Part I — Situation overview

On Thursday, 24 September 2026, Danish military intelligence (Forsvarets Efterretningstjeneste, FE) published a new threat assessment. According to it, the risk that Russia will launch a limited military action against a NATO member state in the coming months is “low, but growing”. The report names two scenarios: a long-range strike on NATO infrastructure supporting Ukraine, or a small-scale incursion, possibly without insignia, into the territory of a member state bordering Russia. According to Thomas Ahrenkiel, head of the service, the aim of such an action would not be to occupy a country, but to divide NATO. The service still considers a full-scale invasion very unlikely (24.hu and Portfolio, 24–25 September 2026). On the night before the report, a fire broke out at the Wola Krobowska ground station of the Polish state-owned Exatel, which is also used by Starlink. Deputy Prime Minister Krzysztof Gawkowski called it deliberate sabotage. On Thursday morning a drone crashed in Suceava County, Romania; two F-16s of the Romanian Air Force took off, and Moldova reported the incursion of four Russian drones (24.hu, BBC, 24 September 2026). NATO Secretary General Mark Rutte said on the same day that the Alliance has worked out every possible response, but the population need not panic.

At home, two issues came to the fore on the same day. Defence Minister Romulusz Ruszin-Szendi denied a press report according to which Hungary is not taking part in the European Union’s programme called SAFE (Security Action for Europe). This is a long-term EU loan at favourable interest for member states’ defence investments. According to the minister, the loan has to be repaid, so it may only be spent on developments that do not overburden public finances (24.hu, 24 September 2026). The minister also announced that two soldiers had died in the line of duty in recent days. One of them took his own life; the other fell ill during training and died in hospital the next day. The investigation of the circumstances is ongoing (HVG, 24 September 2026). MIAK expresses its condolences to the relatives and comrades. Anyone in a crisis can ask for help on the free 116-123 emotional first-aid line.

The background to the topic is well known. In April MIAK wrote about the review of the earlier SAFE plan, worth EUR 16.2 billion according to the press (Review of the SAFE defence loan application), and in July, after the Russian cruise missile that struck Polish territory, it pointed out the absence of a Hungarian airspace-violation procedure (The threshold of Article 4). MIAK’s reading: the Danish report is not a prophecy of war but a risk classification, and the most concrete Western warning so far. The likely danger is hybrid warfare: pressure exerted by non-military means — sabotage, cyberattacks, disinformation — in which the attacker can deny responsibility. The answer to this is not alarm but measurable preparedness. And the SAFE loan is neither good nor bad in itself: what it is worth has to be decided project by project.

Part II — Foundations in the literature

Three sources provide the interpretative framework. In his work On War, Carl von Clausewitz, the early-19th-century Prussian general and military theorist, starts from the premise that the scale of war is determined by the political object. A limited object calls for limited means, and one type of war is precisely the one that tests the cohesion of a shaky alliance. The scenario of the Danish report — a small incursion to divide NATO — fits this logic. According to Clausewitz’s “trinity”, the outcome of war depends on the combined condition of the people, the army and the government; hybrid pressure targets precisely the trust between the people and the government. The European Union’s 2016 global strategy (Shared Vision, Common Action) treats hybrid threats as a shared challenge of internal and external security. It states that the foundation of a resilient state is a society that trusts its institutions, and that defence cooperation must become the norm. The European Commission’s 2026 macroeconomic report (2026 European Macroeconomic Report), in turn, quantifies the price of fragmented procurement. It describes the conditions of the SAFE instrument and points out that in Europe the economic effect of defence spending is often negligible, because a large part of procurement is imported. The detailed discussion of the literature — by author, with quotations — can be found in section 6.4 Literature in detail.

Part III — MIAK’s concrete proposal

MIAK proposes four measurable measures. The first three respond to the security risk and to financing, the fourth to responsibility towards the personnel of the Hungarian Defence Forces.

3.1 A public project yardstick for the SAFE loan (yardstick published within 60 days, every project sheet before the loan agreement is signed)

MIAK proposes that before any application for, or amendment of, the SAFE loan, the Ministry of Defence (HM) publish a fixed project yardstick and, measured against it, a public project sheet on every planned development. The yardstick should answer five questions. Which missing capability among NATO’s capability targets does the project fill? Does it create alliance interoperability — that is, the ability to work together with the allies’ systems? Is it implemented through joint procurement with at least one other member state? What is the share of intra-EU and domestic added value? What is the total life-cycle cost, and what repayment path does it imply for the coming budget years? According to the Commission report (see 6.4.3), uncoordinated procurement consumes a significant share of European military spending, and the economic effect of imported equipment leaks away. Domestic and EU added value is therefore not an industrial concession, but a condition for the loan to pay off. The project sheets should be discussed by the committee of the National Assembly responsible for defence matters. And the repayment should appear on a separate line in the budget act adopted by the National Assembly. The proposal applies programme point HV4 on joint procurement and programme point HV2 on transparency. The principle also voiced by the minister — that procurement should not always go to the same companies — can be verified if the yardstick and the list of winners are public.

3.2 A national hybrid incident register and the inclusion of physical sabotage in the risk assessment of critical infrastructure (by 31 March 2027)

The case of the Polish Starlink station has shown that hybrid attacks do not take place only in cyberspace. MIAK proposes that Hungary introduce a national hybrid incident register. It should include airspace violations, suspicious drone sightings, sabotage against critical infrastructure and significant cyberattacks, with uniform categories. The register should be published quarterly, delayed and aggregated for national security reasons. Competences must be laid down in advance. Air defence and the military response are the task of the HM and the Hungarian Defence Forces. Public alerting, disaster management and police investigation fall under the Ministry of the Interior (BM). And in the risk assessment of telecommunications, energy and railway operators — alongside the cybersecurity obligations — the physical sabotage scenario should also be mandatory. The EU global strategy (see 6.4.2) regards the resilience of critical infrastructure and information sharing among member states as the foundation of defence against hybrid threats. The proposal builds on programme points HV7, HV1 and D5, and, because of the vulnerability of satellite links, also on programme point D17 on sovereign digital infrastructure.

3.3 An annually published, unclassified national threat assessment and a public alert drill (first edition in the first quarter of 2027)

The Danish report triggered a sober debate because it is public, and it states not only the risk but also its likelihood and time horizon. MIAK proposes that the Military National Security Service, which is under the direction of the defence minister, and the HM publish an unclassified, easy-to-understand threat assessment every year. In it the main risks should appear with likelihood categories (for example “very unlikely”, “low, but growing”), and each category should come with a list of actions for the public. In parallel, there should be a nationwide public alert drill every year, together with the disaster management organisation of the BM. The Romanian alert, which reached the residents of the affected counties within minutes of the drone incursion, shows that the system works if it has been rehearsed in advance. The proposal is part of programme point HV11 on strategic communication and programme point HV7 on societal resilience, and on the foreign-policy side of crisis decision-making it is linked to the KP7 protocol. According to Clausewitz’s proposition (see 6.4.1), war depends on the people, the army and the government together — hybrid pressure relies on eroding trust, so credible information is itself a defence capability.

3.4 Duty of care towards personnel (after the investigations are closed)

The deaths of the two soldiers are individual tragedies from which no hasty conclusions should be drawn. MIAK proposes that after the investigations are closed, the HM publish the findings in aggregated and anonymised form, respecting the dignity of the relatives. These should show whether the medical protocol of training or the system of psychological support needs to be changed. MIAK further proposes that the Defence Forces publish every year, in aggregated form, the availability and use of services concerning the mental health of personnel. This includes the network of military chaplains and psychologists, as well as the anonymous helpline. The aim is not to search for those responsible in public, but to ensure that, amid a growing burden, the help available to soldiers not only exists but is also measurable.

The common principle of the four proposals is that the best answer to a security risk is measurable preparedness and public accountability. For the loan this is the project yardstick, for the hybrid threat the register and the drill, and in communication an assessment that works with likelihood categories. Both the Commission report and the EU global strategy show that defence today is not only a matter for the army: it is an industrial, fiscal and societal matter too.

Part IV — Expected effects and risks

Dimension Expected effect Risk
Security The pattern of hybrid incidents becomes visible; competences are clarified in advance Overly detailed public data also informs the attacker — hence delayed, aggregated publication is needed
Budget The SAFE loan goes only to projects that pay off and are sustainable on the repayment path The yardstick may slow down take-up, and Hungary may be squeezed out of the favourable terms
Industry and economy Intra-EU and domestic added value grows, leakage through imports shrinks Domestic supplier capacity is narrow; the added-value requirement may make procurement more expensive
Society The likelihood categories and the alert drill reduce both panic and dismissal A badly timed alert drill or report may itself cause alarm
Public administration The tasks of the HM and the BM are clearly separated; critical infrastructure operators know what they must report New administrative burden for operators; developing uniform categories takes time
Personnel The use of the support system becomes measurable; the lessons of the investigations are built in Publicity may violate the privacy of the relatives if not sufficiently anonymised

The main question to be weighed is the degree of publicity. Too little information gives room to scaremongering and disinformation, while too much may give clues to the attacker. MIAK therefore proposes not real-time but delayed and aggregated publication. The second question is the timing of the SAFE loan. With a strict yardstick, fewer projects may qualify, and the country may use only part of the envelope. This, however, is not a loss if the projects left out would not have delivered real capability. For a repayable debt of several billion euros, speed cannot be a value in itself. The third question is tone: the report is a warning, not a prophecy. Risk communication succeeds if the reader understands at the same time that the danger is real and that the likelihood of full-scale war is very low today.

Part V — Measurability and summary

5.1 What is worth following? (suggested KPIs)

MIAK proposes following the performance indicators below (KPIs — Key Performance Indicators):

  • Coverage of SAFE project sheets: for what percentage of the projects planned from the SAFE loan a public project sheet appeared before the loan agreement was signed. Suggested target: 100%.
  • Joint procurement and added value: what percentage of the value financed from SAFE is implemented through joint procurement with at least one other member state, and what the share of intra-EU and of domestic added value is. It is worth following whether the import share decreases year by year.
  • Hybrid incident register: whether the first quarterly summary has appeared by 31 March 2027, and what percentage of telecommunications, energy and railway operators’ risk assessments include the physical sabotage scenario. Suggested target: 100% by the end of 2027.
  • Preparedness: whether the annual nationwide alert drill has taken place, and how public preparedness develops in the annual National Resilience Survey proposed in programme point HV7.
  • Personnel: the availability and aggregated use of psychological support services, published annually.

5.2 Summary

MIAK’s request to decision-makers: receive the Danish report neither with panic nor with dismissal, but with measurable steps. Decide on the SAFE loan project by project, according to a public yardstick, and have the repayment appear in the budget. There should be a public, delayed register of hybrid incidents, physical sabotage should be included in the risk assessment of critical infrastructure, and an easy-to-understand threat assessment should be published every year, together with an alert drill. In the case of the two soldiers who died, the lessons of the investigations must be communicated tactfully but publicly.

Two MIAK foundational values are at play here. Data-drivenness, because the debate on security risk can only be sober if it rests on likelihood categories and public incident data, not on mood — the same is true of the loan, whose value can be measured project by project. And accountability, because a repayable defence debt of several billion euros is only legitimate if, for every euro used, it can be stated afterwards what capability and how much domestic work it brought.

Part VI — Reasoning and further sources

6.1 Press framing by spectrum

In the public-affairs and economic segment, most outlets relied on international sources, but with different emphases. 24.hu, drawing on the Financial Times report, gave the most detailed, nuanced picture: it specifically highlighted that the Danish service sharply separates a limited action from full-scale war, and it also reported the service’s earlier time horizons. The same outlet carried the minister’s clarification in the SAFE debate, the Romanian drone incident and Rutte’s “no reason to panic” message. Telex, based on the Guardian, put the emphasis on hybrid examples — the drone at Leipzig airport and the sabotage plans against the Danish defence industry. Portfolio wrote on the basis of Sky News. The text of the article is balanced, but its headline (“Szárazföldi invázió is jöhet” — “A land invasion may also come”) is sharper than what the report states, since the service considers a full-scale invasion very unlikely. This is a good example of how, in risk communication, the headline is itself a substantive decision.

In the left-liberal segment, outlets highlighted the communication side of the issue. An analysis by 444.hu, published in a joint project with independent Central and Eastern European outlets, already asked in its headline whether war is really imminent, or whether this is exactly what the Kremlin wants us to believe. The article goes through the Polish, French and Baltic warnings and asks where the line runs between warning and scaremongering. HVG’s subscription analysis opened with a similar question. According to its introduction, American experts argue that the Russian leadership, cornered by the meagre breakthroughs at the front, may become more unpredictable. Népszava carried the warning of French President Emmanuel Macron, according to which France too could become the target of a Russian drone attack. At the same time, according to Portfolio’s report, the French president denied that the CIA had warned Paris of a concrete strike affecting Southern Europe.

In the pro-government conservative segment, the Magyar Nemzet material examined by MIAK focused on the domestic thread, the announcement of the two soldiers’ deaths, in a short, factual form. Based on the articles examined, the conservative segment did not put the Danish report and the SAFE debate in its top focus on this day. From MIAK’s point of view, the difference between the segments is instructive. The left-liberal outlets highlighted the danger of scaremongering, the public-affairs outlets the details of the scenarios, the conservative outlet the matter of domestic personnel — the full picture requires all three.

6.2 Facts and data

Data point Value Source
Risk of a limited Russian military action against a NATO member “low, but growing”, in the coming months Danish military intelligence (FE), 24 September 2026; 24.hu, Telex
Full-scale Russian invasion of a NATO member very unlikely FE; BBC, 24.hu, 24 September 2026
The service’s earlier time-horizon estimate 6 months for a local war, 2 years for a regional threat, 5 years for a large-scale European war 24.hu / Financial Times, 24 September 2026
NATO members bordering Russia Finland, Norway, Estonia, Latvia, Lithuania, Poland Portfolio, 25 September 2026
Fire at the Polish ground station evening of 23 September 2026, Wola Krobowska; operated by the state-owned Exatel, also used by Starlink; the station remained operational Notes from Poland, BBC, 24 September 2026
Russian sabotage incidents in Europe since 2022 151, of which 31 in Poland International Centre for Counter-Terrorism (ICCT), cited by Notes from Poland, 24 September 2026
Drone incident in Romania morning of 24 September, approx. four minutes in Romanian airspace, crashed in Suceava County; two F-16s took off; public alert at 6:26; no injuries or damage Romanian Ministry of National Defence, 24.hu, 24 September 2026
Drone incident in Moldova four Russian drones entered the airspace, at least one exploded President of Moldova, BBC, 24 September 2026
SAFE instrument envelope up to EUR 150 billion in long-term, favourable loans; demand exceeded the envelope European Commission, 2026 European Macroeconomic Report
Earlier Hungarian SAFE plan EUR 16.2 billion (put under review by the Tisza government in spring 2026) Portfolio, 22 April 2026
Number of weapon systems 121 in the EU, 21 in the USA European Commission, 2026 European Macroeconomic Report
Annual cost of uncoordinated procurement EUR 18–57 billion (6.5–20.5% of European military spending) European Commission, 2026 European Macroeconomic Report
Share of defence procurement from European sources below 50% European Commission, 2026 European Macroeconomic Report
Deaths of Hungarian soldiers two soldiers, investigation of the circumstances ongoing HM announcement, HVG, Magyar Nemzet, 24 September 2026

Two remarks belong to the figures. First, the categories of the Danish assessment — “very unlikely”, “low, but growing” — are not exact percentages, but the likelihood bands customary in intelligence analysis. Precisely for this reason it is worth working with similar categories for the Hungarian public as well: this way the warning cannot be read as a prophecy. Second, the earlier Hungarian SAFE plan of EUR 16.2 billion was prepared under the Orbán government. The current government has not yet published any result of its review; the minister only stated that taking up the loan has not been ruled out.

6.3 Policy dimensions

  • Defence (programme points) — project-by-project assessment of the SAFE loan, joint procurement, transparency of defence spending, societal resilience, cyber defence and strategic communication (programme point ID: HV4, HV2, HV5, HV7, HV1, HV11);
  • Foreign policy (programme points) — maintenance of alliance relations and the foreign-policy crisis management protocol in the event of a limited action against a NATO member (programme point ID: KP24, KP7);
  • Digitalisation and AI regulation (programme points) — cybersecurity of critical infrastructure and the vulnerability of satellite and sovereign digital infrastructure (programme point ID: D5, D17).

6.4 Literature in detail

6.4.1 Carl von Clausewitz: On War

One of the central propositions of Clausewitz’s first book is that the scale of war is set not by military logic but by the political object:

“Thus, therefore, the political object, as the original motive of the War, will be the standard for determining both the aim of the military force and also the amount of effort to be made.”

It follows that there are infinitely many gradations between wars. At one end stands the life-and-death struggle for political existence, at the other the war that a forced or wavering alliance wages as an unpleasant duty. According to Clausewitz, whoever rejects these intermediate gradations in theory excludes reality. In the same place he describes the “remarkable trinity” of war. Instinctive passion concerns primarily the people, the play of probability and chance the army and its commander, and political reason the government. The scenario of the Danish report can be read within this framework: a small-scale incursion or a strike disguised as an “accident” is a limited object pursued with limited means, which seeks not territory but to test the cohesion of the alliance. Hybrid pressure, in turn, would erode the trust between the popular and the governmental members of the trinity. This is why MIAK proposes in point 3.3 a public threat assessment working with likelihood categories. MIAK’s programme point HV7 also builds on this threefold unity.

📖 Source: Carl von Clausewitz: On War (Vom Kriege, 1832)

6.4.2 European Union: Shared Vision, Common Action

The EU’s 2016 global foreign and security policy strategy lists hybrid threats, alongside terrorism, energy security and cybersecurity, among the challenges that have both an internal and an external dimension. According to the strategy, these can only be answered through closer cooperation among law enforcement, judicial and intelligence services, and through joint situational assessment. It names the resilience of critical infrastructure, networks and services as a separate objective. The strategy extends the concept of resilience to society as well:

“A resilient society featuring democracy, trust in institutions, and sustainable development lies at the heart of a resilient state.”

On defence capabilities, the document states that member states remain sovereign in their decisions, but defence cooperation must become the norm, because no single member state can afford to develop everything alone. It also records the shared commitment that 35 percent of equipment spending should be carried out through joint procurement, and acknowledges that member states are far from this. The SAFE instrument — which makes joint procurement a condition of the favourable loan — is the financial implementation of this goal set ten years ago. In the Hungarian SAFE assessment, therefore, joint procurement is not a side consideration (3.1), and in defence against the hybrid threat the register and information sharing follow the strategy’s own logic (3.2).

📖 Source: European Union: Shared Vision, Common Action: A Stronger Europe — A Global Strategy for the European Union’s Foreign and Security Policy (2016)

6.4.3 European Commission: 2026 European Macroeconomic Report

The defence chapter of the Commission report contains three propositions directly usable for the Hungarian decision. The first is the price of fragmentation. In the 27 EU member states there are 121 different weapon systems, in the United States 21, and less than half of defence procurement comes from European sources. The report puts it this way:

“The lack of coordinated procurement and dependence on non-EU suppliers carries costs ranging from EUR 18 billion to EUR 57 billion (6.5% to 20.5% of all the European military spending) annually.”

Citing a study, the report adds that unit costs can fall by 10–15 percent with each doubling of production. The second proposition is SAFE itself: according to the Commission’s description, it involves up to EUR 150 billion in favourable, long-term loans. Clear eligibility conditions apply to contracting parties and subcontractors, so that the investment strengthens the European defence industrial base and joint procurement. The third proposition concerns the economic effect. According to the literature, the multiplier of defence spending — that is, how much economic expansion one euro of spending triggers — is typically positive in the United States, but often negligible or negative in Europe. The report explains this mainly by the different share of imported equipment. Translated to the Hungarian SAFE decision: a repayable loan brings more than security if procurement is joint and as large a part of the added value as possible is generated within the EU, preferably at home. This is what the project yardstick proposed in point 3.1 measures.

📖 Source: European Commission: 2026 European Macroeconomic Report (Institutional Paper 328)

6.5 International comparison

For a public threat assessment, Denmark itself is the closest example: its military intelligence communicates its assessment in a public report, with likelihood categories. In the current report it also made public how much time Russia would need for a local, a regional and a large-scale European war. According to 444.hu’s summary, Lithuania already approved its detailed national evacuation plan in July, and the prime minister has now publicly confirmed that they are prepared for various scenarios. In Germany hospitals are being prepared for a possible conflict. For public alerting, Romania provides the most recent, directly neighbouring example: during the drone incursion the RO-Alert system notified the residents of two counties within minutes. On physical sabotage, Poland is the most experienced: according to the ICCT report, nearly a fifth of the Russian sabotage incidents identified in Europe since 2022 took place there, and in the current case the internal security agency immediately joined the investigation. According to the BBC, France has ordered a separate plan to protect critical infrastructure and defence industrial sites. The legal framework is given at EU level: Directive (EU) 2022/2555 on network and information security (NIS2) lays down the cybersecurity obligations, and Directive (EU) 2022/2557 on the resilience of critical entities the obligations concerning physical resilience. The risk assessment requirement proposed in point 3.2 links the two. A counter-example on the scheduling of defence spending is the Czech Republic: according to Deutsche Welle, the Czech government cut the defence budget for 2026 to about 1.7 percent of gross domestic product (GDP), and promises the old 2 percent NATO target only for 2027. Meanwhile the Alliance’s new target is already 3.5 percent. The US ambassador to NATO publicly criticised this — so the spending path has become a question of alliance credibility. The Czech case also shows that the choice between defence spending and social spending is the subject of open political debate; according to MIAK, this debate can be made factual with project-level data.

Defence

  • HV4 — EU defence industrial base and joint procurement
  • HV2 — Transparency of defence spending
  • HV5 — Scheduled increase of defence spending
  • HV7 — Societal defence resilience
  • HV1 — Cyber defence capacity building
  • HV11 — Strategic communication and information defence

Foreign policy

  • KP24 — Cyclical maintenance of alliance relations
  • KP7 — Foreign-policy crisis management protocol

Digitalisation and AI regulation

  • D5 — Cybersecurity strategy
  • D17 — Space and sovereign digital infrastructure

Proposed new programme point: An annually published, unclassified national threat assessment with likelihood categories and a list of actions for the public, linked to an annual nationwide alert drill — for the Defence area.

6.7 List of sources

Press sources (MIAK press monitor, 25 September 2026 — topic 3):

Supplementary international press sources (MIAK foreign press monitor, 25 September 2026 — topic 1):

Knowledge base references (literature):

  • 📖 Carl von Clausewitz: On War (Vom Kriege, 1832)
  • 📖 European Union: Shared Vision, Common Action: A Stronger Europe — A Global Strategy for the European Union’s Foreign and Security Policy (2016)
  • 📖 European Commission: 2026 European Macroeconomic Report (Institutional Paper 328)

MIAK internal materials:

  • MIAK policy area: Defence (programme points; programme point ID: HV4, HV2, HV5, HV7, HV1, HV11)
  • MIAK policy area: Foreign policy (programme points; programme point ID: KP24, KP7)
  • MIAK policy area: Digitalisation and AI regulation (programme points; programme point ID: D5, D17)
  • MIAK press monitor, 25 September 2026 — topic 3, score: 86/100

Supplementary public data sources:

  • Danish military intelligence (Forsvarets Efterretningstjeneste) — threat assessment, 24 September 2026
  • International Centre for Counter-Terrorism (ICCT) — report on Russian sabotage incidents in Europe
  • Directive (EU) 2022/2555 (NIS2) and Directive (EU) 2022/2557 (on the resilience of critical entities) of the European Parliament and of the Council
  • SIPRI Military Expenditure Database — defence spending by country
  • NATO — annual communiqué on member states’ defence expenditure

Generation metadata