A new International Institute for Strategic Studies report plots 144 suspected drone sightings across NATO airspace from 2024 to 2026 and says Russia likely used unmarked vessels to probe Europe's low altitude blind spot.
For three years, something has been flying below the radar across NATO Europe: low, slow, and unmapped. By late 2025, the volume of those flights had grown large enough to force temporary closures of civilian airports in Germany, Spain, and Denmark, while NATO had no automatic trigger to respond. A report published Thursday by the International Institute for Strategic Studies has now plotted 144 suspected drone sightings across European airspace between 2024 and 2026 and concluded that Russia likely used unmarked vessels, which the report calls "shadow ships," operating beyond territorial waters to put those drones in the air.
The IISS assessment, shared with the Associated Press ahead of publication, is the most detailed public dataset yet of a campaign that has quietly reshaped the strategic question for European defense. The question is no longer whether drones can reach NATO airspace, but whether the alliance can see them, attribute them, and decide what to do about them in time. The dataset names Germany, France, Belgium, the Netherlands, the United Kingdom, and Denmark among the affected members. Only Sweden, of the countries tracked in the report, has formally blamed Moscow.
The human stakes landed in Denmark first. Prime Minister Mette Frederiksen publicly characterized the incidents inside Danish airspace as "the most serious attack on Danish critical infrastructure to date," a phrase that put a civilian-policy frame around what military planners had been calling a gray-zone problem. An Associated Press companion piece confirmed that drone incursions repeatedly alarmed NATO airspace and triggered fighter jets scrambled across multiple member states, even when no shots were authorized and no aircraft were shot down.
The IISS dataset distinguishes aggregate plotting from individually verified incidents, and the report's verdict on launch platforms is hedged. The institute assesses that Russia "likely" used shadow ships: unmarked vessels that loiter in international waters and launch drones toward shore. The reasoning is that the drone flight profiles match sea-based launch geometry and the geographic distribution of sightings clusters along coastlines reachable from open water. The hedge matters. The 144 sightings mix suspected and confirmed events, the report is an analyst product rather than a declassified intelligence finding, and the Russian government has denied responsibility. The pattern, not any single flight, is the evidence.
Why this beats the defenses Europe has built is straightforward once the category is named. NATO's integrated air and missile defense architecture was designed for fast, high-signature threats: military aircraft, ballistic missiles, and cruise missiles flying predictable corridors. A small drone launched a few dozen miles from a coastline flies low and slow, looks like a bird or a light aircraft on civilian radar, and can be airborne before any single national system has authority to act. Because it is not a missile and not a manned military aircraft, it sits beneath the threshold at which NATO's Article 5 collective-defense clause has historically been discussed. The reported campaign objectives, in the IISS reading, are precisely to monitor military sites and test NATO responses while staying below that threshold.
The structural gap the report exposes is therefore not a sensor failure but a decision gap. Civilian air-traffic systems can ground planes when an unidentified drone is reported, as happened in Germany, Spain, and Denmark in late 2025, but they cannot attribute or deter. Military air-defense systems can scramble jets, as the AP reporting describes, but they are built to engage targets they can classify, and a slow drone over a commercial airport does not match the engagement criteria they were designed around. Between those two systems sits a layer of work: detection fusion, attribution rules, cross-border notification, and political thresholds for response. European defense policy has not yet built this at the scale the IISS dataset implies is now required.
What Europe is being forced to learn is concrete. The next adaptation phase will be measured in three places. First, whether NATO members move to fuse civilian and military drone-detection feeds in real time. Second, whether the alliance or the European Union produces an attribution doctrine that can assign responsibility for a drone swarm within hours rather than weeks. Third, whether the political threshold for action is revised for sub-threshold tools. Frederiksen's framing in Denmark, attack on critical infrastructure rather than airspace violation, is the early signal of where that threshold is heading. The IISS report does not predict whether it will hold. It documents the pressure being applied to it.