a systematic practice of recruiting local criminals through encrypted channels, particularly Telegram, offering payments of between three and ten thousand dollars per operation. Arson at logistics warehouses, sabotage of railway infrastructure, intimidation of individuals connected to Ukraine support networks, parcel bombs addressed to defence company executives: these are not carried out by Russian officers on European soil. They are carried out by Europeans with criminal records and financial desperation, recruited anonymously, paid through untraceable channels, and left without operational context that would connect them to Moscow (OCCRP, 2024; Kyiv Independent, 2024; GLOBSEC, 2025; RUSI, 2025). The model provides near-perfect plausible deniability. Attribution requires intelligence that most European prosecutors cannot use in open court.

The pattern of incidents across NATO territory is not a series of isolated events. It is a campaign.

Arson attacks on warehouses linked to military logistics and Ukraine-bound equipment have occurred across Germany, Poland, the United Kingdom, and the Baltic states. Undersea data and power cables in the Baltic Sea have been severed on multiple occasions, with Russian shadow fleet vessels in the vicinity at the time of each cut. GPS spoofing across Scandinavian and Baltic airspace has disrupted civilian aviation at levels that constitute sustained operational pressure rather than incidental interference. Parcel bombs and incendiary devices have been intercepted in multiple European cities, several linked through forensic and signals analysis to the same GRU-directed network. A Russian plot to assassinate Armin Papperger, the chief executive of Rheinmetall, Germany's largest defence manufacturer and a central supplier of artillery ammunition to Ukraine, was foiled by US and German intelligence in mid-2024 (CNN, 2024; Bloomberg, 2025). Putin had personally and publicly criticised Papperger before the plot was uncovered.

The Papperger case is not a singular episode. It is the most documented point on a longer line. European defence executives, logistics coordinators, politicians who have taken visible positions on Ukraine, and officials involved in sanctions enforcement have appeared on Russian-linked targeting lists circulated within intelligence and law enforcement networks. The public sees the occasional prosecution of a low-level arsonist. The intelligence picture behind it is considerably wider.

What ties all of this together is a strategic logic that the 2020 essay identified in outline but did not fully develop: Russia understood, before most Western analysts accepted it, that the most effective attack surface in a modern alliance is not a forward military position but internal coherence. Fear, uncertainty, and the sense that the state cannot protect ordinary infrastructure erodes the political confidence that sustains public support for collective defence. You do not have to defeat NATO militarily. You erode the will to defend. This is not a new observation. KGB defector Yuri Bezmenov described the same mechanism in precise detail in 1984, mapping it across four sequential stages: demoralization, destabilization, crisis, and normalization. He noted that by the time a society recognises the process, the decisive phase is already complete.

In the interview below, Bezmenov explains each stage in his own words. Four decades on, the framework has not aged. The context has simply changed scale.

A case study in exposure: the Netherlands

The Netherlands offers one of the sharpest illustrations of the paradox this environment produces. The AIVD, the Dutch General Intelligence and Security Service, was ranked third among European intelligence services in a 2026 assessment, behind only MI6 and its closest counterpart, and is consistently rated among the continent's most capable services (NL Times, 2026a; DutchNews.nl, 2026). The MIVD, its military counterpart, has similarly earned a reputation well above the country's size. Both services published a joint assessment in 2026 warning explicitly that Russia is escalating hybrid attacks and preparing for a long strategic standoff with the West (AIVD and MIVD, 2026; NL Times, 2026b).

That institutional capability sits inside one of the structurally most exposed countries in Europe. The Dutch posture of "Bewaken, Beveiligen en Beschermen", to watch, to secure, and to protect, reflects a genuine doctrine built for a country that understands its exposure. Rotterdam is the largest port in Europe, a critical node for energy, container logistics, and military supply chains. Schiphol is one of the continent's major aviation hubs. The Amsterdam Internet Exchange is among the world's largest internet exchange points. The Hague hosts the International Criminal Court, the International Court of Justice, the Organisation for the Prohibition of Chemical Weapons, and Europol. The Netherlands is, in other words, a country that aggregates critical infrastructure, international legal authority, and digital connectivity in a remarkably small geographic area, in a society defined by openness, transparency, and institutional trust.

That openness is a genuine value. It is also a persistent vulnerability. An open society with high levels of digital integration, a multinational commercial environment, and a strong tradition of civil liberties is precisely the kind of environment that a hybrid campaign is designed to exploit. The AIVD has already documented Russian attempts to penetrate Dutch political and academic institutions, and the Netherlands has previously been the site of a documented GRU operation against the OPCW in The Hague. The question is not whether the Netherlands is targeted. It is how the most capable intelligence service in the country manages a threat environment that the country's structural openness cannot close off through intelligence work alone.

The exposure extends beyond geography and institutions. Eindhoven is home to ASML, the only company in the world capable of producing extreme ultraviolet lithography machines, the technology without which advanced semiconductor manufacturing cannot function. ASML's position in the global supply chain is without parallel: no other entity on earth produces what it produces, which makes it simultaneously the most strategically important commercial asset inside any NATO member state and one of the most actively targeted. Intelligence operations linked to China have sought to acquire ASML technology through corporate espionage and the recruitment of researchers (Reuters, 2023). US pressure on the Netherlands to restrict export licences to China has placed the company at the centre of great-power competition in a way that no security framework built around borders was designed to handle (Reuters, 2024). ASML is not merely a Dutch corporate asset. It is a global technology chokepoint operating inside one of the most accessible research and business environments in Europe.

The Dutch response to this accumulated exposure has moved beyond intelligence. Weerbaar Nederland, launched in 2024 and expanded through 2025 and 2026, reflects a deliberate attempt to translate strategic threat awareness into societal resilience (Rijksoverheid, 2024). The NCSC coordinates a multi-domain approach that treats digital, physical, cognitive and economic threats as interconnected rather than parallel (NCSC, 2025), and the Netherlands was among the first governments to publicly attribute cyberattacks to nation-state actors, the 2018 GRU operation against the OPCW in The Hague being the most documented case (MIVD, 2018). From 2025 onwards, the government ran public campaigns advising citizens on emergency preparedness: stockpiling, communication during blackouts, behaviour in crisis scenarios (Rijksoverheid, 2025). This mirrors what Scandinavian governments have done for years, but represents a significant shift for a country that has not communicated civil defence at this scale since the Cold War. The securitisation of everyday life is no longer a Nordic peculiarity. It is now Dutch policy.

The Dutch case illustrates something that applies across the alliance: institutional intelligence capability is necessary but not sufficient. The attack surface created by an open, connected, logistics-intensive society cannot be managed by any single agency. It requires a level of civil-military-commercial coordination that most NATO members have not yet operationalised.

The vacuum and those who navigate it

The connection between these two pressures, the American withdrawal and the Russian campaign, is not coincidental. It is structural.

Hybrid operations function within a band of ambiguity. They are designed to be interpretable as criminal acts, accidents, or technical failures. What closes that interpretive space and raises the cost of attribution error is a credible, unified political response from an alliance whose members share a threat perception and whose guarantor is clearly committed. When that political unity is absent, when the guarantor is instead publicly questioning whether the alliance is worth its cost, the interpretive space widens. Moscow reads that space and operates within it.

The absence of a coherent US strategy under the Trump administration is therefore not merely a diplomatic inconvenience for European capitals. It is an operational asset for Russian planners. It lowers the expected cost of every hybrid probe. It increases the threshold at which European governments, individually and collectively, can justify a proportionate response. It fragments the intelligence-sharing and diplomatic coordination that makes attribution politically usable. And it does all of this without Russia firing a single weapon at a NATO member state.

Disinformation runs through the entire picture as connective tissue. The narratives that frame hybrid attacks as criminal coincidences rather than state-directed operations, that amplify European disagreements about response thresholds, that position the most vocal NATO members as warmongers or American proxies: these are not organic. They are produced, distributed, and sustained through networks that European intelligence services have documented with increasing precision. The current US posture, whatever its intent, is providing those networks with the kind of transatlantic political friction they cannot manufacture for themselves.

The grammar of collective defence

The distinction that matters here is between NATO's military infrastructure and NATO's political grammar. These are not the same thing, and conflating them produces a false sense of security. The infrastructure is largely intact. Troops are deployed on the eastern flank. Interoperability between member militaries has improved. Defence spending across Europe has risen significantly since 2022, driven by a level of threat perception that the 2020 essay anticipated in outline but could not have predicted in intensity. The physical architecture of collective defence, including command structures, forward presence and logistical planning, has in many respects strengthened over the past six years.

What has not strengthened, and may be fracturing, is the political consensus that gives that infrastructure meaning. Article 5 is not self-executing. It is a commitment by sovereign governments to treat an attack on one as an attack on all, and the weight of that commitment depends entirely on whether governments believe it will be honoured and are prepared to honour it themselves. When the guarantor of last resort signals that the guarantee is conditional on transactional satisfaction, Article 5 becomes a question rather than an assurance. And a question, in a crisis, is a very different thing from a commitment.

Russia's hybrid campaign adds a further complication. Article 5 was designed for conventional military attack. A warehouse fire in Warsaw set by a recruited Polish criminal paid through a Telegram channel controlled by a GRU cut-out in a third country does not trigger it. Neither does a severed undersea cable, a poisoning conducted in a way that leaves forensic ambiguity, or an assassination plot disrupted before it was executed. The attack surface Russia has chosen exists in the space beneath the alliance's legal and political response architecture. And that space has been deliberately widened by the erosion of political cohesion at the top.

Add to this the depletion of US air defence inventory through the Iran conflict, and the material picture shifts meaningfully. The alliance's defensive depth is not only politically uncertain. It is, for a period measured in years rather than months, physically constrained in ways that NATO planners are working around rather than solving.

This is the change that the 2020 essay did not adequately anticipate. Not the specific pressures, which were visible, but the combination: an internal guarantor withdrawing political commitment and draining its own arsenals in a theatre of limited allied relevance, while an external adversary exploits the resulting ambiguity in real time, on European soil, using European citizens as instruments.

What this means in practice

For security planners, protective intelligence professionals, and the institutions and principals they advise, this creates an analytical obligation that did not exist five years ago: the NATO guarantee can no longer be treated as a fixed assumption in threat assessment. It is now a variable, and it should be evaluated like one, against the specific political conditions of the moment, the nature of the contingency, and the degree to which US strategic attention is engaged elsewhere.

The Papperger case should have ended discussion about whether senior executives in defence-adjacent industries, logistics, finance, and sanctions implementation require protective intelligence. It did not. The question of who is on a targeting list is now a legitimate operational question for European companies with visible exposure to the Ukraine conflict, to sanctions enforcement, or to political positions that have drawn public criticism from Moscow. The answer is not always knowable. The obligation to ask is.

Countries on the eastern flank have largely drawn the strategic conclusion and are acting on it, building bilateral arrangements and national capabilities in ways that acknowledge what might not be said publicly. Others have not. The gap between formal assurance and operational reality is now wide enough that it carries its own risk.

The broader implication is one this platform has explored in other contexts: when the environment in which protection has historically been assumed starts to shift, the shift rarely announces itself clearly. It emerges as a pattern of signals, rhetorical, behavioural, financial and operational, that individually invite rationalisation and collectively indicate something structural. The question Ismay's formula was designed to answer has been reopened, not only by Russia, not only by China, but from inside the room, and from inside the perimeter simultaneously.

Closing

In December 2020, writing a master's assignment in a city that felt very far from the decisions being made in Washington, Brussels, and Moscow, I concluded that NATO had a future, conditional on political will, burden-sharing, and the restoration of transatlantic confidence that Biden's election was expected to deliver. Half of that analysis held. The other half rested on an assumption about institutional resilience that the intervening years have tested in ways I did not fully anticipate. The threats I identified were real. The mechanism by which they would materialise was different from what I modelled, and considerably more complex.

NATO is not dead. But the question in 2026 is no longer whether it has a future. It is what kind of alliance survives, under what political conditions its guarantee remains credible, whether its architecture can respond to a threat that operates deliberately beneath its response thresholds, and who is now doing the work of filling the gap that uncertainty creates.

A president who promised to end a war in 24-hours is now managing a Middle Eastern conflict that has depleted the munitions that war would have required. An adversary that cannot match NATO conventionally is dismantling its internal coherence through arson, assassination, and algorithmic amplification. An open society with a world-class intelligence service is watching its exposure widen in the space between what its agencies can see and what its institutions can close.

Those are not abstract strategic problems. They are operational conditions. And they deserve answers that go beyond hoping the formula holds.

Ismay's formula kept the Russians out, the Americans in, and the Germans down. In 2026, the Americans are elsewhere, the Russians are already inside, and Europe is working out what that means without a map.

Björn Rifesser is the founder of Protection in Shifting Domains and Ombrex Consulting. He works at the intersection of protective intelligence, hybrid threat advisory, and security architecture.

References

AIVD and MIVD (2026) Russische hybride aanvallen nemen toe [Russian hybrid attacks are increasing]. The Hague: General Intelligence and Security Service / Military Intelligence and Security Service. Available at: https://www.aivd.nl/publicaties/publicaties/2026/02/19/russische-hybride-aanvallen-nemen-toe

Bloomberg (2025) 'Why Russia Plotted to Kill the Rheinmetall CEO Arming Ukraine'. Available at: https://www.bloomberg.com/news/features/2025-08-04/why-russia-plotted-to-kill-the-rheinmetall-ceo-arming-ukraine

Chatham House (2025) 'Trump's new national security strategy: Cut deals, hammer Europe, and tread gently around autocrats'. Available at: https://www.chathamhouse.org/2025/12/trumps-new-national-security-strategy-cut-deals-hammer-europe-and-tread-gently-around-autocrats

Christian Science Monitor (2026) 'Restocking US missile interceptors will take years. China and Russia are watching'. Available at: https://www.csmonitor.com/USA/Military/2026/0817/us-missile-shortage-iran-russia-china

CNN (2024) 'Rheinmetall: US and Germany foiled Russian plot to assassinate Armin Papperger'. Available at: https://www.cnn.com/2024/07/11/politics/us-germany-foiled-russian-assassination-plot/index.html

CNN (2026) 'Nearly 80% of interceptors for a key missile defense system depleted, sources say'. Available at: https://www.cnn.com/2026/08/04/politics/us-iran-key-missile-interceptors-low

Diplo. (2026). Power without apology: Coercive diplomacy and the Donroe Doctrine - Diplo. [online] Available at: https://www.diplomacy.edu/blog/power-without-apology-coercive-diplomacy-and-the-donroe-doctrine/

DutchNews.nl (2026) 'Dutch intelligence service ranked third best in Europe'. Available at: https://www.dutchnews.nl/2026/08/dutch-intelligence-service-ranked-third-best-in-europe/

GLOBSEC (2025) 'Update of Russia's Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare'. Available at: https://www.globsec.org/publication/update-russia-crime-terror-nexus-hybrid-warfare-europe

IISS (2025) 'The Scale of Russian Sabotage Operations Against Europe'. Available at: https://www.iiss.org/globalassets/media-library—content--migration/files/research-papers/2025/08/pub25-095-the-scale-of-russian-sabotage-operations.pdf

Kyiv Independent (2024) 'Media: Special unit of GRU recruiting saboteurs through social media'. Available at: https://kyivindependent.com/media-special-unit-of-gru-recruiting-saboteurs-through-social-media/

NL Times (2026a) 'Dutch AIVD ranked one of Europe's best intelligence services'. Available at: https://nltimes.nl/2026/08/05/dutch-aivd-ranked-one-europes-best-intelligence-services

NL Times (2026b) 'Dutch intelligence agencies warn of escalating Russian hybrid attacks'. Available at: https://nltimes.nl/2026/02/19/dutch-intelligence-agencies-warn-escalating-russian-hybrid-attacks

NPR (2026) 'The soaring demand for Patriot missiles, from the Middle East to Ukraine'. Available at: https://www.npr.org/2026/08/04/g-s1-137287/us-patriot-missiles-ukraine-middle-east-iran-war

OCCRP (2024) 'Make a Molotov Cocktail: How Europeans Are Recruited Through Telegram to Commit Sabotage, Arson, and Murder'. Available at: https://www.occrp.org/en/investigation/make-a-molotov-cocktail-how-europeans-are-recruited-through-telegram-to-commit-sabotage-arson-and-murder

RUSI (2025) 'Responding to Russian Sabotage Financing'. Available at: https://www.rusi.org/explore-our-research/publications/insights-papers/responding-russian-sabotage-financing

MIVD (2018) GRU close access cyber operations against organisations. The Hague: Military Intelligence and Security Service.

NCSC (2025) Cybersecuritybeeld Nederland 2025. The Hague: National Cyber Security Centre.

Reuters (2023) 'China-linked espionage operations targeted ASML technology'. Reuters.

Reuters (2024) 'Netherlands restricts ASML chip equipment exports to China'. Reuters.

Rijksoverheid (2024) Weerbaar Nederland. The Hague: Ministry of the Interior and Kingdom Relations.

Rijksoverheid (2025) Voorbereid op een crisis. The Hague: Rijksoverheid.

Washington Post (2025) 'Trump's flip-flop on how easy it would be to end the Russia-Ukraine war'. Available at: https://www.washingtonpost.com/politics/2025/05/22/trump-russia-ukraine-24-hours-fact-checker/