The criteria for an armed seizure attempt explicitly include failed, quickly repelled, or "little green men" proxy incursions, significantly lowering the threshold for what constitutes an attack compared to a sustained occupation. However, with only about four months remaining until February 2027, the probability of such an event in Estonia is very low. Russian forces remain heavily tied down in Ukraine, with no ceasefire in place and evidence indicating that Putin remains focused on pushing for

The 8% probability reflects a low but non-zero risk of a deliberate Russian ground seizure attempt in Estonia before February 2029. NATO's collective defense deterrent and the associated risk of major conventional or nuclear escalation remain strong constraints. There is currently no Russian troop buildup near Estonia and no intelligence indicating an imminent attack news.err.eenews.err.eevm.eenews.err.ee. Furthermore, Russia has never attempted to seize territory from a NATO member state, making the

The primary driver of risk for this scenario lies in specific, recent intelligence warnings. In July and August 2026, Polish and Lithuanian intelligence reported that Russia was considering staged false-flag provocations against NATO infrastructure using captured Ukrainian drones 55 sources. Crucially, even if Russia denies involvement or blames Ukraine, a staged attack using repurposed hardware would qualify as a Russian-orchestrated strike so long as there is inde

The 16% probability of a significant missile or mass-drone attack (3+ drones) on Estonia before February 1, 2029, reflects a threat that is materially higher than a direct land incursion, though still unlikely in absolute terms. Deniable aerospace provocations offer Moscow a cheaper, lower-commitment tool to test NATO resolve than deploying ground forces. The extended 28-month time horizon is critical: it spans a potential ceasefire in Ukraine, the November 2026 US midterms, and the January 2029

The possibility of a Russian territorial probe in the Baltics is slightly elevated by the broad scope of this scenario. Including Latvia and Lithuania alongside Estonia introduces strategic vulnerabilities like the Suwałki Gap, the Kaliningrad corridor, and the Belarus border. Furthermore, the standard for a qualifying event is deliberately broad: it includes quickly repelled "little green men" operations and deniable proxy incursions, meaning Moscow would not need to successfully hold ground or

The 10% probability reflects the broad geographic scope of the Baltics and the extended timeframe to February 2029, while recognizing that the risk is heavily constrained by NATO's robust deterrent posture. Covering all three Baltic states encompasses highly vulnerable regions like the Suwałki Gap, Latgale, and Narva. Crucially, the attribution standard—which includes failed, quickly repelled, or deniable proxy "little green men" incursions—lowers the threshold for this scenario. Even a brief, d

Intelligence Warnings and Exact-Match Criteria A significant factor driving this risk is the explicit warning from Baltic and Polish intelligence regarding Russian false-flag operations. In July and August 2026, Polish and Lithuanian officials warned that Moscow is actively considering the use of captured Ukrainian drones to strike NATO critical infrastructure 44 sources. This specific vector perfectly maps onto a scenario where an attack could be staged with plausible

Broad Scope and Timeline This scenario represents the most elevated risk profile in the Baltic region due to its broad geographic scope—encompassing Estonia, Latvia, and Lithuania—and a lengthy 28-month window extending to February 1, 2029. This extended horizon spans potential Ukraine ceasefire negotiations, shifting Western domestic politics, and the January 2029 US presidential transition, offering numerous windows of opportunity for gray-zone escalation or coercive signaling.

**Explicit