Iran’s European Threat: Cognitive Warfare – Covert Operations and the Risk of NATO Escalation

Strategic Intelligence Dossier | European Security | Iranian Military Capabilities | Hybrid Warfare | NATO Deterrence | 2026–2031

Scope: Assessment of Iranian coercive signalling, potential military and non-military operations against European and American interests, the roles of Russia, China and Iranian-aligned networks, and the implications for NATO and European security through November 2031.

Executive Summary / BLUF

Principal judgment: The most defensible interpretation of Iran’s expanding threats against Europe is a multidomain coercion strategy in which the political and psychological effects of threatening military installations can exceed the demonstrated capacity to strike them.

The danger is not confined to ballistic missiles. Iran’s documented experience with covert networks, proxies and cyber operations creates alternative means of imposing security costs on European governments.

The official intelligence record does not establish that Iran possesses an operational, accurate and survivable missile capability capable of striking every European location implicated by its public threats.

The stronger, independently documented concern is asymmetric escalation: coercive information operations, deniable violence, cyber disruption and attacks on interests outside a conventional battlefield.

On 10 June 2026, 24 governments issued a joint statement condemning Iranian security-service activities and attacks attributed to intermediaries. On 14 July, the United Kingdom attributed a series of European attacks to an IRGC-directed proxy organisation. These are government assessments, not judicial determinations of every individual incident. Joint statement on Iranian State Threats and HAYI-claimed attacks — UK FCDO — Jun 2026 and FCDO summons Iranian Chargé d’Affaires — UK FCDO — Jul 2026.

Iran has relationships with Russia, China and North Korea, but the March 2026 US intelligence assessment explicitly warned against treating their cooperation as an integrated military alliance.

An attempted Iranian strike against NATO territory would carry disproportionately high escalation risks, whereas covert operations could exploit legal, political and attribution uncertainties below the threshold of conventional war.

Strategic implication: European governments must assess not only whether Iran can physically reach particular military facilities, but whether Tehran can create sufficiently credible uncertainty to influence deployment decisions, domestic politics, economic expectations and alliance cohesion.

Decisive uncertainty: The current public official record does not establish whether Tehran has approved a new European operational campaign, which capabilities remain available following 2026 hostilities, or whether any external state would actively support an extension of the conflict.

Why Europe’s most consequential exposure to Tehran may lie less in ballistic missiles than in energy disruption, covert operations and the cost of sustaining NATO’s security commitments.

Europe’s central vulnerability in a confrontation with Iran is not a demonstrated Iranian ability to strike military installations across the continent, but the economic and institutional cost of defending against threats whose conventional credibility remains uncertain. The contradiction became visible in 2026: US intelligence assessed Iran’s military capabilities as severely degraded, while European governments documented Iranian-linked covert operations and the International Energy Agency recorded the largest supply disruption in global oil-market history. NATO, meanwhile, is translating strategic uncertainty into long-term financial obligations, including a commitment to spend 5% of GDP annually on defence and security by 2035. The immediate policy question is therefore not simply whether Tehran can reach Europe militarily, but whether European governments can preserve economic continuity, alliance cohesion and political decision-making without allowing coercive threats to determine their spending priorities.

1. Iran’s military weakness does not eliminate its capacity to impose costs

The 2026 Annual Threat Assessment of the US Intelligence Community, released on 18 March, described Iran’s conventional military power-projection capabilities as severely degraded following American and Israeli operations. Missile production facilities, inventories and launch capabilities had sustained substantial damage, while rebuilding important elements of the force was expected to require years. The assessment nevertheless identified Iranian space-launch technologies potentially relevant to developing an intercontinental ballistic missile before 2035, should Tehran pursue that objective. Technological potential, however, is not an operational inventory. Historical Iranian missile capabilities of approximately 2,000 kilometres cannot establish the existence of a reliable, currently available force capable of conducting sustained attacks throughout Europe.

NATO’s operational record introduces a second constraint. On 5 March 2026, the Alliance reported the identification, tracking and interception of an Iranian ballistic missile directed toward Türkiye. Its ballistic missile defence architecture, which reached Enhanced Operational Capability in July 2024, provides a functioning defensive framework, although not a guarantee of universal interception. The distinction matters because Iran’s ability to threaten a location politically is not equivalent to its ability to strike it effectively. Conversely, a reduced conventional capability does not invalidate other means of retaliation. Tehran’s strategic leverage depends on exploiting this difference between demonstrable military performance and the costs European institutions incur when confronting uncertainty.

2. Twenty-four governments have documented the threat that missiles cannot explain

On 10 June 2026, 24 governments jointly condemned Iranian-linked hostile activities, identifying operations associated with Iranian security organisations and criminal intermediaries. Italy, France, Germany, the United Kingdom and the United States were among the participating countries. The statement concerned threats against dissidents, journalists, Jewish and Israeli communities, and American interests. On 14 July, the British Foreign, Commonwealth & Development Office attributed attacks across Europe between March and May to the Islamic Revolutionary Guard Corps Qods Force acting through an intermediary organisation known as IMCR or HAYI. British authorities had also identified attacks claimed by that organisation at seven British locations, including an arson incident involving four ambulances in Golders Green.

These governmental attributions do not constitute judicial proof of every incident, but they establish something more significant than speculative military rhetoric: European authorities have identified a concrete category of Iranian-linked hostile activity operating outside conventional warfare. For national governments, the resulting costs fall on intelligence services, police, prosecutors, protective-security organisations and diplomatic institutions. An incident involving criminal intermediaries requires evidence sufficient to establish responsibility, while public attribution can produce consequences for sanctions, criminal enforcement and interstate relations. The strategic asymmetry is substantial: a threat need not involve a long-range missile to force a government to allocate resources, protect affected communities or reconsider its security posture.

3. The decisive economic shock has already occurred outside Europe

The most compelling quantitative evidence of Iran-related economic exposure is the International Energy Agency’s Oil Market Report of 12 March 2026. Before the conflict, approximately 20 million barrels per day of oil and petroleum products transited the Strait of Hormuz. During the disruption, Gulf producers curtailed at least 10 million barrels per day of crude oil, condensate and natural gas liquids production, while the IEA projected an approximately 8-million-barrel-per-day decline in global supply during March. Brent crude reached roughly US$92 per barrel at the time of the report, around US$20 above its level when hostilities began, after futures prices had approached US$120.

The institutional response was equally substantial. On 11 March 2026, IEA member countries agreed to make 400 million barrels of emergency oil reserves available. That decision demonstrated the importance of coordinated economic buffers, but also the difficulty of compensating for disruptions involving infrastructure and trade flows that cannot be rapidly replaced. For European economies, the transmission mechanism runs through imported energy costs, industrial inputs, transport expenditure, working capital and commercial continuity. These costs do not require an Iranian missile to reach European territory. They arise because a regional military confrontation can interrupt internationally significant flows of goods and energy. The March figures are a historical measure of an actual shock, not evidence that identical market conditions persisted through November.

A second infrastructure warning emerged on 4 November 2026, when the European Commission reported cybersecurity incidents involving commercial refrigeration systems across several member states, beginning on 11 October and followed by further incidents on 1–2 November. The Commission described coordinated monitoring involving ENISA, Europol, national incident-response teams and EU-CyCLONe. Crucially, it did not attribute those incidents to Iran. Their significance lies elsewhere: technologically interconnected commercial systems can require multinational institutional responses even when the responsible actor remains unidentified. Confusing infrastructure disruption with geopolitical attribution would weaken, rather than strengthen, European security analysis.

4. Europe’s defence commitments are growing faster than proven resilience

At the Hague Summit on 25 June 2025, NATO Allies committed to allocating 5% of GDP annually by 2035 to defence and security-related expenditure: at least 3.5% for core defence requirements and up to 1.5% for broader security-related investment, including critical infrastructure, civilian preparedness and resilience. According to NATO’s June 2026 defence-investment assessment, European Allies and Canada spent more than US$571 billion in 2021 prices during 2025, an increase of more than US$90 billion, or nearly 20% in real terms, compared with 2024. Their combined expenditure represented approximately 2.3% of GDP. The financial trajectory is measurable; the conversion of additional expenditure into operational readiness requires separate verification.

The European Union has introduced another financial instrument through Security Action for Europe, or SAFE, providing up to €150 billion in loans for defence-related investment and common procurement. The distinction between financing capacity and delivered military capability is decisive. Loan availability does not establish that equipment has been ordered, manufactured, delivered or integrated into national forces. Nor does the NATO spending commitment demonstrate that civilian continuity systems have been adequately tested. Governments must finance physical protection, secure communications, maintenance, industrial capacity and recovery arrangements while preserving fiscal space for other public responsibilities. Poorly sequenced investment risks generating debt and expenditure commitments before delivering corresponding security benefits.

NATO’s revised 2026 Resilience Baseline Requirements, published on 15 September, define seven civilian functions essential to collective defence: continuity of government, energy supply, movement of people, food and water, healthcare, communications and transportation. The inclusion of civilian continuity within NATO’s defence framework changes the investment calculation. Military capability increasingly depends on infrastructure and services that are frequently operated or supported by civilian institutions and commercial providers. A higher defence budget is therefore not sufficient evidence of improved deterrence unless governments can demonstrate that these functions remain available, recoverable and compatible with military requirements.

5. NATO’s legal guarantees are stronger than the assumption of a united adversarial coalition

The external strategic balance is more differentiated than the image of Iran supported by an integrated coalition of Russia, China and North Korea. The March 2026 US intelligence assessment described cooperation among the four countries as predominantly bilateral and selective, constrained by divergent interests. Russia’s strategic partnership with Iran and documented military-industrial relationships have material importance, while China’s bilateral cooperation is supported by measurable commercial ties. According to the Chinese Ministry of Foreign Affairs, China–Iran trade totalled US$9.96 billion in 2025, comprising US$6.93 billion in Chinese exports and US$3.03 billion in imports. Those figures establish economic cooperation, not a Chinese commitment to participate in military operations against European states.

The absence of an integrated opposing coalition does not eliminate the possibility of simultaneous strategic pressure. Russia, China and North Korea can pursue independent objectives that affect American and European resources without operating under common military direction. NATO faces a different institutional obligation. Article 4 of the North Atlantic Treaty provides for consultations when an Ally considers its security threatened; Article 5 establishes collective assistance following a qualifying armed attack. Serious cyber or hybrid operations may also meet the relevant threshold depending on their circumstances. These provisions give Allied governments instruments that do not depend on treating every threat as war, while leaving national authorities responsible for determining appropriate action within the treaty framework.

The European regulatory position is less uniform. On 19 February 2026, the Council of the European Union added the IRGC to the EU terrorist list, imposing restrictive financial measures. The United Kingdom subsequently developed separate national-security powers addressing foreign-state-directed activity. Yet on 8 July 2026, the European Commission referred France, Ireland, Spain and the Netherlands to the Court of Justice for failing to notify full transposition of the NIS2 Directive. That finding does not establish operational cybersecurity failure, but it exposes the distance between common European legislation and consistent national implementation. Alliance commitments can be agreed politically while regulatory and operational preparedness still depends on individual governments.

6. The next 12–24 months will determine whether preparedness produces security or merely expenditure

Between November 2026 and November 2028, European governments face three measurable tests. The first is whether NATO’s 2025 spending commitments translate into delivered capabilities rather than procurement announcements and budget authorisations. The second is whether the September 2026 resilience requirements produce demonstrably functioning arrangements for government continuity, energy supply, healthcare, communications and transport. The third is whether European security authorities can distinguish Iranian-directed hostile operations from unrelated criminal and technical incidents while maintaining credible, legally grounded attribution. These tests will matter even if Iran avoids a direct military confrontation with NATO, because economic disruption and covert-state activity can impose substantial costs without crossing conventional military thresholds.

The costs of inaction will not fall uniformly. National treasuries will absorb less efficient emergency expenditure and delayed investment; energy-intensive industries and transport operators will face greater exposure to supply interruptions; essential-service providers will bear recovery and continuity costs; and taxpayers will ultimately finance the difference between preventive preparedness and crisis response. The 400-million-barrel IEA intervention of March 2026, the €150-billion SAFE financing ceiling and NATO’s 5%-of-GDP commitment for 2035 illustrate three different financial responses to insecurity: emergency stabilisation, investment financing and long-term expenditure obligations. None guarantees resilience by itself. The decisive economic question is whether those commitments produce verified operational capacity before the next disruption forces governments to pay for the same deficiencies under emergency conditions.

---

Navigational Index

PILLAR I — Cognitive Warfare, Strategic Intent and Escalation Signalling

Chapter 1. The Strategic Context: Iran, Europe and the Transformation of Deterrence : Iran’s military and political position in 2026; the distinction between published threats, state authorisation and operational planning; the role of US–Iranian confrontation in European security.

Chapter 2. Cognitive Warfare and the Construction of European Vulnerability : The strategic purpose of public target narratives; intimidation, perception management, media amplification, alliance division, domestic political pressure and the possibility that visible threats conceal different operational priorities.

Chapter 3. Iran’s External Relationships: Russia, China, North Korea and Regional Networks : Documented cooperation, military and economic dependencies, limits of mutual assistance, competing interests, proxy autonomy and the risk of parallel crises without formal coordination.

PILLAR II — Military Feasibility, Indirect Threats and European Vulnerability

Chapter 4. Iran’s Conventional Strike Capabilities and European Reach : Ballistic missiles, cruise missiles, unmanned systems, declared versus demonstrated ranges, remaining operational capacity, delivery constraints and NATO defensive capabilities.

Chapter 5. Covert Action, Cyber Operations and Critical-Infrastructure Exposure : Iranian intelligence activity, criminal intermediaries, terrorist networks, cyber operations and European infrastructure resilience. Assessment of potential indirect pathways without presuming that every disruptive incident is attributable to Tehran.

Chapter 6. European Countries Under Pressure: Italy, France, Germany, the United Kingdom and the Wider NATO Periphery : Separate national assessments of military exposure, domestic security, civil protection, infrastructure dependencies, institutional authority and alliance responsibilities. Comparative treatment of the Eastern Mediterranean, Southeastern Europe and transatlantic coordination.

PILLAR III — Escalation Scenarios, Alliance Responses and Strategic Outlook

Chapter 7. Competing Strategic Hypotheses and Indicators of Escalation : Cognitive deterrence, coercive bargaining, deniable hybrid campaigns, direct attacks and the possibility of simultaneous pressure from strategically aligned actors.

Chapter 8. NATO, European Governments and the Economics of Strategic Disruption : Collective defence, legal thresholds, decision-making, counterintelligence, readiness costs, infrastructure protection, economic transmission and alliance cohesion.

Chapter 9. The 2026–2031 Strategic Outlook: Early Warning, Policy Options and Net Assessment : Observable warning indicators, changing military capabilities, partner-state behaviour, scenario conditions, priority intelligence gaps and proportionate defensive options.

---

Master Abstract

The central question is not whether Iran can attack Europe, but how it could make Europe behave as though an attack were imminent

The strategic significance of Iranian threats against European military infrastructure cannot be measured by missile range alone. A threat communicated publicly can influence government decisions even if the capabilities necessary to execute it remain uncertain. It can generate pressure to reinforce installations, intensify internal security, redistribute intelligence resources, revise military planning and explain new security expenditure to domestic populations. This creates an important asymmetry: the resources required to publicise a threat can be negligible compared with the institutional and economic resources required to prepare against it.

Such effects do not prove that an adversary deliberately generated every subsequent precaution. They establish a plausible mechanism through which credible threats, uncertainty and public amplification may produce coercive benefits.

For Tehran, this distinction matters because direct military confrontation with several NATO states would create severe retaliation risks. The political value of suggesting a geographically unrestricted conflict may therefore be greater than the military value of actually initiating one. However, this interpretation cannot exclude genuine preparation for an attack. Coercive signalling and contingency planning are compatible, and public information campaigns may accompany real capability development.

A European missile threat must be distinguished from a European operational strike capability

A ballistic missile’s nominal maximum range does not establish the capability to conduct an effective attack against a particular target. Operational credibility also depends on the weapon’s tested configuration, usable payload, accuracy, reliability, available launch systems, readiness and the opposing defensive environment. A longer-range space-launch technology cannot automatically be classified as a deployed long-range military missile.

The March 2026 US Annual Threat Assessment stated that Iran had demonstrated space-launch technologies potentially relevant to developing an intercontinental ballistic missile by 2035, should Tehran pursue that objective. Crucially, the same assessment described substantial degradation of Iran’s military capabilities and the prospect of a prolonged rebuilding effort. That March assessment is an authoritative historical baseline, not a verified inventory of Iranian forces in November. Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026, pp. 10–11 and 28–31.

NATO’s publicly documented defensive posture also changes the operational equation. In its updated assessment of 29 October 2026, NATO confirmed its missile-defence architecture and described the interception of Iranian ballistic missiles directed toward Türkiye in March 2026. This demonstrates an operational defensive capability, although it does not prove comprehensive protection against every missile type, attack configuration or geographic contingency. Ballistic Missile Defence — NATO — Oct 2026.

Consequently, a map of threatened installations cannot be converted into an evidence-based map of militarily reachable targets. Nor can the absence of a publicly demonstrated long-range capability establish that no such capability could be developed or concealed.

The indirect European threat is supported by a more concrete security record

The public official record establishes a history of Iranian-linked hostile activity extending beyond conventional military operations. The 10 June 2026 joint statement by 24 governments condemned plotting and violence associated with Iranian security organisations, including activities directed against dissidents, journalists, Jewish and Israeli communities, and American interests. It also identified criminal intermediaries as part of the threat environment.

The UK’s 14 July 2026 diplomatic action went further by attributing a series of European attacks between March and May to an organisation directed by the IRGC Qods Force. Joint statement on Iranian State Threats and HAYI-claimed attacks — UK FCDO — Jun 2026. FCDO summons Iranian Chargé d’Affaires — UK FCDO — Jul 2026.

These findings materially affect the European threat assessment. They establish that non-conventional activities are not merely hypothetical capabilities inferred from rhetoric. They are the subject of formal government attribution and diplomatic action. The relevant distinction concerns the potential escalation of an existing category of activity, rather than assuming that Tehran must develop an entirely new means of operating inside Europe.

Cyber operations require similar attention. The US intelligence community assessed in March that Iranian cyber actors could threaten networks and critical infrastructure, while noting limitations in their performance against more capable opponents. The assessment explicitly referenced Iran’s earlier operations against Albania. Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026, pp. 15–16.

This supports a differentiated model of risk: disruptive activity against comparatively weak defences may be more credible than complex, sustained attacks against heavily protected strategic systems. It does not establish a specific Iranian plan to attack European energy, transport, banking or telecommunications networks.

Iran’s external partners widen the strategic problem without constituting a unified war coalition

Russia, China and North Korea are important to understanding Iran’s strategic endurance, but their relationships must not be conflated with a collective defence treaty or automatic commitment to fight on Tehran’s behalf.

The March 2026 US intelligence assessment described economic support and trade as factors helping Tehran withstand sanctions, and Iranian military assistance to Russia as part of their bilateral relationship. At the same time, it characterised cooperation among the four countries as selective, primarily bilateral and constrained by divergent interests. The report explicitly cautioned that the concept of a consolidated adversarial alignment overstated the integration actually observed. Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026, p. 20.

A European crisis could nevertheless become more difficult to manage if other actors independently exploited the diversion of diplomatic, military or intelligence attention. That possibility requires analysis of observable behaviour, not an assumption of coordinated action. Economic assistance, diplomatic protection, technology exchange, intelligence sharing and direct military intervention are fundamentally different forms of support.

The assessment must also distinguish state relationships from Iranian-aligned non-state organisations. A network’s ideological affinity, previous assistance or historical operational relationship does not establish that it would participate in a new European campaign.

Europe is not a single exposure category

Italy faces a strategic problem centred on the intersection of transatlantic military cooperation, Mediterranean geography, civil protection and domestic security. The critical policy question is not whether a public threat names an Italian installation, but whether the country’s defence and security institutions can distinguish credible threat intelligence from coercive narratives without imposing disproportionate economic or operational costs.

Germany presents a distinct alliance dimension because NATO identifies Ramstein as the location of its ballistic-missile-defence command centre. German security therefore has implications for alliance coordination beyond national military protection. The challenge is to preserve operational confidence and institutional continuity while responding to intelligence-driven threats.

The United Kingdom possesses especially relevant documentary evidence concerning Iranian-linked hostile activity. Its formal attribution of proxy-directed operations in 2026 demonstrates why domestic counterintelligence and the protection of communities must be assessed alongside conventional deterrence.

France combines independent national military authority, NATO responsibilities and participation in European diplomatic and economic security mechanisms. Its exposure must be evaluated through the interaction of national decision-making, alliance solidarity and any independently established hostile activity.

The European Union collectively faces problems that cannot be resolved through national missile defence alone: cross-border intelligence cooperation, sanctions enforcement, transportation resilience, cyber preparedness and the economic consequences of sustained uncertainty.

The Eastern Mediterranean and Southeastern Europe introduce additional complications involving geographic proximity, national jurisdictions and differentiated alliance memberships. Cyprus, in particular, must not be treated as interchangeable with a NATO member when evaluating collective-defence obligations.

The fundamental strategic risk is a crisis that moves between legal and military thresholds

A conventional armed attack on NATO territory creates fundamentally different legal consequences from an unattributed cyber incident, a criminal act connected to a foreign intelligence service or a threatening media campaign.

Article 4 of the North Atlantic Treaty provides for consultations when Allied security is threatened. Article 5 establishes collective assistance following a qualifying armed attack; it does not impose an identical military response by every member. NATO also recognises that sufficiently serious cyber and hybrid attacks may, depending on the circumstances, qualify as armed attacks. The North Atlantic Treaty — NATO — Apr 1949, Articles 4–6.

A state seeking to influence European decision-making without triggering a major military confrontation therefore has incentives to operate within the difficult territory between intelligence suspicion, criminal attribution, hostile-state activity and legally established armed attack.

This assessment does not establish that Iran has chosen such a strategy for November 2026. It establishes why the combination of documented covert activity, declared hostility, uncertain conventional reach and selective international partnerships demands a broader security assessment than a missile-range calculation.

Key Evidence Table

Indicator	Value/status	Reference date	Definition/scope	Issuer	Exact source
Joint condemnation of Iranian-linked hostile activity	24 governments	10 Jun 2026	Government statement covering plots and hostile activity across Europe and other jurisdictions	UK FCDO and co-signatories	Joint statement
Proxy-directed European attacks	Formal UK attribution	14 Jul 2026	Activities attributed to an IRGC-directed organisation during Mar–May 2026	UK FCDO	Diplomatic summons
Iranian long-range missile development	Technological potential; no verified continent-wide European strike capability established by this assessment	Mar 2026 baseline	Distinction between space-launch technology and operational long-range weapons	ODNI	Annual Threat Assessment, pp. 10–11
Iranian conventional military condition	Substantially degraded, according to US intelligence	Mar 2026	Assessment made during 2026 hostilities; not a November inventory	ODNI	Annual Threat Assessment
NATO missile defence	Enhanced Operational Capability declared in 2024; heightened posture following March 2026 interceptions	Updated 29 Oct 2026	Alliance-wide defensive architecture with national contributions	NATO	Ballistic Missile Defence
Iranian cyber threat	Documented capability and persistent intent, with operational limitations	Mar 2026	Cyber espionage and attacks, including experience involving Albania	ODNI	Annual Threat Assessment, pp. 15–16
External strategic cooperation	Selective, mainly bilateral	Mar 2026	Russia, China, Iran and North Korea; not a unified military alliance	ODNI	Annual Threat Assessment, p. 20
NATO collective-defence threshold	Qualifying armed attack; assistance determined under treaty obligations	Treaty in force	Articles 4, 5 and 6	NATO	North Atlantic Treaty
EU restrictions on the IRGC	EU terrorist designation and associated restrictive measures	19 Feb 2026	EU counterterrorism sanctions regime	Council of the EU	EU sanctions against Iran

Competing Strategic Hypotheses

The following hypotheses concern Iran’s potential strategic objectives. They are not mutually exclusive: coercive signalling, preparation for covert operations and military contingency planning can occur simultaneously. Their standing reflects the available evidence, not fabricated statistical probabilities.

Hypothesis	Diagnostic support	Disconfirming evidence or limitations	Indicators	Current standing
H1 — Cognitive coercion is the principal objective	Public threats can increase perceived risk and defensive expenditure without demonstrated long-range capability	Public messaging alone cannot establish leadership intentions	Continued threat amplification without corroborated operational preparations	Strong explanatory fit; intention unproven
H2 — Covert operations are a principal alternative	Formal multinational condemnation and UK attribution of Iranian-linked European activities	Past operations do not prove a newly authorised campaign	New official attributions, connected arrests, financial-network disruption and consistent forensic findings	Substantial documented capability basis
H3 — Iran is preparing for direct military escalation into Europe	Conflict with the United States and demonstrated willingness to employ missiles regionally	No independently established capability for comprehensive strikes across Europe; degraded forces	Verified relevant tests, military deployments and official evidence of operational readiness	Possible; insufficient supporting evidence for broad claims
H4 — Wider strategic partners will amplify the crisis	Existing economic, political and military relationships	US intelligence explicitly identifies significant limits to cooperation	Coordinated diplomatic actions, new military-transfer evidence, attributable operational collaboration	Selective support credible; coordinated war strategy not demonstrated
H5 — The principal objective is diplomatic leverage rather than an attack	Escalation threats can influence negotiation costs and risk calculations	Public threats could equally reflect domestic politics or genuine preparations	Changes in rhetoric tied to formal diplomatic concessions, mediation or negotiated commitments	Plausible; requires direct corroboration

Analytical interpretation

H1 and H2 currently provide the strongest framework for evaluating the discrepancy between the breadth of publicly expressed threats and the narrower military capabilities independently demonstrated.

This is not a finding that H3 is impossible. It is a finding that the public official evidence does not justify promoting a geographically extensive threat narrative into an established operational fact.

H4 deserves particular caution. The existence of partners creates strategic possibilities, but neither trade relationships nor previous military cooperation establish an agreement to undertake attacks on European states.

H5 is important because coercive signalling may be intended to change political decisions without requiring the threatened action to occur. Demonstrating that purpose, however, requires evidence connecting the threatening behaviour to specific diplomatic objectives.

Principal Intelligence Gaps and Watch Indicators

The missile capability gap

The decisive missing information is a current, officially corroborated assessment of Iranian operational missile availability and demonstrated long-range performance following the 2026 conflict.

The difference between an announced range, a successful test and a reliably deployable weapon determines whether a threat represents practical military reach or chiefly psychological pressure.

A future official assessment documenting tested longer-range systems, available delivery platforms and credible operational performance would materially change the conventional-strike judgment.

The covert-operations gap

The June and July government records establish a basis for concern about Iranian-linked activity in Europe. They do not provide a complete account of the command relationships, available resources or current intentions of every associated network.

The most consequential new evidence would be coordinated official attribution linking multiple recent activities to common direction, financing or operational control. Such evidence would strengthen the hypothesis of a deliberate campaign rather than a collection of separate incidents.

The external-support gap

The public record does not establish a binding commitment by Russia, China or North Korea to participate in an Iranian conflict with European states.

Documented military technology transfers, coordinated operational assistance or jointly issued security commitments would be materially different from diplomatic statements or economic cooperation.

The key analytical requirement is to distinguish assistance that improves Iranian resilience from assistance specifically intended to enable attacks or coercive operations in Europe.

The European-response gap

NATO’s public record identifies important defensive capabilities, but it does not provide a comprehensive, independently auditable measurement of readiness across every relevant European installation or critical infrastructure sector.

The consequential questions concern the resilience of national decision-making, the ability to sustain protective measures, the exchange of intelligence between governments and the capacity to manage a prolonged hybrid threat without undermining essential civilian activity.

The attribution and escalation gap

A disruptive incident and an attributable hostile-state operation are not synonymous. Reliable attribution requires converging intelligence, forensic and investigative evidence.

This distinction becomes central if an incident generates demands for retaliation before government agencies have established the responsible actor and the relevant legal threshold.

The most significant warning condition is not an isolated alarming incident, but a combination of credible attribution, demonstrated hostile capability, repeated activity and evidence of central direction.

Strategic Priorities for European Decision-Makers

The available evidence supports a policy approach built around three connected objectives.

First, preserve analytical discrimination. Military threats, intelligence warnings, hostile-state information operations and verified attacks must remain separate categories. Treating every hostile statement as an imminent attack risks allowing an adversary to shape European resource allocation.

Second, strengthen protection against documented forms of hostile activity. Counterintelligence, cyber resilience, criminal-network investigations and cross-border information sharing have a direct evidentiary foundation in the 2026 government record. Protective measures should be proportionate, legally grounded and capable of revision as intelligence changes.

Third, preserve alliance decision-making under uncertainty. NATO and European governments must be able to respond to confirmed hostile action while resisting deliberate attempts to create strategic confusion. This requires credible attribution, coherent public communication, continuity planning and an understanding that national exposures and legal obligations are not uniform.

The resulting strategic assessment is therefore narrower, but more consequential, than the proposition that Iran can strike military facilities throughout Europe.

The principal European vulnerability is the possibility that an adversary combines a credible but geographically limited conventional threat with deniable hostile activities and cognitive pressure to create an impression of unrestricted strategic reach.

That conclusion has a substantial documentary foundation in existing state-threat assessments, military capability reporting and alliance policy. The specific intention to execute such a combined campaign in November 2026 remains unproven.

---

Strategic Intelligence / Europe 2026

Conventional military limits, covert-state threats,
asymmetric pressure and NATO decision-making.

OPEN-SOURCE ASSESSMENT · 08 NOV 2026

Dashboard language

English
Italiano
Español
Français
Deutsch

Pause animations

Reset dashboard

Strategic bottom line

The public threat to European military infrastructure has
greater demonstrated value as coercive signalling than as
proof of continent-wide strike capability. Documented
Iranian-linked covert activity creates a distinct and
consequential security pathway. Neither a new European
attack order nor coordinated intervention by Iran’s
external partners is established by the official record.

Strategic architecture

Three pillars of escalation analysis

Qualitative framework — not a numerical risk model

PILLAR 01

Cognitive coercion

Public threats, strategic ambiguity, perception management and political pressure on European decision-makers.

PILLAR 02

Operational pathways

Missile feasibility, covert networks, cyber activity and differentiated national vulnerabilities.

PILLAR 03

Alliance consequences

NATO thresholds, external partners, European resilience and escalation-management choices.

Interactive strategic network

Threat mechanisms and decision effects

Select a node to inspect its analytical relationship

Strategic signalling

Public coercive narratives can influence perceived risk without proving an executable military plan.

Evidence qualification matrix

These are documentary assessments, not numerical threat levels.

Documented
Qualified
Unresolved

European security architecture

Comparative country lenses

National institutional lens

Italy

Competing strategic interpretations

Five hypotheses, no invented probabilities

Select a hypothesis to compare supporting evidence, limitations and observable warning indicators. These pathways can overlap.

Documentary record

2026 verification milestones

Auditable intelligence baseline

Evidence and assessment table

Source dates are not equivalent to current operational readiness

Official source architecture

Primary institutional references

Iran, Europe and the Strategic Transformation of Deterrence: State Authority, Coercive Information Operations and the Limits of External Military Support

Central intelligence judgment: The transformation of Iran’s confrontation with the United States and Israel into a wider European security problem is not adequately explained by the geographic reach of Iranian weapons. The more consequential development is the potential convergence of leadership instability, reduced conventional military freedom of action, documented extraterritorial security operations, information-based coercion and selective cooperation with other powers. These elements create opportunities for Tehran to increase the perceived costs of European participation in American military operations without necessarily possessing the resources or political willingness to execute conventional attacks throughout Europe. The challenge for European governments is to distinguish deterrent communication from operational preparation while recognising that both can coexist and that a militarily weakened state may retain considerable capacity to create insecurity through intelligence networks, criminal intermediaries and strategic uncertainty.

This pillar examines the political and institutional foundations of Iranian decision-making, the mechanisms through which military threats are converted into cognitive pressure, and the extent to which Iran’s international relationships can alter the balance between coercive influence and operational capability. The assessment covers developments established by official records available through 8 November 2026, with a strategic outlook extending to 2031. It distinguishes the political positions of the governments concerned from independently established military facts, and it does not treat declarations of solidarity as evidence of binding military obligations.

Chapter 1 — The Strategic Context: Iran, Europe and the Transformation of Deterrence

Principal judgment: Iran’s military and political position in 2026 demonstrates why the relationship between conventional weakness and coercive behaviour cannot be understood as a simple inverse of military power. The reduction of conventional capabilities can increase the incentives to preserve deterrence through non-conventional instruments, but it does not automatically produce greater risk-taking. The direction of Iranian behaviour depends on the leadership’s assessment of regime survival, retaliation costs, domestic stability and the credibility of alternative instruments of pressure.

The 2026 strategic rupture and the reconstitution of political authority

The 2026 confrontation represents a material disruption of Iran’s previous strategic position. In its assessment delivered to the US Congress on 18 March 2026, the Office of the Director of National Intelligence described a regime that appeared institutionally intact but had suffered serious damage to its leadership and military capabilities following American and Israeli operations. The assessment characterised Iran’s conventional regional power-projection capabilities as substantially degraded and identified the reconstruction of missiles and unmanned aerial vehicles as a potential multiyear undertaking. This distinction between the survival of the governing system and the degradation of its military instruments is fundamental. A state can preserve its coercive institutions, internal security apparatus and strategic objectives even as it loses substantial freedom to conduct conventional military operations. Conversely, the continued existence of the regime is not evidence that its former command structures, production capacity or operational readiness have been restored. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

The political rupture was intensified by the death of Supreme Leader Ali Khamenei during the opening phase of the February 2026 hostilities and the subsequent succession of Mojtaba Khamenei. China’s Ministry of Foreign Affairs publicly acknowledged the killing of the former Supreme Leader on 1 March 2026 and condemned it as a violation of Iranian sovereignty. The significance of this transition extends beyond the replacement of one political figure. Iran’s Supreme Leader occupies a central position within the country’s security architecture, including the strategic direction of the Islamic Revolutionary Guard Corps. A change at this level during an active military confrontation can create simultaneous pressures for institutional continuity, elite cohesion, deterrent credibility and the preservation of political authority. It does not, however, provide sufficient evidence to conclude that a successor has adopted either a more aggressive or a more restrained strategy. Such conclusions require corroborated decisions and observable changes in state behaviour. Foreign Ministry Spokesperson’s Remarks on the Killing of Iran’s Supreme Leader Ayatollah Ali Khamenei — Ministry of Foreign Affairs of China — Mar 2026.

The institutional architecture described by the United Kingdom’s Home Office provides a more precise framework for analysing these decisions. Its 2026 assessment identifies the IRGC as a branch of the Iranian armed forces operating independently from the regular army and ultimately accountable to the Supreme Leader. The IRGC comprises ground, naval, aerospace, Qods Force, intelligence and Basij components, with distinct functions and varying degrees of common senior-level decision-making. The Home Office identifies the Qods Force as responsible for overseas military and covert activities, while the IRGC Intelligence Organisation and the Ministry of Intelligence and Security form additional parts of the intelligence apparatus. This division matters because public threats involving ballistic missiles, covert overseas activity and political intimidation cannot automatically be assigned to one operational authority. Their implementation would involve different organisations, approval structures, capabilities and institutional interests. National Security (State Threats) Act 2026: Factsheet — UK Home Office — 2026.

The analytical consequence is that Iranian strategic intent should be treated as a hierarchy rather than a single uniform intention. At the highest level are political objectives involving regime preservation, sovereign authority, external deterrence and the termination or limitation of hostile military pressure. At an intermediate level are choices about whether to threaten, retaliate, negotiate, mobilise partners or authorise unconventional activity. At the operational level are military orders, intelligence assignments, logistical preparations and execution. An official declaration may establish the political position of a governing authority without proving that an operational command has received a viable assignment. An intelligence service’s documented hostile activity may establish operational behaviour without demonstrating that every public statement issued elsewhere within the state reflects a coordinated campaign. This separation is especially important when the state under examination has experienced military disruption and leadership succession.

Published threats, state authorisation and operational capability are different forms of evidence

A government communication, a statement by a senior military official, a report attributed to an unnamed source and a technically verified military capability occupy different positions in the evidentiary hierarchy. The fact that an Iranian political or media institution publicly describes a broader confrontation does not demonstrate that the Supreme Leader has approved a specific military operation. A statement attributed to the Supreme Leader would establish a stronger indication of political direction if its authenticity and exact wording were independently authenticated, but it would still require separate evidence before being classified as an executable operational plan. Evidence of a command decision would need to be distinguished from evidence that subordinate institutions actually possess the personnel, equipment, intelligence and technical means necessary for implementation.

This separation is particularly consequential for long-range strike claims. The US intelligence assessment of March 2026 stated that Iran had demonstrated space-launch and related technologies that could contribute to the development of a militarily viable intercontinental ballistic missile before 2035 if Tehran chose to pursue that objective. The assessment also emphasised the damage sustained by Iranian missile production facilities, inventories and launch capabilities, and anticipated that further evaluation would be required as the effects of American operations became clearer. Neither proposition establishes the existence of an operational Iranian intercontinental missile force in November 2026. Space-launch technology, missile development potential, demonstrated flight performance, military integration and reliable operational availability are separate technical categories. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

A second distinction concerns the difference between geographic range and coercive effectiveness. The political effect of threatening a distant country does not require a demonstrated capability to strike every location within that country. A government receiving credible evidence of possible hostile activity may need to reinforce security, consult allies, protect communities or revise crisis-management arrangements regardless of whether the most dramatic conventional threat is technically plausible. Nevertheless, this observation cannot be inverted into an assumption that coercion will succeed. European governments possess diplomatic, intelligence, military and legal instruments of response. The credibility of deterrence depends partly on their capacity to communicate which threats they consider realistic, which activities they can attribute and which consequences would follow a verified attack.

European policy moved from nuclear non-proliferation toward an expanded state-security problem

The European response to Iran in 2026 cannot be reduced to the military conflict. In September 2025, the Council of the European Union reimposed restrictive measures connected with Iran’s nuclear proliferation activities following the dispute over the restoration of UN sanctions. The Council’s official chronology subsequently recorded additional January 2026 measures concerning human rights abuses and Iranian military support to Russia, followed by the political agreement to designate the IRGC as a terrorist organisation. On 19 February 2026, the Council formally added the IRGC to the EU terrorist list, making it subject to financial asset freezes and prohibitions on EU operators providing funds or economic resources. These measures represented distinct legal and policy responses: nuclear non-proliferation controls, sanctions relating to Russia’s war, human-rights measures and counterterrorism restrictions should not be treated as interchangeable instruments. Timeline — EU Sanctions against Iran — Council of the European Union — 2025–2026; EU Terrorist List: Council Designates the Islamic Revolutionary Guard Corps as a Terrorist Organisation — Council of the European Union — Feb 2026.

The United Kingdom followed a separate national legislative trajectory. Its National Security (State Threats) Act 2026, which received Royal Assent on 8 July, introduced additional powers to designate organisations involved in foreign-power threat activity. On 17 July, the Home Office formally announced the designation of the IRGC, the Islamic Movement of the Companions of the Right and Russia’s GRU Volunteer Corps under the new regime. The legislation strengthened the ability of British authorities to pursue forms of assistance, material support and association with designated hostile-state bodies. The legal innovation is significant because it addresses situations that cannot be managed solely through conventional terrorism legislation or military deterrence: foreign-state-directed activity may involve espionage, sabotage, covert intimidation, criminal intermediaries and interference without constituting an openly declared military attack. National Security (State Threats) Act 2026: Factsheet — UK Home Office — 2026; First Groups Designated as Threat to National Security — UK Home Office — Jul 2026.

The implications for European strategic autonomy are substantial. Italy, France and Germany operate within the EU sanctions framework while also maintaining national criminal-law, intelligence and security responsibilities. The United Kingdom, outside the EU, has developed a specific legal instrument for foreign-state threats. These different institutional pathways may converge in identifying hostile organisations but diverge in their investigative powers, procedural requirements, sanctions implementation and definitions of prohibited conduct. A coordinated European response therefore depends not only on shared political assessments but also on practical legal interoperability, admissible evidence, mutual assistance, financial investigations and the ability to distinguish foreign-state direction from independent criminal activity.

The transatlantic military connection changes the meaning of European neutrality

European security becomes directly relevant to an American–Iranian confrontation because European states participate in different forms of transatlantic military cooperation, alliance command arrangements and diplomatic coordination. Yet the existence of American military facilities or bilateral defence arrangements on European territory does not remove the political sovereignty of the host state. Decisions about access, operational support, force protection and the participation of national armed forces are governed by different domestic and international legal arrangements. The possibility that a facility contributes to American operations does not itself establish that the host country has become a party to an armed conflict, nor does it make every associated civilian or military object a lawful target.

NATO’s published collective-defence framework establishes a second boundary. Article 4 of the North Atlantic Treaty provides for consultations when an Ally considers its security threatened. Article 5 establishes an obligation to assist an Ally subjected to a qualifying armed attack, but the nature of that assistance is determined within the treaty framework and does not automatically require identical military action by every member. NATO further explains that serious cyber or hybrid incidents may be considered armed attacks depending on their specific circumstances. The legal determination is therefore incident-dependent, and political consultations do not themselves amount to the activation of collective defence. Collective Defence and Article 5 — NATO — Official Topic.

The strategic consequence for Tehran is that threatening European territory creates a risk qualitatively different from threatening military interests within an existing regional theatre. A verified armed attack against a NATO member could strengthen rather than weaken transatlantic coordination, increase the political legitimacy of collective military responses and reduce the space for bilateral diplomatic bargaining. European threat narratives may therefore function as deterrent instruments precisely because implementing them conventionally would expose Iran to severe escalation costs. This interpretation is analytically plausible but not a demonstrated Iranian leadership decision; the relevant evidence would consist of authenticated directives, consistent operational preparation and the relationship between threats and subsequent diplomatic or military conduct.

The political economy of deterrence under strategic pressure

A state attempting to maintain deterrence after a major military degradation confronts a difficult allocation problem. Rebuilding complex military equipment requires industrial capacity, technical personnel, financing, production security, supply chains and time. Restoring intelligence relationships, public communication capacity and diplomatic activity may involve different resource demands and operational constraints. The relative costs cannot be quantified from the available record, but the distinction creates a possible incentive to emphasise instruments that preserve uncertainty and influence before conventional forces are fully rebuilt. The incentive becomes stronger where sanctions and internal economic pressures constrain reconstruction, although those same pressures can reduce the resources available for external operations and increase leadership incentives to avoid further confrontation.

The March 2026 American intelligence assessment described severe domestic economic pressure and anticipated continuing institutional tensions even if the Iranian regime survived. The EU’s successive sanctions decisions provide an additional official record of constraints on financing, trade and designated organisations. Taken together, these records support an assessment in which Iranian external strategy must balance military rebuilding, domestic political control and the maintenance of external deterrence. They do not establish that covert operations are necessarily cheaper, more effective or politically preferred in every circumstance. Deniable operations can fail, generate decisive attribution, cause uncontrolled escalation or provoke financial and criminal-enforcement measures against networks that may have taken years to develop. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026; EU Sanctions against Iran — Council of the European Union — Official Policy Record.

The transformation of deterrence must consequently be understood as a contest involving capability, credibility, institutional resilience and political interpretation. Conventional military strength remains central, but the ability of governments to interpret threats accurately and respond proportionately becomes an independent component of strategic power.

Chapter 1 — Comparative institutional and strategic table

Analytical dimension	Iran	United States and NATO	European governments	Strategic consequence
Political authority	Supreme Leader and differentiated military-security institutions	National US authority and NATO’s collective political process	National executives, legislatures and applicable alliance mechanisms	Public statements and executable orders must be distinguished
Conventional military position	Serious degradation assessed in March 2026; subsequent restoration requires verification	Multidomain deterrence and defensive capabilities documented by NATO	National force protection and participation decisions	Threat geography does not establish operational reach
Coercive options	Public signalling, diplomatic pressure and documented security-service activity	Deterrence, consultation, intelligence and military response	Counterintelligence, sanctions, police and crisis management	Several escalation pathways exist below conventional war
Domestic constraints	Economic pressure, sanctions and leadership-transition challenges	Political and military commitments across regions	Different legal authorities, budgets and domestic political conditions	Sustained coercion imposes costs on both sides
Legal exposure	State responsibility depends on attributable conduct and applicable law	NATO Articles 4–6; international law	EU and national sanctions, criminal law and security powers	The legal category of an incident affects response options
Principal uncertainty	Current operational authorisation and recoverable military capacity	Response to future contingencies	Degree of coordinated attribution and policy implementation	Intelligence quality is central to deterrence credibility

The table compares institutional functions rather than implying equal military capabilities or uniform legal systems. Its documentary foundations are the 2026 US Annual Threat Assessment — ODNI — Mar 2026, Collective Defence and Article 5 — NATO, National Security (State Threats) Act 2026: Factsheet — UK Home Office and EU Sanctions against Iran — Council of the EU.

Key judgments — Chapter 1

The structural change in 2026 lies in the combination of Iranian leadership succession, major conventional military degradation and the persistence of institutions capable of external coercion. The official record supports neither the conclusion that Iran has lost all capacity to threaten European interests nor the conclusion that it can execute unrestricted attacks across Europe. The principal European decision requirement is to establish whether an observed threat represents political communication, authenticated state direction, operational preparation or an actual hostile action. The analytical distinction becomes especially important when coercive communication is capable of generating governmental responses before military intentions or capabilities can be established.

What would change the assessment: A subsequent official military evaluation documenting substantial restoration of Iranian long-range strike capability; authenticated leadership instructions authorising attacks beyond the Middle East; or corroborated evidence of a deliberate change in the role of Iranian security institutions would materially change the present judgment.

Open official record: A current comprehensive assessment of Iranian operational military inventories, command arrangements and the extent of post-conflict reconstruction remains necessary to determine how far the March 2026 baseline describes the situation in November.

Chapter 2 — Cognitive Warfare and the Construction of European Vulnerability

Principal judgment: The strategic effect of cognitive warfare is not determined by whether its most dramatic military claims prove technically accurate. It is determined by whether communication changes the expectations, decisions and resource allocations of the intended audience. In the European security environment, a threat directed at an American military interest may simultaneously address European governments, NATO decision-makers, domestic populations, financial institutions and military planners. The resulting influence is potentially multidirectional: an adversary may seek to discourage participation in a conflict, induce costly precautionary measures, create disagreement over the credibility of intelligence, or test the coherence of alliance responses. These objectives are not automatically complementary. A threat that produces public anxiety may also strengthen political solidarity, accelerate defensive investment and generate a more forceful deterrent response.

Cognitive warfare as an attempt to influence decisions rather than merely opinions

Cognitive warfare should be treated here as a strategic analytical concept rather than an automatically established legal or operational category. It encompasses attempts to influence how institutions and populations perceive threats, interpret evidence, allocate attention and choose between competing courses of action. This distinguishes it from disinformation alone. A coercive communication can consist of accurate information, selective information, unverifiable assertions or deliberately misleading material. Its potential security effect depends not simply on the truthfulness of an individual statement but on how the statement is presented, attributed, repeated and integrated into a wider perception of vulnerability.

NATO’s official approach to countering information threats, endorsed by Allied defence ministers on 18 October 2024, provides an authoritative institutional framework. NATO identifies intentional, harmful, manipulative and coordinated activity in the information environment as a potential security threat and recognises that hostile actors exploit openness, digitalisation and interconnected societies. The framework addresses information manipulation, interference and disinformation as related but distinguishable phenomena, rather than treating all controversial political communication as hostile activity. NATO’s January 2026 policy on countering hybrid threats similarly identifies propaganda, deception, sabotage and other non-military methods as instruments capable of affecting political institutions and public opinion. These policy definitions are particularly important because an analytical assessment must not classify a communication as an organised hostile operation merely because it originates from a politically aligned media institution or expresses a threatening position. Coordinated intent, manipulation, institutional connection and consequential behaviour require independent evidence. NATO’s Approach to Counter Information Threats — NATO — Oct 2024; Countering Hybrid Threats — NATO — Jan 2026.

The relevant unit of analysis is therefore the decision that a communication may influence. A military planner assesses whether additional force protection is necessary. A government considers whether to continue supporting an operation or impose restrictions. An intelligence organisation evaluates whether a threatening statement requires additional collection. A financial institution reassesses disruption risk. A population interprets the relationship between national involvement in an overseas conflict and domestic security. These decisions are connected, but they are not identical, and they cannot be assumed to move in the same direction. In particular, a threatening message may produce government caution while increasing public support for a stronger security response. Its effects depend on the credibility of the communicator, the existing political environment, the availability of corroborating evidence and the ability of institutions to explain their decisions.

The most consequential characteristic of cognitive coercion is that it can operate through uncertainty without resolving it. A threat need not convince every audience that an attack will occur. It may influence behaviour if the audience believes there is a sufficiently serious possibility of an attack and considers the consequences of insufficient preparation unacceptable. The analytical problem is to determine whether that effect reflects an adversary’s deliberate objective or a rational precaution taken independently by the threatened state. Without that distinction, every costly security response risks being interpreted as evidence of successful adversarial manipulation, even when the response is operationally justified and strengthens resilience.

The geography of threatened installations creates a political image of reach

A publicly communicated account of military vulnerability can compress several very different kinds of information into a single visual or narrative representation. Geographic proximity, military relevance, political symbolism, facility ownership, potential operational involvement and theoretical weapon reach may be presented together even though each concerns a separate question. The resulting representation can make a geographically dispersed set of institutions appear to be a unified operational category, despite differences in sovereignty, defensive arrangements, military function and exposure.

This compression has substantial political consequences. American forces operating in European territory are not equivalent to European national armed forces; NATO institutions are not identical to bilateral American host-nation arrangements; and the presence of military infrastructure does not demonstrate that every host state has authorised participation in a particular conflict. A public threat that fails to preserve these distinctions can create an impression that Europe is uniformly exposed to retaliation because of its relationship with Washington. That impression may be politically useful to the communicator even when actual operational feasibility varies widely.

The military interpretation must remain separate from the visual effect. NATO has documented the development of its ballistic missile defence architecture, including the declaration of Enhanced Operational Capability in July 2024 and subsequent defensive activity during the March 2026 Iranian missile attacks directed toward Türkiye. The existence of these capabilities does not establish universal interception coverage, but it demonstrates that the European military environment cannot be accurately represented as a collection of unprotected installations. Nor can the ability to draw a distant location within a hypothetical range band establish that a deployed weapon could reach, identify and successfully engage it. Ballistic Missile Defence — NATO — Official Topic, updated 2026.

The distinction between geographic inclusion and operational credibility produces an important analytical paradox. The wider a publicly communicated threat becomes, the more countries it may influence psychologically; yet the same enlargement can reduce its military credibility if the asserted reach is unsupported by demonstrated capabilities. An effective public response should therefore separate technical assessment from political messaging. Governments can acknowledge a credible hostile intention without validating every asserted delivery capability, and they can increase protective measures without accepting the adversary’s preferred description of the crisis.

The possibility of alternative objectives: five mechanisms of strategic influence

The first potential objective is deterrence by anticipated punishment. In this interpretation, Tehran seeks to persuade governments that participation in operations against Iran could impose costs beyond the immediate military theatre. The mechanism depends on the audience believing that at least some form of retaliation is credible. It does not require that every publicly mentioned military option be executable; a combination of limited conventional reach, regional retaliation and documented non-conventional activity may be sufficient to make wider consequences politically salient. The limitation is that deterrence can fail when the threatened government believes the adversary lacks the means or willingness to act, or when the threat is viewed as evidence that additional military preparedness is required.

The second potential objective is resource diversion. A sufficiently credible external threat may induce additional expenditure on security, surveillance, emergency planning, intelligence coordination, legal proceedings and continuity arrangements. These costs do not necessarily indicate strategic success for the threatening state because defensive investments may produce lasting improvements in resilience. Nevertheless, the ability to influence an opponent’s allocation of resources can have strategic value even in the absence of an attack. To establish deliberate resource diversion rather than merely infer it, analysts would need evidence that the threatening actor sought to generate particular defensive responses and subsequently adjusted its conduct in relation to those responses.

The third potential objective is political differentiation among European governments. Countries differ in their relationship with American military operations, their defence authorities, their domestic political environments and their legal responsibilities. A threat intended to make national participation appear more costly could exploit those differences, even if no government formally changes policy. Yet the countervailing possibility is equally important: credible external coercion may increase cooperation among states that otherwise disagree over diplomatic approaches to Iran. The multinational response of June 2026 demonstrates that substantial agreement on Iranian-linked hostile activity can emerge across governments with different security institutions and political systems. That statement was signed by 24 countries, including Italy, France, Germany, the United Kingdom and the United States, and explicitly condemned threats associated with Iranian security organisations and intermediaries. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK Foreign, Commonwealth & Development Office — Jun 2026.

The fourth potential objective is domestic regime consolidation. A government experiencing external military pressure and internal political difficulties may use declarations of defiance to demonstrate institutional continuity and reassure domestic constituencies that it retains strategic agency. This mechanism is consistent with the political pressures identified in the March 2026 US intelligence assessment, but the existence of domestic pressure does not establish the purpose of any specific communication. Domestic reassurance, deterrence of foreign adversaries and preparation for negotiations can occur simultaneously. The critical evidence would include the intended audience, timing, official institutional endorsement and observable relationship between messaging and domestic political decisions. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

The fifth potential objective is concealment of operational priorities. A highly visible conventional threat may attract intelligence collection and political attention toward a particular category of military danger while other forms of hostile activity remain less visible. This possibility requires serious consideration because the 2026 official record documents Iranian-linked covert operations in Europe. It would nevertheless be analytically unsound to conclude that a public military threat was deliberately designed as cover for clandestine activity merely because both categories exist. Concealment would require evidence of coordination, temporal association, tasking, diversionary intent or operational benefit. Without such evidence, the proposition remains an alternative explanation rather than a verified finding.

The empirical record of covert activity changes the credibility of non-conventional threats

The most important new development for assessing non-conventional coercion in Europe is the emergence of a formal, multinational government record during 2026. On 10 June, 24 governments condemned hostile actions attributed to the IRGC Intelligence Organisation, the Qods Force and the Ministry of Intelligence and Security, including plotting against dissidents, journalists, Jewish and Israeli communities and associated interests. The statement described longstanding connections between Iranian security services and criminal organisations and identified attacks claimed by Harakat Ashab al-Yamin al-Islamiya, also known as HAYI. This establishes a significant distinction between general concern about Iranian intentions and a collective government assessment that identifiable categories of hostile activity have occurred. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK Foreign, Commonwealth & Development Office — Jun 2026.

The British record became more specific in July. On 13 July, the Foreign Secretary announced sanctions against the Islamic Movement of the Companions of the Right, identifying the organisation as also known as HAYI and reporting that it had publicly claimed responsibility for seven attacks at British locations associated with Jewish and Israeli communities and Persian-language media. The government specifically referred to the arson attack against four Hatzola ambulances in Golders Green during March 2026. On 14 July, the Foreign, Commonwealth & Development Office summoned Iran’s Chargé d’Affaires and attributed a series of attacks across Europe between March and May to direction by the IRGC Qods Force through the same proxy organisation. These are consequential official attributions. They establish the British government’s assessment of organisational responsibility and foreign-state direction, but they should not be described as independent judicial proof of every act attributed to the network. UK Sanctions Iran-Linked Criminal Group That Publicly Claimed Responsibility for Recent Attacks on Jewish Locations — UK FCDO — Jul 2026; FCDO Summons Iranian Chargé d’Affaires over IRGC Qods Force’s Role in Directing Attacks by Proxy Groups — UK FCDO — Jul 2026.

This evidence changes the analysis of strategic communication in two ways. First, European governments are not evaluating Iranian threats against an entirely hypothetical background: officially attributed hostile activities have already occurred. Second, the existence of those activities can increase the perceived credibility of further non-conventional threats even when a conventional military claim remains technically unsupported. The critical safeguard is not to merge the two categories. A demonstrated ability to direct a criminal intermediary does not prove the capacity to execute a long-range missile strike, while the inability to demonstrate such a missile capability does not invalidate documented covert-state threats. The strategic evaluation must preserve both propositions simultaneously.

Cognitive warfare can exploit uncertainty about attribution and legal thresholds

The classification of an incident determines which institutions can act, which evidence is required and which legal consequences become available. An ordinary criminal offence, a politically motivated attack, an intelligence-directed operation, a cyber disruption, an act of terrorism and an armed attack may overlap in their visible effects but carry different legal implications. Attribution therefore has a political and strategic function beyond determining criminal responsibility. It influences the credibility of public statements, the legitimacy of sanctions, the possibility of interstate countermeasures and the conditions under which governments consult their allies.

NATO’s public guidance makes clear that serious cyber and hybrid attacks can, depending on their circumstances, qualify as armed attacks for the purposes of Article 5. This is not an automatic classification. The Alliance considers the nature and circumstances of the incident, and the decision-making process must preserve the distinction between consultations, national action and collective defence. A hostile actor might seek to exploit ambiguity below that threshold, but it also risks losing control of escalation if an operation causes severe consequences or becomes convincingly attributable. Collective Defence and Article 5 — NATO — Official Topic; Countering Hybrid Threats — NATO — Jan 2026.

The defensive problem is not simply to accelerate attribution at all costs. Premature attribution may produce strategic errors, while excessive delay can allow further hostile activity and undermine public confidence. The most effective approach is to build an evidentiary process that distinguishes preliminary intelligence judgments, public governmental attribution, prosecutorial evidence and independently established technical findings. Each may be legitimate for a different decision, but they should not be presented as interchangeable levels of proof.

Information amplification and the institutional cost of uncertainty

Modern digital communication enables threatening statements, speculative analyses and visual representations to circulate across different audiences without a consistent distinction between source authority and factual reliability. A statement initially presented as a political warning may subsequently be described as a military directive, while a technical possibility may be interpreted as an operationally available capability. These transitions can occur without the addition of new evidence. The resulting information environment can create a self-reinforcing sense of urgency in which repeated reports appear to corroborate one another despite deriving from a common origin.

The NATO framework is especially relevant because it defines the need to understand manipulation and coordination, rather than equating repetition with independent corroboration. An intelligence assessment should reconstruct whether apparently separate reports share a common source, whether translations preserve the original meaning, whether the stated authority is genuine and whether the military information has been verified through independent observation. NATO’s Approach to Counter Information Threats — NATO — Oct 2024.

In European policy terms, a successful defensive response requires a separation between public communication and operational decision-making. Governments can take protective measures on the basis of classified intelligence while acknowledging that the details cannot be disclosed. They should nevertheless avoid describing an adversary’s unverified technical claims as demonstrated facts. Similarly, communication intended to reassure the public should not imply that all forms of hostile activity are impossible simply because the most ambitious conventional scenario is unsupported. The relevant objective is calibrated public understanding: a credible account of the threat, an explanation of why particular measures are justified and a clear distinction between observed activity and potential escalation.

Chapter 2 — Comparative table of cognitive-warfare mechanisms

Mechanism	Possible strategic objective	Required causal mechanism	Evidence needed to establish intent	Principal countervailing effect
Geographic threat expansion	Increase perceived exposure of multiple European governments	Audiences treat distant facilities as potentially involved in the conflict	Authenticated official direction, consistent targeting narratives and linked diplomatic demands	Wider threats can reduce technical credibility
Resource diversion	Increase defensive and administrative costs	Threats trigger additional protective measures	Evidence connecting threatening activity to intended resource effects	Protective investments may strengthen resilience
Alliance differentiation	Encourage divergence over American military cooperation	National governments respond differently to perceived costs	Observable policy changes linked to coercive communications	Threats can produce stronger alliance solidarity
Domestic political signalling	Demonstrate continued state authority	External defiance reinforces domestic perceptions of leadership continuity	Verified domestic communication objectives and leadership decisions	Excessive threats can expose weakness or increase economic pressure
Operational concealment	Draw attention away from other hostile activity	Visible threats divert intelligence and political focus	Evidence of coordinated diversion and covert operational tasking	Heightened vigilance may uncover concealed networks
Diplomatic leverage	Improve negotiating position	Anticipated escalation changes political calculations	Verifiable connection between threats and demands	Coercion may obstruct negotiations or provoke sanctions

This table identifies analytical mechanisms rather than attributing all six objectives to Iranian leadership. The institutional basis for evaluating these mechanisms is provided by NATO’s Approach to Counter Information Threats — NATO — Oct 2024, Countering Hybrid Threats — NATO — Jan 2026 and the Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK FCDO — Jun 2026.

The cognitive escalation transmission chain

The following component is a standalone explanatory scheme for insertion immediately after the preceding mechanism table. Its objective is to show that political communication, audience interpretation and government decisions are distinct stages, each involving a potentially different causal relationship. It does not assert that Iran has successfully manipulated any particular government.

The code uses an isolated container identifier, locally scoped CSS, no JavaScript, no external assets and no WordPress configuration changes. The directional layout represents a conceptual sequence rather than an automatically established cause-and-effect finding.

PILLAR I / CAUSAL PATHWAY ANALYSIS

Cognitive Escalation: From Threat Communication to Strategic Consequence

A conceptual model of how a hostile communication may influence
European decisions. Every transition is conditional and requires
independent observation before being classified as an actual effect.

STAGE 01

Threat communication

Political statements, public warnings and potentially coercive narratives.

STAGE 02

Information amplification

Repetition, interpretation, translation and redistribution to different audiences.

STAGE 03

Risk assessment

Separate evaluation of intent, demonstrated capability, attribution and credibility.

STAGE 04

Institutional response

Intelligence collection, protective action, consultations and public communication.

STAGE 05

Strategic consequences

Potential effects on resources, alliance coordination, deterrence and diplomacy.

THREE POSSIBLE OUTCOME PATHWAYS

Coercive effect

Political restraint or additional costs emerge from perceived threat credibility.

Resilience effect

Threats generate stronger preparedness, information sharing and alliance solidarity.

Escalatory effect

Misinterpretation, attribution disputes or actual hostile conduct intensify confrontation.

The possibility of cognitive backfire

A sophisticated assessment of information-based coercion must account for the possibility that intimidation strengthens rather than weakens the intended adversary. Threatening a country whose government has not directly participated in an attack may widen the coalition of states willing to cooperate against the threatening actor. Publicly associating foreign military facilities with potential retaliation may also reinforce the argument that European governments need additional investment in missile defence, domestic security and alliance coordination. Where the threatening actor lacks a credible capability to execute the most ambitious elements of the warning, the gap between declared intent and demonstrated power may damage rather than enhance deterrence.

The 24-government declaration of June 2026 provides an actual institutional example of convergence against Iranian-linked security threats, although it does not prove that a particular public threat caused that convergence. The EU’s IRGC designation and the United Kingdom’s subsequent state-threat legislation illustrate how hostile activity can produce durable regulatory and legal consequences. Those developments create additional costs for any state relying on intermediaries, financial networks or deniable operations. They also demonstrate that the strategic effects of coercion are not confined to immediate military responses. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK FCDO — Jun 2026; EU Terrorist List: Council Designates the IRGC — Council of the EU — Feb 2026; First Groups Designated as Threat to National Security — UK Home Office — Jul 2026.

Key judgments — Chapter 2

Cognitive coercion is credible as a mechanism but remains unproven as the exclusive intention behind any specific Iranian communication. Its potential effectiveness depends on the relationship between perceived danger, technical capability, institutional credibility and observable changes in policy. The strongest evidence of an associated non-conventional threat does not come from threatening statements themselves, but from formal governmental findings concerning Iranian-linked hostile activity in Europe during 2026. Those findings make it necessary to consider covert escalation alongside conventional deterrence, without conflating the two. The most consequential European response is therefore the capacity to recognise hostile information activity, authenticate security threats, protect relevant institutions and communicate calibrated assessments without validating unsupported claims or concealing genuine vulnerabilities.

What would change the assessment: Evidence of centrally coordinated information campaigns associated with specific diplomatic demands; verified changes in European policy causally attributable to Iranian threats; or documented connections between threatening narratives and newly authorised covert operations would clarify the balance between psychological coercion and operational preparation.

Open official record: The relationship between Iranian leadership communications, media dissemination, operational security-service tasking and the intended effects on European governments remains insufficiently documented to assign a single verified strategic purpose.

Chapter 3 — Iran’s External Relationships: Russia, China, North Korea and Regional Networks

Principal judgment: Iran’s relationships with Russia, China, North Korea and regional armed organisations expand its diplomatic opportunities, economic options and potential access to military knowledge, but they do not establish the existence of a unified coalition prepared to conduct hostilities against European states. The strategic danger is more complex than a formal alliance: several actors may independently exploit the same international crisis, provide different forms of assistance or coordinate selectively without accepting the risks of collective military intervention. The resulting environment can increase uncertainty for European governments, but each alleged connection must be assessed according to its actual legal basis, material contribution, command relationship and demonstrated operational effect.

Russia: strategic cooperation, military-industrial connections and the limits of mutual obligation

Russia’s relationship with Iran has a documentary foundation extending beyond political expressions of solidarity. Their Comprehensive Strategic Partnership Treaty was signed in January 2025 and entered into force on 2 October 2025, according to a Russian Foreign Ministry statement subsequently transmitted to the United Nations. Moscow described the treaty as a framework for developing bilateral cooperation, while the two countries maintained parallel positions on aspects of the international dispute over Iran’s nuclear programme and the reimposition of sanctions. These positions demonstrate diplomatic alignment on specific issues, but the existence of a strategic partnership must not be equated with an automatic undertaking to intervene militarily against NATO members. Statement by the Ministry of Foreign Affairs of the Russian Federation on the Expiration of Security Council Resolution 2231 (2015) — Russian Federation, transmitted to the United Nations — Oct 2025, A/80/500–S/2025/656.

Military-industrial cooperation is the most concrete domain of strategic interaction. The Council of the European Union identifies Iranian military support for Russia’s war against Ukraine, including the delivery of unmanned aerial vehicles, as an established basis for restrictive measures. Its sanctions chronology records further designations in January 2026 related to Iranian support for Russia’s military campaign. These official actions support the conclusion that the relationship has involved material contributions to Russia’s war effort, rather than exclusively political coordination. They do not, however, establish the quantity, serviceability or present allocation of every system transferred, nor do they prove that Moscow would provide equivalent military support if Iranian operations expanded toward Europe. EU Sanctions against Iran — Council of the European Union — Official Policy Record; Timeline — EU Sanctions against Iran — Council of the European Union — Jan 2026.

The relationship creates several distinct strategic possibilities. Russia may benefit diplomatically from a situation that complicates American strategic planning, but the magnitude of any such benefit depends on the actual distribution of American forces and political attention. Moscow may have incentives to preserve Iran as a partner, yet direct participation in attacks against NATO states would introduce substantial escalation risks and potentially interfere with Russian priorities elsewhere. Russia’s military-industrial relationship with Iran could also produce technological or organisational learning over time, but historical cooperation cannot establish that specific new capabilities have been transferred, deployed or made operational during 2026. The relevant analytical question is therefore not whether Russia is politically aligned with Tehran on every issue, but which concrete forms of support are available, what conditions govern their use and whether Russian institutions have authorised any assistance directed toward the European theatre.

The March 2026 US intelligence assessment provides a significant constraint on maximalist interpretations. It characterised cooperation among Russia, China, North Korea and Iran as primarily bilateral and selective, rather than representing an integrated strategic organisation. The intelligence community identified divergent sovereign interests and concerns about confronting the United States as factors limiting cooperation. This assessment is especially important because it was issued during an active confrontation with Iran, when US intelligence agencies had reason to examine the potential involvement of other adversarial states. Nevertheless, it remains an assessment from March, and its conclusions should be revised if subsequent official evidence demonstrates a material expansion of cooperation. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

A further distinction concerns Russia’s own use of covert and proxy structures. The British Home Office designated the GRU Volunteer Corps in July 2026 under the same new state-threat powers applied to the IRGC and an Iranian-linked organisation. The government identified the Russian group as part of a structure associated with Russian military intelligence. This establishes the British government’s assessment of two separate categories of hostile-state organisation, but their simultaneous designation does not demonstrate that Russian and Iranian intelligence services jointly directed European attacks. A common legal response by one government is not evidence of a common operational command. Establishing coordination would require more specific evidence of shared personnel, funding, tasking, communication or operational decisions. First Groups Designated as Threat to National Security — UK Home Office — Jul 2026; National Security (State Threats) Act 2026: Factsheet — UK Home Office — 2026.

The resulting judgment is that Russia constitutes a potentially consequential source of diplomatic, technological and industrial support, but not a demonstrated guarantor of Iranian military action against Europe. Russia’s independent capacity to create pressure in the Euro-Atlantic area may complicate European crisis management even without a coordinated Russian–Iranian campaign. This produces a genuine multi-theatre strategic concern while preserving the fundamental distinction between parallel interests and shared operational planning.

China: economic relationships, diplomatic protection and the boundaries of strategic assistance

China occupies a different position within Iran’s network of external relationships. Beijing maintains a comprehensive strategic partnership with Tehran and has developed a bilateral cooperation framework covering multiple civilian and political domains. The Chinese Ministry of Foreign Affairs records the establishment of the comprehensive strategic partnership in January 2016, the signing of a comprehensive cooperation plan in March 2021, and the announcement of its implementation in January 2022. Those instruments establish a sustained bilateral relationship, but their existence does not demonstrate a commitment by China to enter an armed conflict on Iran’s behalf. China–Iran Bilateral Relations — Ministry of Foreign Affairs of the People’s Republic of China — updated Jul 2026.

The Chinese Foreign Ministry provides official bilateral trade figures that enable a more precise assessment of the economic relationship. It reports total China–Iran trade of US$9.96 billion in 2025, comprising Chinese exports of US$6.93 billion and imports of US$3.03 billion. For the first quarter of 2026, it records bilateral trade of US$1.562 billion, comprising Chinese exports of US$1.143 billion and imports of US$419 million. These figures are published under Chinese official trade definitions and should not automatically be treated as complete measures of Iranian oil exports, indirect trade or transactions occurring through third-country intermediaries. Nor should a single quarter be extrapolated into a full-year total without examining seasonality, disruptions and differences in reporting coverage. Their strategic significance is that the relationship contains measurable commercial activity that creates incentives for both countries to preserve economic channels, although those interests may also give Beijing reasons to avoid direct military involvement in a regional conflict. China–Iran Bilateral Relations — Ministry of Foreign Affairs of the People’s Republic of China — updated Jul 2026.

China’s diplomatic behaviour during the February and March 2026 hostilities provides a clear example of the difference between support for Iranian sovereignty and acceptance of an expanded Iranian military campaign. On 2 March, the Chinese Foreign Ministry condemned American and Israeli strikes against Iran, called for an end to military operations and emphasised dialogue and diplomacy. In the same briefing, Beijing stressed that the sovereignty and territorial integrity of Gulf states must also be respected and expressed concern about the conflict spreading beyond Iran. This position supports Tehran diplomatically on certain questions of sovereignty and the legality of the use of force, while simultaneously opposing further regional escalation. Foreign Ministry Spokesperson Mao Ning’s Regular Press Conference — Ministry of Foreign Affairs of China — Mar 2026.

The Chinese position is therefore not accurately described either as neutrality in every respect or as an unconditional military alignment with Iran. Beijing has articulated strong objections to American and Israeli military action, but its official communications also emphasise regional stability, negotiations and the protection of neighbouring states. This creates a potentially important difference between diplomatic intervention intended to constrain US action and military assistance intended to enlarge Iranian striking power. The two may have different implications for European governments and should not be combined into a single assessment of Chinese support.

A verified numerical comparison: the composition of China–Iran trade

The following table uses only the bilateral trade figures published by the Chinese Foreign Ministry. The percentage shares are calculated from those figures, rounded to one decimal place. They are descriptive ratios, not estimates of Iran’s strategic dependence on China or China’s willingness to provide military assistance.

Official trade indicator	2025	Q1 2026	Interpretation
Total bilateral trade	US$9.960bn	US$1.562bn	Different reference periods; not directly comparable as annual totals
Chinese exports to Iran	US$6.930bn	US$1.143bn	Recorded goods-flow component
Chinese imports from Iran	US$3.030bn	US$0.419bn	Recorded goods-flow component
Chinese exports as share of bilateral trade	69.6%	73.2%	Calculated from official figures
Chinese imports as share of bilateral trade	30.4%	26.8%	Calculated from official figures
Chinese trade surplus with Iran	US$3.900bn	US$0.724bn	Exports minus imports, calculated from official figures

Source: China–Iran Bilateral Relations — Ministry of Foreign Affairs of the People’s Republic of China — updated Jul 2026. Calculated percentages are rounded to one decimal place and may be affected by the precision of the original published figures.

The composition of the trade flows warrants careful interpretation. China’s reported exports exceeded its recorded imports from Iran in both reference periods, but this does not establish that the broader economic relationship is equivalent to those bilateral customs figures. Such figures do not by themselves identify the strategic importance of specific categories of goods, the role of indirect trade, financing arrangements, sanctions-related compliance or the extent to which commercial relationships would survive an intensified conflict. The official figures nevertheless provide a defensible baseline for studying whether China’s incentives are primarily commercial, diplomatic or military, without substituting speculative estimates for the actual published record.

Verified China–Iran trade composition

The next component provides a specific WordPress-ready table with proportional bars. The bars represent only the reported share of bilateral trade and are not military-capability scores, geopolitical alignment ratings or risk probabilities. The table remains readable when animations are disabled, and it contains the issuing institution, time periods, units and source link.

China–Iran Trade: Official Bilateral Composition

Officially reported merchandise trade. Reference periods differ:
full-year 2025 and January–March 2026.
Figures do not measure defence transfers or military commitments.

Full Year 2025

US$9.960bn

Chinese exports to Iran
69.6% · US$6.930bn

Chinese imports from Iran
30.4% · US$3.030bn

Q1 2026 · January–March

US$1.562bn

Chinese exports to Iran
73.2% · US$1.143bn

Chinese imports from Iran
26.8% · US$0.419bn

Indicator	2025	Q1 2026
Total trade	US$9.960bn	US$1.562bn
Exports to Iran	US$6.930bn	US$1.143bn
Imports from Iran	US$3.030bn	US$0.419bn
Trade surplus	US$3.900bn	US$0.724bn
Exports / total	69.6%	73.2%
Imports / total	30.4%	26.8%

North Korea: strategic affinity without demonstrated Iranian war guarantees

North Korea’s relevance to Iran must be evaluated through the distinction between strategic affinity, technological relationships and verified operational assistance. Both states have longstanding reasons to contest aspects of the American security presence in their respective regions, and the March 2026 US intelligence assessment placed North Korea and Iran within a broader discussion of countries cooperating selectively against shared strategic pressures. The same assessment, however, warned that the relationship among Russia, China, North Korea and Iran remained constrained by separate national priorities. This is sufficient to establish that North Korea belongs within the broader strategic assessment, but not sufficient to identify it as a provider of a specific Iranian missile system, an operational participant in the European theatre or a state committed to reciprocal military intervention. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

North Korea’s military assistance to Russia creates an additional analytical consideration. The American intelligence assessment documented the deployment of more than 11,000 North Korean troops to Russia in 2024, while describing the benefits Pyongyang received from combat experience and closer military cooperation with Moscow. Those documented relationships may produce changes in North Korea’s own capabilities, but they do not establish a triangular mechanism by which technology, military personnel or operational intelligence are subsequently transferred to Iran. Such a conclusion would require identifiable records of transfers, agreements, deployment or operational collaboration. Without this evidence, the possibility of indirect capability transfer remains a collection priority rather than an established pathway. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

The principal European concern is therefore not a presumed North Korean military intervention on behalf of Iran, but the possibility that concurrent security pressures in East Asia and the Middle East affect the allocation of American and allied attention. This risk can arise without a formal agreement between Pyongyang and Tehran. It can also be overstated if simultaneous developments are assumed to be coordinated merely because their timing is similar. A defensible assessment must distinguish an opportunistic action undertaken independently from an action planned jointly to exploit American commitments across several regions.

Regional organisations: political alignment does not eliminate operational autonomy

Iran’s relationships with regional armed organisations introduce a further complexity because state influence, financial support, ideological affinity and command authority are not equivalent. The March 2026 US intelligence assessment described Iranian-aligned organisations as weakened following successive regional conflicts and indicated that some could rely increasingly on asymmetric methods. This supports continued attention to the possibility of indirect hostile activity, but it does not establish that every organisation previously associated with Iran retains the same capabilities, relationships or operational priorities in November 2026. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

The analytical categories should distinguish organisations that operate as formal components of the Iranian state, organisations receiving material assistance from Iranian institutions, organisations exercising substantial political or military autonomy and criminal intermediaries recruited for particular acts. The distinction determines what can reasonably be inferred from organisational conduct. An operation conducted by a formally subordinate security organisation supports a different inference about state control from an attack claimed by a loosely affiliated group, and an attack executed by criminals may require additional evidence before being attributed to a foreign government. The July 2026 British attribution concerning IMCR is important precisely because it identified a specific relationship with the IRGC Qods Force rather than relying only on ideological affinity or an uncorroborated claim of responsibility. FCDO Summons Iranian Chargé d’Affaires over IRGC Qods Force’s Role in Directing Attacks by Proxy Groups — UK FCDO — Jul 2026.

Regional armed organisations may also possess strategic objectives that differ from Tehran’s immediate priorities. Their leadership may be concerned with local political authority, territorial control, organisational survival or relations with neighbouring states. These concerns can constrain compliance with external requests or create incentives to act independently. The possibility of autonomous escalation is therefore a genuine analytical variable: a partner organisation might undertake action that Tehran did not specifically authorise, while Tehran might attempt to discourage activity it considers strategically counterproductive. A comprehensive assessment must avoid assuming either perfect Iranian control or complete independence without evidence.

Diplomatic coordination between Iran, Russia and China is documented, but its scope is limited

An important distinction between diplomatic alignment and military integration appears in the official trilateral record. On 14 March 2025, representatives of China, Russia and Iran met in Beijing to discuss Iran’s nuclear programme, sanctions and associated international questions. Their joint statement, transmitted to the United Nations, called for political and diplomatic solutions, continued consultation and coordination in international institutions including BRICS and the Shanghai Cooperation Organisation. The statement provides direct documentary evidence of coordinated diplomatic positions on specified issues. It does not constitute an agreement to undertake military action against the United States or European governments. Joint Statement of the Beijing Meeting between China, Russia and Iran — transmitted to the United Nations — Mar 2025, A/79/823–S/2025/167.

The distinction matters because coordinated diplomatic pressure can influence international negotiations without creating an integrated military structure. States may adopt common positions on sanctions, sovereignty or the interpretation of international agreements while maintaining incompatible approaches to military escalation. Their cooperation may be meaningful and strategically consequential even when it falls short of mutual defence. Equally, the absence of a mutual-defence arrangement does not exclude selective material assistance or intelligence exchange. The relevant assessment must identify the form of cooperation being alleged and determine whether the evidence supports that particular form.

The political positions articulated by Beijing during the March 2026 hostilities further illustrate these boundaries. China condemned the attacks against Iran but also advocated an end to hostilities, diplomatic negotiation and respect for the sovereignty of neighbouring countries. These positions are consistent with an interest in preventing a wider regional conflict and preserving diplomatic influence. They do not demonstrate that China would accept an Iranian campaign against military installations in Europe, especially where such a campaign could expand the confrontation and undermine international economic stability. Foreign Ministry Spokesperson Mao Ning’s Regular Press Conference — Ministry of Foreign Affairs of China — Mar 2026.

The possibility of strategically aligned but operationally independent crises

The most complex risk for European governments is not necessarily a coordinated multinational attack. It is the possibility of several independently generated crises that interact through their effects on military resources, public expectations, diplomatic attention and economic conditions. A crisis in the Middle East could alter the availability of American military resources for European contingencies. A separate period of Russian pressure could intensify European concerns about force readiness. Developments involving North Korea could create additional demands on American strategic planning. None of these developments would prove prior coordination, yet their combined effects could be more difficult to manage than any one crisis in isolation.

This possibility requires a different analytical method from simply identifying countries that share opposition to American policy. The relevant evidence concerns whether events are operationally linked, whether their timing is causally significant, whether participating actors have communicated or coordinated and whether the interaction changes actual military or political capacity. Simultaneous diplomatic statements are weaker evidence of coordinated operations than documented intelligence sharing, military transfers or shared command arrangements. Similarly, an indirect economic benefit from another state’s crisis does not establish that the beneficiary planned or caused the event.

The March 2026 ODNI assessment provides a useful baseline by explicitly identifying the selectivity of cooperation among the four states and the constraints arising from divergent national interests. The evidence does not rule out expanded cooperation after March, but it makes an automatically unified coalition an inappropriate starting assumption. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

Chapter 3 — Comparative partnership assessment

Actor or relationship	Verified cooperation or institutional record	Potential significance for Iran	What the record does not establish	European analytical priority
Russia	Strategic partnership; documented Iranian military assistance to Russia; diplomatic coordination	Diplomatic support, industrial relationships and possible selective technological cooperation	Automatic Russian military intervention against NATO	Distinguish continuing cooperation from new operational commitments
China	Comprehensive strategic partnership; bilateral trade; coordinated diplomacy	Economic channels, diplomatic influence and international negotiation	Binding military-defence obligation or intervention on Iran’s behalf	Monitor concrete policy decisions, trade developments and military-transfer evidence
North Korea	Selective cooperation described by US intelligence; substantial military relationship with Russia	Potential indirect strategic and technological implications	Verified participation in an Iranian European campaign	Identify documented transfers or coordination rather than infer triangular cooperation
Iranian-aligned regional organisations	Historical support relationships; reduced capabilities assessed in 2026	Regional pressure and potential asymmetric activity	Uniform command or automatic compliance with Iranian orders	Distinguish state direction, autonomy and independent escalation
Criminal and covert intermediaries	Multinational condemnation and specific UK attributions in 2026	Deniable hostile activity outside conventional military conflict	Central direction of every incident or a newly authorised Europe-wide campaign	Investigative attribution and cross-border intelligence cooperation
Trilateral diplomatic cooperation	Documented Beijing meeting and UN-transmitted joint statement in March 2025	Common positions on sanctions and international diplomacy	Joint military command, defence treaty or shared war plan	Separate political coordination from operational collaboration

The principal references are the 2026 Annual Threat Assessment — ODNI — Mar 2026, China–Iran Bilateral Relations — Chinese Ministry of Foreign Affairs — Jul 2026, Joint Statement of the Beijing Meeting — United Nations — Mar 2025, EU Sanctions against Iran — Council of the EU and Joint Statement on Iranian State Threats — UK FCDO — Jun 2026.

External relationships and escalation commitments

This scheme separates documented diplomatic and economic cooperation from potential military involvement. It is designed to prevent the visual proximity of countries or organisations from being mistaken for evidence of a joint command structure. The categories describe different forms of cooperation, not a numerical measure of alliance strength.

The component contains a detailed HTML table, five selectable analytical views using native HTML controls, and self-contained styling. It does not use JavaScript, external libraries, remote resources or WordPress configuration functions.

PILLAR I / PARTNERSHIP STRUCTURE

Iran’s External Relationships: Cooperation Is Not Collective Defence

Five analytical lenses distinguish documented institutional relationships,
strategic benefits, operational limitations and European security consequences.
No shared military command is inferred from diplomatic alignment.

Russian Federation

Strategic partnership, documented military-industrial connections and diplomatic cooperation.

STRATEGIC PARTNERSHIP

People’s Republic of China

Trade, comprehensive strategic partnership and diplomatic engagement.

ECONOMIC / DIPLOMATIC

North Korea

Selective relationships in the wider strategic environment; no established European intervention commitment.

LIMITED VERIFIED SCOPE

Regional and covert networks

Different degrees of state direction, material support, operational autonomy and attribution.

NETWORK-SPECIFIC ATTRIBUTION

Russia
China
N. Korea
Networks
Europe

Russia: Strategic Partnership

Documented diplomatic cooperation and military-industrial relationships create opportunities for selective assistance.

Evidence: bilateral strategic framework and EU records concerning Iranian military support for Russia.

Limitation: no automatic Russian military intervention against European NATO members is established.

China: Economic and Diplomatic Cooperation

Official bilateral trade and diplomatic positions establish sustained cooperation and a preference for political engagement.

Evidence: comprehensive partnership, cooperation plan and official bilateral trade series.

Limitation: these relationships do not establish a Chinese military-defence commitment to Iran.

North Korea: Selective Strategic Relationship

North Korea participates in a broader environment of selective cooperation and maintains a substantial military relationship with Russia.

Evidence: US intelligence identifies selective cooperation and North Korean military assistance to Russia.

Limitation: an operational transfer chain or coordinated European campaign involving Iran is not demonstrated.

Regional and Covert Networks

State institutions, aligned organisations and criminal intermediaries must be assessed separately according to verified control relationships.

Evidence: official UK attribution links particular European attacks to an IRGC-directed intermediary.

Limitation: the attribution does not establish control of every ideologically aligned organisation or incident.

European Decision Consequences

Selective cooperation by multiple powers may complicate European military and diplomatic planning even without a formally coordinated campaign.

Decision issue: identify specific material support, legal obligations, command relationships and simultaneous operational demands.

Analytical safeguard: concurrent crises do not independently prove a shared strategic plan.

Relationship	Established mechanism	Additional involvement requiring verification	Principal constraint
Russia–Iran	Strategic partnership and documented military cooperation	New direct operational support in Europe	Independent sovereign interests and NATO escalation risk
China–Iran	Diplomatic partnership and bilateral trade	Military assistance enabling European attacks	Beijing’s stated opposition to regional escalation
North Korea–Iran	Selective wider strategic cooperation	Specific operational transfer or joint deployment	No verified European campaign commitment
Iran–regional networks	Different historical support and influence relationships	New coordinated operations beyond the Middle East	Operational autonomy and variable capabilities
Iran–covert intermediaries	Specific European operations attributed by UK authorities	Broader centrally directed European campaign	Investigative attribution and enforcement exposure

Key judgments — Chapter 3

The official evidence establishes a differentiated network of relationships rather than a unified coalition capable of directing a common war against Europe. Russia is relevant through its strategic partnership, documented military cooperation and independent ability to challenge European security. China is relevant through its diplomatic influence, trade relationships and international political positions, which can favour Iranian sovereignty without entailing support for military escalation. North Korea is relevant through broader patterns of selective cooperation and its own military relationship with Russia, but the reviewed record does not establish a direct commitment to participate in an Iranian campaign against Europe. Regional and covert organisations introduce additional possibilities for indirect hostile activity, but their autonomy, resources and relationship to Iranian decision-makers must be established individually.

The strategically important conclusion is that simultaneous pressure does not require a unified alliance, while a unified alliance cannot be inferred from simultaneous pressure. Multiple actors can alter each other’s opportunities through independently motivated actions, just as diplomatic relationships can produce meaningful strategic effects without military participation. European planning must therefore distinguish partner-state capability, demonstrated assistance, binding obligation, operational direction and potential opportunistic behaviour.

What would change the assessment: A new defence agreement containing an explicit military-assistance obligation; formally verified military transfers materially affecting Iranian capabilities; evidence of joint operational planning; attributable communications establishing coordination across theatres; or a sustained pattern of military actions supported by a documented shared command mechanism.

Open official record: The decisive gaps concern post-March 2026 changes in Russian, Chinese and North Korean material assistance; the current status of Iranian missile and military-industrial reconstruction; and any authenticated decisions authorising external support for operations beyond the Middle East. No comprehensive official record available in this assessment resolves these questions.

Pillar I — Integrated Strategic Net Assessment

The three chapters establish a coherent strategic interpretation. Iran’s security position following the 2026 hostilities combines a surviving political system with degraded conventional capabilities, documented external security-service activity, significant economic and institutional constraints and external relationships that remain materially different in their scope and obligations. These characteristics create incentives and opportunities for coercive signalling and non-conventional pressure, but they do not establish the existence of a centrally coordinated strategy to attack military installations across Europe. The central intelligence requirement is therefore to determine whether communication, operational preparation and partner-state assistance are converging toward a common objective, or whether apparently connected developments reflect separate political, military and institutional processes.

The European response must address two risks that can reinforce one another. The first is underestimating genuinely hostile activity because a more ambitious public military threat lacks demonstrated technical credibility. The second is accepting an adversary’s preferred representation of its capabilities and consequently making strategic decisions on the basis of unsupported assumptions. Neither outcome is consistent with effective deterrence. A defensible European security posture requires the capacity to recognise the differences among political intent, technical capability, operational authorisation, covert activity and externally supplied assistance, while ensuring that intelligence uncertainty does not automatically become strategic paralysis.

The distinction between military deterrence and cognitive coercion is particularly important because their effects are not necessarily aligned. Conventional attacks against NATO territory could produce powerful collective responses and make Iran’s international position more precarious. Information-based coercion and deniable operations might appear to offer greater flexibility, but they also create risks of attribution, criminal enforcement, diplomatic isolation and uncontrolled escalation. Russia, China and North Korea may influence the strategic environment through different forms of cooperation, yet the public official evidence does not support treating them as participants in an integrated Iranian war plan.

Final Pillar I judgment: The principal strategic challenge for Europe is not a demonstrated Iranian capability to conduct unrestricted conventional attacks across the continent. It is the possibility that a state with constrained conventional freedom of action can combine threatening communication, existing covert-security networks and selective external relationships to impose uncertainty and defensive costs on European institutions. That possibility warrants serious preparation, but the evidence supports a differentiated threat assessment rather than a single conclusion of imminent, continent-wide military escalation.

The next analytical stage, Pillar II — Military Feasibility, Indirect Threats and European Vulnerability, must establish the operational validity of the military and non-military pathways identified here. Its principal task is to examine the actual performance and availability of relevant capabilities, the documented security record and the differentiated exposure of individual European states, without treating strategic intention as proof of executable capacity.

---

Iranian Strike Capabilities, Asymmetric Operations, European Critical Infrastructure and NATO’s Multidomain Defence Architecture

Principal intelligence judgment: The European security implications of Iran’s military capabilities must be evaluated through three separate threat environments: direct conventional attack, hostile activity conducted through covert or cyber capabilities, and the broader disruption of European security and essential services during an international crisis. These environments have different evidentiary foundations, defensive requirements and legal consequences. Official United States intelligence assessments establish that Iran developed substantial regional missile and unmanned-aircraft capabilities before the 2026 conflict, but also describe severe degradation of its conventional force structure during that confrontation. NATO’s official record confirms the operational use of Allied ballistic-missile defences against Iranian missiles directed toward Türkiye in March 2026. At the same time, European and British official records identify Iranian-linked covert activity, continuing cyber threats and a European infrastructure environment characterised by growing digital interdependence. The resulting picture is neither one of unrestricted Iranian military reach nor one of European immunity. It is a differentiated security environment in which credible regional military threats coexist with wider, less geographically constrained forms of hostile activity.

Chapter 4 — Iran’s Conventional Strike Capabilities and European Reach

Chapter judgment: The central military question is whether Iran possesses fielded, operationally available and sufficiently reliable delivery systems capable of generating significant effects at the distances implied by threats against European military interests. The answer cannot be derived from declared maximum ranges alone. The available official record supports a historical Iranian capability to conduct ballistic-missile operations at regional distances, evidence of more ambitious missile-development activity, and significant degradation of military capabilities during 2026. It does not support a definitive inventory of Iranian operational strike systems in November 2026 or an assertion that Iran can conduct sustained conventional attacks throughout Europe. This assessment therefore distinguishes technical potential, previous operational experience, publicly demonstrated performance, remaining availability and the protective effects of Allied defence systems.

The historical missile-force baseline and its limitations after the 2026 conflict

The most useful starting point is the distinction between a historically established missile programme and a currently available missile force. In its 2017 Worldwide Threat Assessment, the US Defense Intelligence Agency stated that Iran possessed the Middle East’s largest ballistic-missile arsenal and referred to Iranian claims of systems capable of reaching approximately 2,000 kilometres from Iranian territory. In its 2021 testimony, the agency again described missiles capable of reaching regional targets at distances of approximately 2,000 kilometres, alongside continuing efforts to improve accuracy, reliability, lethality and survivability. These statements are significant because they originate from a competent military intelligence institution and establish that long-range regional missile development was not a recent invention. Nevertheless, both documents predate the major military confrontations of 2025 and 2026 and cannot establish the condition of the Iranian force at the present cut-off. Selected Statements from Lieutenant General Vincent Stewart’s Worldwide Threat Assessment — Defense Intelligence Agency — May 2017; Statement for the Record: Worldwide Threat Assessment — Defense Intelligence Agency — 2021.

The relevant change occurred during the 2026 hostilities. On 18 March, the US Director of National Intelligence publicly assessed Iran’s conventional military power-projection capabilities as severely degraded and stated that its missile production facilities, stockpiles and launching capabilities had suffered substantial damage. The assessment anticipated that Iran would require a prolonged reconstruction effort if its governing institutions remained capable of directing such a programme. This is a material change from the historical force baseline. However, describing a force as severely degraded is not equivalent to establishing that every missile has been destroyed, that all launch systems are inoperable or that every remaining military unit lacks an operational role. The March assessment also predates any rebuilding or additional losses occurring between then and November. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — Office of the Director of National Intelligence — Mar 2026.

The distinction has direct consequences for evaluating European exposure. The previous existence of a missile family does not prove that an operational inventory remains available. Conversely, substantial military degradation does not exclude a limited residual capability or subsequent recovery. The relevant evidence would include current official assessments of fielded systems, demonstrated post-conflict testing, industrial recovery and operational readiness. Public demonstrations and announcements alone would remain insufficient to establish sustained military availability. The governing principle is that weapon development, production, deployment and operational readiness are separate stages of military capability.

Ballistic missiles, cruise missiles and unmanned aircraft are not interchangeable threats

Ballistic missiles, cruise missiles and unmanned aircraft differ fundamentally in their flight characteristics, operational requirements and defensive implications. Ballistic missiles typically rely on powered acceleration followed by a predominantly ballistic trajectory, although some systems employ manoeuvring technologies that complicate classification. Cruise missiles rely on sustained powered flight, commonly within the atmosphere, while unmanned aircraft encompass a broad category of systems whose endurance, payload and flight performance vary considerably. The relevant military distinction is not which system appears more technologically sophisticated, but whether a specific type has been demonstrated in the configuration necessary for the intended mission.

Iran’s historical ballistic-missile programme provides the strongest official foundation for assessing conventional regional reach. The DIA has documented Iran’s efforts to increase the range and accuracy of several missile classes. Its previous assessments also identified cruise-missile development and unmanned systems as priorities. The 2026 US intelligence assessment confirmed that missile and UAV reconstruction would remain strategically important following the degradation of the force. These findings establish the continuing relevance of all three categories, but they do not establish equivalent delivery capacity or geographic reach. Statement for the Record: Worldwide Threat Assessment — Defense Intelligence Agency — 2021; 2026 Annual Threat Assessment — ODNI — Mar 2026.

Unmanned aircraft deserve particular analytical caution because the term covers systems with radically different military roles. A remotely piloted aircraft used for surveillance cannot automatically be classified as a long-range strike asset, and a one-way attack drone cannot be assumed to possess the same payload, navigation performance or survivability as a ballistic missile. The EU’s sanctions regime concerning Iranian military support for Russia’s war against Ukraine establishes that Iranian unmanned systems have had international military relevance. It does not establish that systems supplied to Russia remain available to Iran in identical quantities or that their performance in one theatre can be transferred uncritically to another. EU Sanctions against Iran — Council of the European Union — Official Policy Record.

Cruise missiles similarly require independent assessment. A published range specification does not establish the reliability of a weapon’s guidance systems, the availability of compatible launch platforms or its ability to function against defensive measures. In addition, nominal performance may depend on the configuration being discussed. A lightweight test payload, a military warhead and an operationally deployable configuration do not necessarily produce the same range or performance. Consequently, a defensible comparison cannot be constructed simply by gathering the largest numerical range ever associated with each Iranian missile family.

Declared range, technical demonstration and operational performance

Military range claims are particularly susceptible to confusion because the same unit of measurement may refer to different technical realities. A government’s declared maximum range is evidence of its public position. A documented flight test establishes that a system performed under particular conditions. An operational inventory establishes the possession of equipment, but not necessarily its readiness. Combat employment provides evidence of practical use, although the conditions of that employment may not demonstrate the entire claimed performance envelope.

These distinctions are reinforced by the 2026 US intelligence assessment concerning Iranian space-launch technologies. ODNI stated that Iran had demonstrated space-launch and related technologies potentially relevant to developing an intercontinental ballistic missile before 2035 if it chose to pursue that objective. Such a statement is not equivalent to confirmation that an operational intercontinental ballistic missile existed in March 2026. Space-launch and ballistic-missile programmes can share technical foundations without producing identical military systems. DNI Gabbard Releases 2026 Annual Threat Assessment — ODNI — Mar 2026.

For European military planners, the central issue is therefore not whether a country has published a numerical figure exceeding a specified distance. It is whether official evidence establishes a complete operational capability at that distance. This requires more than theoretical feasibility and must incorporate the post-conflict condition of the force. Any assertion of exact present-day European strike coverage would require evidence not established by the reviewed public official record.

NATO’s defensive architecture is an operational factor, not a guarantee of universal protection

The ability of an attacker to launch a weapon and the ability of that weapon to produce an effect are separate questions. NATO’s missile-defence architecture is an established institutional and operational programme designed to protect Allied populations, territory and forces. The Alliance declared Initial Operational Capability in July 2016 and Enhanced Operational Capability at the Washington Summit in July 2024. NATO’s official update of 29 October 2026 further confirms that its ballistic-missile-defence system identified, tracked and intercepted Iranian ballistic missiles directed toward Türkiye in March 2026, after which the Alliance increased its broader defensive posture. This is direct evidence of operational interception activity during the relevant conflict period, rather than merely a procurement plan or technical ambition. Ballistic Missile Defence — NATO — updated Oct 2026.

The Alliance’s Integrated Air and Missile Defence Policy, endorsed on 13 February 2025, sets out a broader defensive concept covering unmanned aircraft, cruise missiles, ballistic missiles and other aerial threats. It emphasises coordinated command and control, continuous surveillance, airborne defence, surface-based systems, layered defensive arrangements and complementary national contributions. The policy also identifies technical feasibility, affordability and changing threat assessments as relevant considerations. This establishes a comprehensive institutional approach rather than a claim that every possible attack can be intercepted. A layered defence seeks to improve protection and resilience; it cannot be treated as a mathematical guarantee of complete effectiveness. NATO Integrated Air and Missile Defence Policy — NATO — Feb 2025.

NATO’s public documentation further distinguishes the Alliance’s ballistic missile defence mission from integrated air and missile defence as a whole. Ballistic missile defence focuses on a defined class of threats, whereas the integrated system incorporates additional aerial threats and the assets necessary to address them. This difference matters because success against one class of missile cannot establish identical performance against a different class of aircraft or weapon. Nor can the announcement of a defensive capability establish uniform protection of every Allied location. The military balance depends on the interaction of available forces, the evolving threat environment, operational command and the continuing ability of governments to sustain defensive missions.

A broader geopolitical consideration also follows. The defence of European territory is not exclusively an American undertaking, although American capabilities play a significant role. NATO’s official policy describes an integrated arrangement involving common command structures and national contributions. The European policy question is therefore not simply whether American installations are exposed, but how national and alliance authorities protect populations and preserve freedom of action without assuming either absolute vulnerability or absolute protection.

Comparative technical assessment of conventional capabilities

Capability category	Historical official evidence	Relevant 2026 change	What can be established	What remains unresolved
Short-range ballistic missiles	Established component of Iran’s regional missile programme	Severe military degradation assessed by ODNI	Historical possession and regional military role	Current quantities, readiness and reconstruction
Medium-range ballistic missiles	DIA documented systems associated with approximately 2,000 km of regional reach	Missile facilities, inventories and launch capabilities damaged	Historical regional reach; no established comprehensive European capability	Operational availability following the 2026 conflict
Longer-range ballistic missile development	ODNI identified potentially relevant space-launch technologies	Damage complicates assessment of programme development	Technical potential relevant to future development	Fielded long-range military capability and demonstrated readiness
Land-attack cruise missiles	DIA documented development and deployment ambitions	Post-conflict availability not established	Historical programme relevance	Current operational force and mission performance
Unmanned strike systems	Documented Iranian programme and military exports	ODNI anticipated prolonged rebuilding	International military relevance and continuing programme importance	Current usable inventory and sustained availability
Allied ballistic missile defence	NATO operational architecture developed since 2016	March 2026 interceptions and heightened defensive posture	Operational defensive activity against Iranian missiles	Comprehensive performance under all future conditions
Integrated air and missile defence	NATO policy covering multiple aerial threats	Alliance-wide adaptation during 2026	Established multinational defensive framework	Uniformity of protection and future effectiveness

Sources: Selected Statements from the Worldwide Threat Assessment — DIA — May 2017; Worldwide Threat Assessment — DIA — 2021; 2026 Annual Threat Assessment — ODNI — Mar 2026; NATO Integrated Air and Missile Defence Policy — Feb 2025; Ballistic Missile Defence — NATO — Oct 2026.

The operational meaning of a limited conventional threat

The available evidence supports a regional missile danger but does not establish the ability to conduct unrestricted conventional attacks throughout European NATO territory. This judgment should not be interpreted as a determination that every European location is outside Iranian military reach. Geographic exposure depends on the specific weapon, its verified operational performance and the wider military circumstances. What cannot be established from the current record is a comprehensive set of reliable strike possibilities across Europe or the capacity to sustain such operations after the military degradation of 2026.

Nor does military reach determine the strategic consequences of an attack in isolation. An isolated hostile act may produce a major diplomatic or military response even where its direct physical consequences are limited. A threatening state must therefore consider the possibility that attempting to impose a limited cost on an adversary could instead generate a much larger confrontation. In the European context, the existence of national defence forces, NATO consultation mechanisms and collective-defence provisions makes the relationship between an intended limited attack and its eventual strategic consequences particularly uncertain.

The military conclusion is consequently more restrictive than the political rhetoric surrounding possible European escalation. Historical missile capability is established; comprehensive contemporary European strike capability is not. NATO has demonstrated operational defensive capability; complete protection under every contingency is not established either. These are simultaneous findings, not contradictory ones.

Chapter 4 — Key judgments

Iran’s historical missile programme provides a credible foundation for concern about conventional regional military threats. The 2026 US intelligence assessment materially qualifies that foundation by documenting severe military degradation, while NATO’s October 2026 public record confirms operational interceptions of Iranian ballistic missiles directed toward Türkiye. The principal unresolved question is the present operational state of Iranian forces, not the existence of past missile-development activity. A European assessment should therefore avoid converting historic specifications or political declarations into claims about currently available strike systems.

What would change the assessment: Official evidence of newly demonstrated longer-range operational capability, verified restoration of missile-force readiness, or documented changes in Allied defensive capability would alter the present evaluation. The absence of such evidence limits the scope of what can responsibly be concluded.

Open official record: A comprehensive post-conflict inventory of operational Iranian delivery systems and an independently verifiable assessment of remaining military availability are not established by the reviewed sources.

Chapter 5 — Covert Action, Cyber Operations and Critical-Infrastructure Exposure

Chapter judgment: The most consequential European security concern beyond conventional missile warfare is the interaction of foreign-state-directed hostile activity, cyber intrusion, criminal intermediaries and infrastructure interdependence. The official record establishes that Iranian-linked networks have been associated with hostile activity on European territory, while competent European cybersecurity authorities document an environment in which cyber incidents can affect essential services across borders. These findings do not establish that Iran has directed every disruptive incident, that it possesses comprehensive control over European infrastructure or that a coordinated campaign against essential services has been authorised. They establish a different requirement: governments must be able to investigate attribution, preserve essential-service continuity and respond proportionately to a spectrum of incidents whose political implications may extend beyond their immediate technical effects.

The European covert-threat record and the distinction between intelligence attribution and criminal evidence

The June and July 2026 official record establishes a much more concrete foundation for discussing hostile-state activity inside Europe than general speculation about Iranian external operations. On 10 June, 24 governments jointly condemned plotting and other hostile conduct attributed to Iranian security bodies, including activities affecting Iranian dissidents, journalists, Jewish and Israeli communities, and American interests. The statement explicitly identified the relationship between Iranian intelligence services and criminal organisations as a continuing security concern. Its significance is not that it supplies a complete account of every operation, but that multiple governments publicly endorsed a common assessment concerning both the responsible institutional categories and the nature of the threat. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK Foreign, Commonwealth & Development Office — Jun 2026.

The United Kingdom’s 14 July diplomatic summons supplied a more specific attribution. The Foreign, Commonwealth & Development Office stated that the IRGC Qods Force had directed the Islamic Movement of the Companions of the Right, also known as IMCR or HAYI, in connection with attacks across Europe between March and May 2026. This attribution concerns foreign-state direction through an intermediary. Its analytical significance lies in the asserted command relationship rather than simply the identity of the organisation carrying out the attacks. Nevertheless, a diplomatic attribution, a public intelligence assessment, a police investigation and a judicial finding remain distinct categories of evidence. The government’s statement establishes its official position; it does not make every related allegation independently proven in court. FCDO Summons Iranian Chargé d’Affaires over IRGC Qods Force’s Role in Directing Attacks by Proxy Groups — UK FCDO — Jul 2026.

The strategic implications extend beyond any particular incident. The use of intermediaries can complicate the relationship between visible perpetrators and the ultimate directing authority. Criminal investigations may identify participants before establishing the involvement of a foreign intelligence institution, and national security intelligence may provide grounds for protective measures before it can be introduced into judicial proceedings. These are structural features of the evidentiary problem, not proof that any particular investigation has failed. The relevant European requirement is the ability to coordinate criminal investigation, counterintelligence, financial inquiry and diplomatic response while maintaining the procedural standards applicable to each.

The critical distinction between Iranian cyber capability and the European cyber-threat environment

Iranian cyber capabilities must be assessed independently of the overall level of cybercrime affecting Europe. In its March 2026 Annual Threat Assessment, the United States intelligence community identified Iran among states possessing capabilities to threaten networks and critical infrastructure, while also describing limitations relative to more capable cyber adversaries. The report’s reference to previous Iranian operations involving Albania is material because it establishes a European precedent for state-linked cyber confrontation. It does not establish that every significant cyber incident in Europe is attributable to Iranian actors or that Iran possesses the ability to disrupt all major categories of European infrastructure simultaneously. DNI Gabbard Releases 2026 Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

The United Kingdom’s National Cyber Security Centre provided a particularly important assessment during the June 2026 Middle Eastern conflict. Its alert stated that there was likely no significant immediate change in the direct Iranian cyber threat to the United Kingdom at that point, while judging that organisations with operational or supply-chain exposure in the Middle East faced a substantially heightened indirect threat. The centre also assessed that Iranian state and Iran-linked actors retained at least some cyber capability. This combination is analytically valuable because it distinguishes capability from immediate threat level, and direct attacks from indirect consequences. It demonstrates that a competent national authority can acknowledge continued hostile capability without asserting that a large increase in direct attacks has already occurred. Alert: NCSC Advises UK Organisations to Take Action Following Conflict in the Middle East — UK National Cyber Security Centre — Jun 2026.

The subsequent NCSC Annual Review 2026, published on 3 November, identified Iranian-linked groups as continuing to demonstrate the disruptive potential of cyber operations while treating Russia and China as distinct and, in important respects, more extensive cyber challenges to the United Kingdom. This is a crucial comparative qualification. The existence of Iranian cyber capabilities does not justify treating Tehran as the dominant source of every cyber threat facing European governments. National vulnerability assessments must distinguish the capabilities and objectives of different state and criminal actors, particularly where similar technical methods can be used by several unrelated groups. NCSC Annual Review 2026: The Cyber Threat to the UK — UK National Cyber Security Centre — Nov 2026.

The 2026 ENISA evidence provides a more current European baseline

The European Union Agency for Cybersecurity published its ENISA Threat Landscape 2026 on 22 September, analysing events recorded between 1 January and 31 December 2025. The report found that cyber threats to the Union continued to involve cybercrime, espionage, hacktivism, information manipulation and exploitation of technological vulnerabilities. ENISA’s accompanying institutional analysis reported that 57% of the incidents it examined were ideologically motivated, while almost 30% were financially motivated. Distributed denial-of-service incidents accounted for 51% of recorded cases, and public administration remained the most frequently affected sector. These are descriptive proportions within ENISA’s collected incident universe, not the probability that a particular European installation will be attacked. Exploring the Evolution of the Cyber Threat Landscape: How Dependencies Weaken Our Digital Resilience — ENISA — Sep 2026; ENISA Threat Landscape 2026 — ENISA — Sep 2026.

The most important interpretive finding is that ENISA identified increasingly interconnected technological dependencies as a factor capable of amplifying the effects of incidents. Its report described the continuing importance of third-party dependencies and supply-chain relationships, while warning that the technical methods used by cybercriminal, hacktivist and state-linked actors can overlap. This does not mean that the actors share objectives or command structures. It means that technical indicators alone may be insufficient to establish political attribution. For European decision-makers, the presence of an incident within a strategic sector must therefore be evaluated through two separate processes: technical incident management and attribution of responsibility. The first seeks to understand and contain the disruption; the second determines whether the available evidence justifies linking it to a specific actor or state.

ENISA also reported that, among unauthorised-access cases in which an initial intrusion vector could be identified, 60% involved vulnerability exploitation. The denominator is essential: ENISA stated that an initial vector was identifiable for only 5% of the unauthorised-access incidents within that particular analysis. It would therefore be incorrect to present the 60% figure as the share of all European cyberattacks caused by vulnerability exploitation. This illustrates why aggregate cybersecurity statistics must retain their definitions and population boundaries. Exploring the Evolution of the Cyber Threat Landscape — ENISA — Sep 2026.

The broader conclusion is that the European cyber environment already contains substantial criminal and ideological activity independently of Iran. An increase in incidents during an international crisis would not establish Iranian direction without additional evidence. Equally, the existence of a substantial background level of cybercrime does not justify dismissing credible intelligence that a particular incident involves foreign-state actors. Both propositions need to be preserved if incident attribution is to support defensible government decisions.

November 2026: refrigeration-system incidents demonstrate the difference between infrastructure disruption and state attribution

A particularly relevant and recent European example is the official statement published on 4 November 2026 by the European Commission concerning cybersecurity incidents affecting commercial refrigeration systems and related devices in several EU member states. The Commission reported that incidents had occurred since 11 October 2026, with a further wave recorded on 1–2 November. The statement identified coordinated monitoring and information exchange involving the Commission’s Directorate-General for Communications Networks, Content and Technology, ENISA, Europol’s European Cybercrime Centre, national computer security incident response teams and the EU cyber crisis liaison network, EU-CyCLONe. Joint Statement on Cyber Incidents in Refrigeration Systems across the EU — European Commission, DG CONNECT — Nov 2026.

The significance of this case is institutional and technical, not an established geopolitical attribution. Commercial refrigeration systems support economic functions that depend on safe and continuous operation. Incidents affecting such systems can therefore create operational and financial consequences beyond the immediate information technology environment. The Commission’s statement demonstrates that European institutions consider geographically dispersed incidents involving specialised commercial systems sufficiently consequential to warrant coordinated monitoring and response.

The statement does not attribute these incidents to Iran. Their inclusion in this assessment must not be interpreted as evidence that Tehran directed or facilitated them. The case instead demonstrates the analytical danger of confusing an existing technical incident with an assumed foreign-state operation during a period of geopolitical tension. The responsible decision process is to establish the technical facts, investigate possible common causes, identify the affected services and pursue attribution through competent investigative authorities. Only if evidence establishes foreign-state involvement should the incident be incorporated into the corresponding geopolitical threat assessment.

This example also clarifies the economic transmission problem. A disruption affecting specialised commercial equipment may generate costs through service interruption, replacement expenditure, emergency maintenance, operational uncertainty and recovery activity. Those costs cannot responsibly be quantified without information on the affected operators, incident duration and actual losses. The same principle applies to other essential-service sectors: the existence of interdependence is established, but the magnitude of any particular disruption must be measured rather than assumed.

Critical infrastructure is an interconnected service system, not merely a collection of physical assets

European critical-infrastructure policy increasingly treats the continuity of essential services as the relevant object of protection. The European Commission’s Critical Entities Resilience framework covers 11 sectors, including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space and food. The related NIS2 Directive covers 18 critical sectors, creating a complementary system of cybersecurity risk-management obligations and incident reporting. These frameworks address different but connected dimensions of resilience: physical and organisational continuity on one side, and the protection of networks and information systems on the other. Critical Infrastructure Resilience at EU Level — European Commission, DG HOME — Jan 2026; NIS2 Directive: Securing Network and Information Systems — European Commission, DG CONNECT.

The Critical Entities Resilience Directive, Directive (EU) 2022/2557, entered into application in October 2024. It requires national risk assessments, the identification of critical entities and measures to strengthen the continuity of essential services. The Commission’s institutional guidance of 10 July 2026 addressed technical, security and organisational measures intended to improve resilience against natural and deliberate threats, including sabotage, drone-related incidents and wider hybrid challenges. These measures do not establish that an identified operator has been targeted by Iran. They establish a general European policy framework that can reduce the effects of disruption regardless of the responsible actor. Commission Issues Guidance to Strengthen Resilience of Critical Infrastructure — European Commission — Jul 2026.

The relationship between physical and digital resilience is especially consequential because an essential service may depend on several independently governed systems. A transport operator can depend on communications providers, energy supply, maintenance contractors and public authorities. A healthcare provider can depend on digital services, equipment suppliers, power, logistics and personnel availability. A financial institution can depend on telecommunications and third-party technology services. These examples describe general categories of interdependence rather than specific weaknesses in identifiable facilities. The relevant defensive objective is continuity of the essential service when one or more supporting functions becomes unavailable, whether the originating incident is criminal, accidental, natural or deliberately hostile.

The European Commission’s 2026 guidance reinforces this broader understanding by identifying preparation, mitigation, recovery and coordination as parts of one resilience framework. As a result, European protection cannot be measured solely through numbers of security personnel, installed defensive equipment or nominal system redundancy. A credible evaluation must consider whether institutions can detect disruption, maintain essential services, coordinate responses across jurisdictions and restore functions within their legally defined responsibilities. Public sources do not provide sufficiently comparable national operational data to construct a defensible ranking of these capabilities across all European states. Critical Entities Resilience — European Commission, Joint Research Centre.

The European regulatory gap: common rules do not establish uniform implementation

A significant difference exists between the adoption of an EU directive and its complete implementation in national law. On 8 July 2026, the European Commission announced that it was referring France, Ireland, Spain and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of the NIS2 Directive. The original transposition deadline was 17 October 2024, and the Commission had previously issued formal notices and reasoned opinions. This establishes a documented implementation concern, not evidence that those countries were incapable of responding to cyber incidents or lacked all domestic cybersecurity legislation. Commission Refers Ireland, Spain, France and the Netherlands to the Court of Justice for Failing to Transpose the Rules on Cybersecurity — European Commission — Jul 2026.

This distinction has direct relevance to the comparison of national resilience. An EU member state may possess sophisticated cybersecurity organisations while experiencing delays in the legislative implementation of common European requirements. Conversely, formal transposition of a directive does not establish that every regulated operator has achieved high operational maturity. Legal compliance, institutional capability, actual incident handling and recovery performance must therefore be assessed separately. The July 2026 Commission action supplies a concrete example of why European resilience cannot be treated as uniform simply because common legislation exists.

Chapter 5 — Evidence and infrastructure table

Domain	Verified institutional baseline	Quantitative or documentary reference	Relevance to European resilience	Attribution limitation
Iranian-linked hostile activity	Collective government condemnation	24 governments, 10 June 2026	Counterintelligence and criminal-investigation cooperation	Does not establish responsibility for all suspicious incidents
Iranian-linked European attacks	Formal UK attribution concerning IRGC-QF and IMCR	14 July 2026	Criminal networks and foreign-state direction	Government attribution is not a judgment on every individual case
European cyber threat	ENISA Threat Landscape 2026	2025 incident reference period	Understanding the background threat environment	Aggregate incidents cannot be attributed to Iran
Ideologically motivated incidents	ENISA reports 57% of collected incidents	ENISA 2026 edition	Geopolitical influence on the cyber environment	Ideological motive is not proof of state direction
DDoS incidents	51% of recorded cases	ENISA 2026 edition	Service availability and public communication	No Iran-specific attribution
Cyber intrusion methods	60% vulnerability exploitation among cases with identifiable vectors	Initial vectors identified in 5% of relevant unauthorised-access cases	Importance of preventative cyber controls	Restricted denominator; not an all-incident statistic
EU refrigeration-system incidents	Commission-coordinated response	11 Oct–2 Nov 2026; statement of 4 Nov	Cross-border incident coordination and commercial continuity	No Iranian attribution established
Critical-entity resilience	CER Directive and Commission guidance	11 sectors; July 2026 guidance	Physical, organisational and service continuity	General resilience framework
Cybersecurity regulation	NIS2 Directive	18 sectors	Risk management and significant-incident reporting	National implementation differs
NIS2 transposition	Commission infringement proceedings	Four member states referred in July 2026	Legal implementation and regulatory coordination	Does not measure national cyber readiness

Sources: Joint Statement on Iranian State Threats — UK FCDO — Jun 2026; FCDO Summons Iranian Chargé d’Affaires — Jul 2026; ENISA Threat Landscape 2026 — Sep 2026; ENISA Threat Landscape Findings — Sep 2026; European Commission Statement on Refrigeration-System Incidents — Nov 2026; Critical Infrastructure Resilience at EU Level — European Commission — Jan 2026; NIS2 Transposition Proceedings — European Commission — Jul 2026.

WordPress HTML scheme — European cyber evidence and attribution matrix

This component introduces a quantitative visualisation using the officially published ENISA 2026 percentages. It also presents an attribution-control table distinguishing documented incidents from Iranian-directed activity. The chart shows proportions only within the stated ENISA reporting universe; it does not portray attack likelihood or rank particular infrastructure as vulnerable.

PILLAR II / DOCUMENTED EUROPEAN CYBER ENVIRONMENT

Cyber Incidents and Attribution: Evidence Must Precede Geopolitical Conclusions

ENISA 2026 findings relating to incidents collected for calendar year 2025.
The categories below are different analytical dimensions and must not be
added together. They do not identify Iranian responsibility.

Motivation recorded by ENISA

Financially motivatedAlmost 30%

The 30% bar is an approximate visual rendering of ENISA’s
“almost 30%” description, not an exact reported figure.
Other or unclassified motivations are not inferred.

Observed incident characteristics

DDoS share of recorded incidents51%

Vulnerability exploitation in identified intrusion vectors60%

ENISA identified an initial intrusion vector for only 5% of
the relevant unauthorised-access cases. The 60% figure
applies to that restricted subset.

Observation	Official attribution	Defensible conclusion
Iranian-linked covert operations in Europe	Formal multinational and UK governmental attribution	Documented state-threat concern, not proof of every individual incident
General EU cyber incidents recorded by ENISA	Multiple actor categories	No Iran-specific attribution from aggregate percentages
EU commercial refrigeration incidents, Oct–Nov 2026	No Iranian responsibility established in the Commission statement	Cross-border cybersecurity response is documented
Cyber activity associated with geopolitical events	Requires incident-specific evidence	Temporal coincidence does not establish state direction

Chapter 5 — Key judgments

The European covert-security threat is supported by formal governmental attribution, while the broader European cybersecurity environment is supported by ENISA’s 2026 statistical and institutional reporting. These two evidence bases must not be merged. The existence of Iranian-linked hostile activity is relevant to government threat assessments; the existence of a disruptive cyber incident is not sufficient to establish Iranian responsibility. The Commission’s November 2026 refrigeration-system statement illustrates the importance of this distinction in a contemporary cross-border context.

The most consequential institutional requirement is an integrated but evidence-disciplined response. Cybersecurity teams must manage technical disruption; criminal investigators must establish the facts relevant to offences; intelligence organisations must assess possible foreign direction; and governments must determine whether the incident justifies diplomatic, regulatory or security action. These tasks may proceed concurrently, but conclusions reached in one process should not automatically be presented as proof of conclusions in another.

What would change the assessment: A coordinated official attribution linking currently unattributed infrastructure incidents to Iranian state institutions; authoritative evidence of a newly directed European campaign; or a material revision in the NCSC or ENISA threat assessments would justify reassessing the role of Iran within the broader European threat environment.

Open official record: The full technical and investigative findings concerning the October–November 2026 commercial refrigeration incidents, the current operational capacity of Iranian-linked cyber organisations and comparable national data on essential-service recovery remain unresolved in the reviewed record.

Chapter 6 — European Countries Under Pressure: Italy, France, Germany, the United Kingdom and the Wider NATO Periphery

Chapter judgment: Europe’s exposure to Iranian-related escalation cannot be assessed through a single continental category. National security responsibilities, military commitments, legal authorities, institutional capacity, geographic relationships and the organisation of essential services differ materially among states. The European countries most relevant to the assessment share NATO and, in several cases, EU obligations, but they do not possess identical military functions, domestic security regimes or regulatory implementation records. The most consequential distinction is between states confronting direct military contingencies, states supporting transatlantic defence functions, and institutions responsible for protecting civilian life and cross-border essential services. Those categories overlap, but their legal and operational implications remain different.

Italy: Mediterranean responsibilities, alliance coordination and the continuity of essential services

Italy’s principal strategic significance derives from the interaction of its Mediterranean position, its participation in NATO, its bilateral military relationship with the United States and its obligations within the European Union’s security and resilience frameworks. An assessment restricted to the question of whether Iran could reach an American installation in Italy would omit the wider institutional responsibilities of the Italian state. National authorities would need to evaluate the security of Italian territory, the implications of allied military activity, the protection of persons exposed to foreign-state threats and the continuity of essential services during a wider crisis. These responsibilities cannot be reduced to a missile-range calculation because some are activated by intelligence warnings, criminal offences or infrastructure disruptions that do not involve conventional military attacks.

Italy was among the 24 governments signing the June 2026 declaration condemning Iranian-linked hostile activity. This establishes that Italian participation in the European response to Iranian state threats was not confined to the broader diplomatic dispute over the nuclear programme or the military confrontation in the Middle East. Italy publicly aligned itself with the proposition that hostile activity attributed to Iranian security bodies and associated intermediaries constituted a security concern for participating governments. The statement does not establish an Italian-specific incident, nor does it provide a public assessment of the relative exposure of particular Italian institutions. Its significance is political and institutional: it confirms Italian participation in an international framework for identifying and condemning foreign-state-directed hostile conduct. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK FCDO — Jun 2026.

Italy’s resilience responsibilities are also shaped by European regulation. As an EU member state, it operates within the frameworks established by the NIS2 Directive and the Critical Entities Resilience Directive, subject to the applicable national implementation measures. These frameworks are relevant to the continuity of energy, transport, health, digital services and other essential functions. Their significance is not that every sector faces a demonstrated Iranian attack plan, but that an all-hazards security posture becomes more important when European institutions face simultaneous conventional, cyber and covert-security concerns. NIS2 Directive: Securing Network and Information Systems — European Commission; Critical Infrastructure Resilience at EU Level — European Commission — Jan 2026.

The Italian institutional challenge is therefore primarily one of coordination across legally distinct authorities. Defence decisions concerning national forces and allied arrangements remain separate from criminal investigations, domestic intelligence activity, emergency management and the regulatory supervision of essential-service operators. A threat affecting an American military interest would not automatically justify treating every associated civilian service as part of the military confrontation. Equally, an incident affecting a civilian service would not by itself establish a foreign military attack. The ability to maintain those distinctions while sharing intelligence and coordinating protective measures is central to preserving Italian institutional legitimacy and operational continuity.

From an economic perspective, the most relevant categories of potential exposure are the costs of protective measures, changes in transport and commercial continuity, cyber incident response, supply-chain disruption and the effects of prolonged geopolitical uncertainty. These are categories of possible transmission, not evidence of existing Italian losses attributable to Iran. A country-specific financial estimate would require verified figures for actual incidents, expenditure, service interruptions and recovery costs. No such comprehensive Iran-specific series is established by the reviewed official record. The appropriate conclusion is therefore that Italy has multiple institutional responsibilities relevant to a wider crisis, without assigning speculative probabilities or monetary losses to them.

France: national military authority, European security coordination and a documented regulatory implementation gap

France differs from Italy in the configuration of its national military authority and its institutional role in European security policy. Its national decision-making framework includes independent military responsibilities alongside NATO commitments and participation in EU legislation. In a crisis involving threats to American or European military interests, France would therefore need to distinguish national security decisions from Alliance consultations and EU-level coordination. This is not a claim that France would necessarily choose a different response from Italy, Germany or the United Kingdom. It is a recognition that shared alliance obligations do not eliminate national legal authority or independent political decision-making.

France also signed the June 2026 declaration concerning Iranian state threats, establishing a common public position with other participating countries. That fact should not be transformed into an assertion that the French government has publicly identified a particular Iranian attack plan against a French military installation. The relevant document supports participation in a multinational condemnation of hostile activity, not a verified inventory of French-specific threats. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK FCDO — Jun 2026.

A separate, verifiable concern concerns the implementation of European cybersecurity legislation. On 8 July 2026, the European Commission announced its decision to refer France, together with Ireland, Spain and the Netherlands, to the Court of Justice of the European Union for failure to notify full transposition of the NIS2 Directive. This finding establishes a legal implementation problem at the date of the Commission’s announcement. It does not establish that France’s national cyber-defence organisations were inactive, that French infrastructure was uniquely vulnerable or that France lacked relevant national security powers. Those would require separate evidence. Nevertheless, incomplete transposition is not inconsequential: it raises questions about the timely and consistent application of common obligations, regulatory supervision and cross-border cybersecurity requirements. Commission Refers Ireland, Spain, France and the Netherlands to the Court of Justice for Failing to Transpose the Rules on Cybersecurity — European Commission — Jul 2026.

The French case illustrates the difference between military sovereignty and regulatory interdependence. A state can maintain independent military decision-making while relying on EU legislation for aspects of civilian cybersecurity and essential-service resilience. Failure to complete a legislative obligation does not measure battlefield capability, but it can create uncertainty about the application of common legal requirements. The strategic consequence is that France’s European security responsibilities span at least three different institutional domains: national defence, NATO consultation and EU-regulated civilian resilience. Evaluating them through one composite threat score would obscure the actual allocation of authority.

Germany: alliance functions, domestic counterintelligence and the relationship between military and civilian continuity

Germany occupies a particularly significant position in the European defence architecture because NATO’s official documentation identifies Ramstein as the location of its ballistic-missile-defence command centre. This establishes a publicly documented Alliance function within Germany, but it does not establish the ability of an adversary to strike that facility or provide an assessment of its operational vulnerability. The policy significance is institutional rather than tactical. Germany’s responsibilities involve preserving national security, supporting alliance command arrangements and maintaining the civilian services necessary for a functioning state. Ballistic Missile Defence — NATO — updated Oct 2026.

Germany also joined the June 2026 multinational declaration concerning Iranian-linked hostile activity. Its participation establishes a common governmental position regarding threats associated with Iranian security organisations, but the domestic significance of that position should be evaluated separately from the German military role. Counterintelligence and criminal investigations involve national legal authorities, while NATO command functions operate within a multinational defence framework. Even when the underlying geopolitical concern is related, the applicable standards of evidence, investigative powers and decision processes are different. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK FCDO — Jun 2026.

The German security problem consequently extends beyond the protection of military facilities. A major crisis could require cooperation among military authorities, domestic security organisations, emergency-management bodies, digital-service operators and cross-border regulatory institutions. The importance of this coordination is reinforced by NATO’s integrated air and missile defence policy, which treats defensive operations as a continuous activity extending from peacetime into crisis and conflict. The relevant decision requirement is not to assume that a particular facility represents an exploitable weakness, but to ensure that national and allied authorities can maintain continuity and coordinate protective measures in accordance with their respective responsibilities. NATO Integrated Air and Missile Defence Policy — NATO — Feb 2025.

United Kingdom: the strongest documented national link to the 2026 Iranian covert-threat campaign

The United Kingdom differs from the other major European states in this assessment because its official record contains specific, public attribution of Iranian-linked hostile operations during 2026, alongside a detailed national cyber-threat assessment. The July diplomatic summons concerning the IRGC Qods Force and IMCR establishes the British government’s position that an Iranian state institution directed attacks through an intermediary organisation. The July sanctions announcement identified attacks claimed by the organisation at locations in the United Kingdom, including the arson attack involving four ambulances in Golders Green. These findings provide a stronger country-specific documentary foundation for assessing covert threats than a general statement about Iranian military capability. UK Sanctions Iran-Linked Criminal Group That Publicly Claimed Responsibility for Recent Attacks on Jewish Locations — UK FCDO — Jul 2026; FCDO Summons Iranian Chargé d’Affaires — UK FCDO — Jul 2026.

The country’s national security response also developed through legislation and regulatory measures, although the significance of those actions must be evaluated according to the powers they actually create. The critical analytical point is that the British threat environment combines conventional defence responsibilities, documented covert-state concerns, national criminal-enforcement obligations and cybersecurity resilience. This requires more than a military assessment of missile reach. A hostile operation directed against people, communities or civilian institutions may be addressed through criminal law, protective security and diplomatic action even when it has no connection to an attack on a military facility.

The NCSC’s Annual Review, published on 3 November 2026, adds a particularly current assessment of the cyber dimension. It describes a more competitive and technologically accelerated cyber environment and identifies Iranian-linked groups as capable of producing disruptive effects, while distinguishing those activities from the more extensive cyber challenges associated with other states. The centre’s June alert further demonstrates the importance of distinguishing direct Iranian cyber threats from the indirect consequences affecting British organisations with Middle Eastern operations or supply chains. NCSC Annual Review 2026: The Cyber Threat to the UK — UK NCSC — Nov 2026.

The policy implication is that the United Kingdom must maintain a differentiated response. Physical security, counterintelligence, policing, cyber protection and military defence remain separate functional responsibilities even when political circumstances connect them. The existence of a documented Iranian-linked covert threat does not establish an imminent conventional attack against British territory. Conversely, a lack of verified long-range missile capability should not lead to the dismissal of the hostile activities identified by British authorities.

The Eastern Mediterranean, Southeastern Europe and differentiated alliance membership

The wider European periphery introduces additional legal and institutional complexity. Greece, Türkiye, Romania, Albania and Portugal are NATO members, although their geographical positions, military roles and national security arrangements differ. Cyprus is an EU member state but not a NATO member. This distinction is essential: the geographical proximity of several states or territories to the same crisis does not mean that identical collective-defence provisions apply to all of them. The official NATO membership list establishes the relevant institutional distinction. NATO Member Countries — NATO — Official Membership Record.

Türkiye is of particular importance because NATO documented actual interceptions of Iranian ballistic missiles directed toward Turkish territory in March 2026. This creates a different evidentiary basis from hypothetical attacks against more distant European locations. The Turkish case involves an officially acknowledged military contingency and a documented Allied defensive response. It therefore provides evidence that the crisis had already interacted directly with NATO’s defensive responsibilities, while not establishing that all other European countries faced an equivalent conventional threat. Ballistic Missile Defence — NATO — updated Oct 2026.

Romania occupies a different position within the publicly documented Allied missile-defence architecture. NATO’s records identify Romania as one of the countries participating in the broader European missile-defence structure. This establishes its role within an institutional defensive system, not a measured level of vulnerability. Greece and Albania similarly participate in NATO’s collective political and military framework, while maintaining their own national responsibilities. The policy requirement across these states is to distinguish Alliance membership, national authority, military function and actual incident evidence rather than to classify them collectively as a single group of potential targets.

Cyprus requires especially careful treatment because its EU membership creates access to European regulatory and crisis-coordination mechanisms without making it a party to the North Atlantic Treaty. The potential consequences of a regional confrontation for Cyprus therefore require separate examination under the applicable international law, national arrangements and European Union frameworks. It would be incorrect to describe an incident affecting Cypriot territory as automatically triggering NATO Article 5. Similarly, the international security arrangements of foreign military facilities should not be confused with the formal membership status of the territory on which they are situated.

European Union responsibilities: the gap between military defence and essential-service resilience

The European Union’s role is fundamentally different from NATO’s military defence mission. The EU possesses legislative, regulatory, economic, judicial and coordination instruments that can support the resilience of member states without assuming responsibility for NATO’s integrated military command. This distinction matters most when a crisis affects critical infrastructure, cross-border communications, financial services, transport or other essential economic functions.

The European Commission’s Critical Entities Resilience framework provides a common legal structure for protection against natural and deliberate disruptive events, including sabotage and hybrid threats. NIS2 establishes parallel requirements for digital security and incident reporting. The Commission’s 2026 guidance further addresses the practical implementation of resilience measures, while the EU’s coordinated response to the October–November refrigeration-system incidents demonstrates the existence of institutions capable of participating in cross-border technical monitoring and incident response. Critical Infrastructure Resilience at EU Level — European Commission — Jan 2026; Commission Issues Guidance to Strengthen Resilience of Critical Infrastructure — Jul 2026; Joint Statement on Cyber Incidents in Refrigeration Systems across the EU — European Commission — Nov 2026.

The importance of this division is operational and constitutional. A military threat may require NATO consultation and national defence decisions. A cyber incident affecting an EU-regulated operator may require notification, technical response and competent regulatory supervision. A criminal attack may require national law-enforcement action and judicial cooperation. A severe cross-border infrastructure disruption may involve several of these processes simultaneously. They should coordinate, but not be confused. The existence of a serious security crisis does not automatically transfer all relevant responsibilities to a single European or Atlantic institution.

Chapter 6 — Comparative European institutional matrix

Jurisdiction	Documented military or alliance relationship	Iran-related official security evidence	Civilian resilience framework	Principal analytical distinction
Italy	NATO member; Mediterranean and transatlantic military cooperation	Signatory of June 2026 multinational condemnation	EU NIS2 and CER frameworks, subject to national implementation	National defence, domestic security and EU resilience require separate authorities
France	NATO member; independent national military decision-making	Signatory of June 2026 multinational condemnation	EU frameworks; July 2026 NIS2 transposition proceedings	Regulatory delay must not be confused with military incapacity
Germany	NATO member; documented Alliance missile-defence command functions	Signatory of June 2026 multinational condemnation	EU frameworks and national institutional responsibilities	Military command continuity and domestic counterintelligence are distinct functions
United Kingdom	NATO member; national military and security authorities	Specific 2026 governmental attribution of Iranian-linked attacks	National cyber and protective-security institutions	Stronger country-specific covert-threat documentary record
Türkiye	NATO member	NATO documented Iranian missile interceptions in March 2026	National security and emergency arrangements	Actual documented military incident, not merely theoretical exposure
Romania	NATO member; contributes to European missile-defence architecture	No specific Iran-directed incident established here	EU NIS2 and CER frameworks	Defensive participation does not itself establish vulnerability
Greece	NATO and EU member	No specific Iran-directed incident established here	EU frameworks and national authorities	Eastern Mediterranean location is not an operational capability assessment
Albania	NATO member; historic Iranian cyber activity referenced in US intelligence assessments	European cyber precedent	National arrangements outside EU membership	Cyber attribution and military threat are different evidence categories
Portugal	NATO and EU member	Signatory of June 2026 multinational condemnation	EU frameworks and national authorities	Distance and alliance participation do not establish conventional strike exposure
Cyprus	EU member, not a NATO member	No specific Iran-directed incident established here	EU resilience framework	EU membership must not be confused with NATO Article 5 coverage
European Union	Not NATO’s military command structure	EU sanctions and counterterrorism measures	NIS2, CER and cross-border coordination mechanisms	Regulatory and civilian resilience functions differ from collective military defence

Sources: NATO Member Countries — NATO; Ballistic Missile Defence — NATO — Oct 2026; Joint Statement on Iranian State Threats — UK FCDO — Jun 2026; FCDO Summons Iranian Chargé d’Affaires — Jul 2026; NIS2 Transposition Proceedings — European Commission — Jul 2026; Critical Infrastructure Resilience at EU Level — European Commission — Jan 2026.

WordPress HTML scheme — European institutional response and escalation authorities

The following component translates the comparison into a self-contained institutional responsibility matrix. It deliberately avoids ranking countries by assumed vulnerability. Instead, it shows which kinds of decisions belong primarily to national governments, NATO, EU institutions and specialised security authorities. This is a more defensible comparison than treating geographic distance or the presence of military facilities as a direct measure of exposure.

The HTML contains no JavaScript, imports, remote data requests or global style rules. All selectors are restricted to its unique container, and it does not modify WordPress settings or content outside the component. Its design uses a dark 3D-style presentation while retaining a complete accessible HTML table.

PILLAR II / INSTITUTIONAL SECURITY ARCHITECTURE

European Crisis Response: Three Distinct Institutional Systems

Defence, civilian resilience and criminal-security responses can operate
simultaneously, but their legal mandates and evidentiary requirements differ.
The matrix does not assert country-specific operational weaknesses.

SYSTEM 01

NATO and National Defence

Military deterrence, defensive readiness, consultation and collective-defence decisions under applicable national and treaty authority.

SYSTEM 02

EU and Essential Services

Cybersecurity regulation, critical-entity resilience, cross-border coordination and continuity of civilian economic functions.

SYSTEM 03

National Security and Justice

Counterintelligence, criminal investigation, protective security, attribution and enforcement of domestic legal obligations.

Situation	Principal responsible system	Supporting coordination	Legal and evidence threshold
Credible military threat	National defence authorities and NATO structures	Intelligence, civil protection and allied consultation	Threat assessment; treaty and national authority
Qualifying armed attack on an Ally	National governments and NATO political decision-making	Military command, intelligence and diplomatic coordination	North Atlantic Treaty, including Articles 4–6 as applicable
Major cyber incident affecting an essential entity	Competent national cyber authorities and operators	CSIRTs, ENISA and EU coordination mechanisms	Applicable NIS2 and national incident-reporting rules
Cross-border critical-service disruption	National critical-entity and crisis-management authorities	European Commission and relevant EU networks	CER framework and applicable national law
Suspected foreign-directed criminal activity	Police, prosecutors and national security authorities	International legal assistance and intelligence exchange	Applicable criminal, national-security and evidentiary rules
Unattributed technical incident	Responsible operator and competent incident-response authority	National and international technical cooperation	Evidence must support attribution before assigning state responsibility

Chapter 6 — Key judgments

The European security consequences of Iranian-related escalation depend on the jurisdiction and institutional responsibility involved. Italy must balance Mediterranean and transatlantic military commitments with domestic security and essential-service continuity. France combines independent national military decision-making with NATO and EU responsibilities, while the July 2026 NIS2 proceedings provide evidence of a specific European regulatory implementation issue rather than a measure of French military readiness. Germany’s documented role in Allied missile-defence coordination gives it a distinct institutional position. The United Kingdom possesses especially relevant official evidence of Iranian-linked covert activity during 2026. Türkiye provides the clearest documented example within this assessment of an Iranian missile threat interacting directly with NATO defensive operations. Cyprus illustrates why EU membership and NATO collective-defence coverage must remain separate legal categories.

The broader European Union has an essential but different function from NATO. Its resilience legislation, cybersecurity coordination networks, restrictive measures and cross-border cooperation mechanisms address threats and disruptions that cannot be resolved exclusively through military defence. The central institutional requirement is therefore a coordinated response that maintains the distinctions between intelligence assessment, national sovereign authority, collective military defence, regulatory compliance and criminal attribution.

What would change the assessment: Newly published national threat assessments, verified changes in legal implementation, documented alterations in Alliance defensive arrangements or official evidence of additional country-specific hostile activity would justify revising the comparative assessment. A responsible ranking of national operational vulnerability would also require comparable and authoritative data not established by the present public record.

Open official record: The principal gaps concern comparable national incident-response performance, current readiness across relevant military and civilian systems, and the precise national implementation status of European resilience obligations following the most recently verified Commission decisions.

Pillar II — Integrated Military and Infrastructure Assessment

The evidence assembled across the three chapters supports a central distinction between capability, reach, consequences and attribution. Conventional military reach concerns the demonstrated performance and operational availability of weapons. Covert and cyber threats concern different institutions, operational methods and investigative requirements. Critical-infrastructure exposure concerns the ability of essential services to withstand disruption, regardless of whether the originating cause is hostile, criminal, accidental or natural. European alliance responsibilities determine how governments may respond when an incident becomes a security or defence matter. These categories interact, but none can be substituted for the others.

The official military record establishes a historical Iranian regional missile capability, substantial degradation during the 2026 confrontation and NATO’s demonstrated interception of Iranian ballistic missiles directed toward Türkiye. It does not establish a comprehensive Iranian capacity to attack European military installations throughout the continent. The covert-security record is more specific in a different domain: the June and July 2026 governmental statements identify Iranian-linked hostile activity and provide explicit attribution concerning an intermediary organisation. The cybersecurity evidence is broader but must be interpreted with even greater care. ENISA’s 2026 reporting describes a complex European threat environment dominated by multiple actor categories, while the European Commission’s November statement concerning refrigeration-system incidents demonstrates the need for coordinated technical investigation without establishing Iranian responsibility.

The resulting strategic consequence is that European preparedness cannot be organised around one hypothesised weapon system or one model of hostile activity. Military defence, counterintelligence, law enforcement, cyber incident management and essential-service continuity require different capabilities and evidentiary standards. Their coordination is necessary precisely because the same international crisis may create simultaneous demands across these domains. That coordination must not eliminate the distinctions between an established attack, an attributable hostile-state operation, a suspected cyber incident and a public threat whose operational basis remains unverified.

Final Pillar II judgment: European governments face a genuine multidomain security challenge involving documented conventional military activity in the wider region, formally attributed Iranian-linked covert operations and a complex infrastructure environment susceptible to disruption from multiple causes. However, the available official evidence does not justify describing Iran as possessing unrestricted conventional strike capabilities against Europe, nor does it justify assigning responsibility for unattributed European incidents to Tehran. The most defensible response is to preserve military readiness and civilian resilience while applying rigorous standards of technical verification and legal attribution.

The next analytical stage, Pillar III — Escalation Scenarios, Alliance Responses and Strategic Outlook, must determine how these differentiated capabilities and institutional responsibilities could interact during future crises, what observable evidence would justify changing the threat assessment, and which policy options can improve deterrence and resilience without relying on unsupported assumptions about adversarial capability or intent.

---

Iran and Europe: Escalation Thresholds, Economic Coercion, NATO Decision-Making and the Five-Year Strategic Balance

Principal intelligence judgment: The most consequential European risk arising from a renewed or prolonged confrontation involving Iran is not necessarily a sustained Iranian conventional attack against European territory. It is the possibility that military uncertainty, politically directed threats, covert activity, energy-market disruption and competing international crises interact to create disproportionate strategic consequences. The evidence supports distinguishing an adversary’s willingness to threaten European interests from its ability to conduct particular operations, and distinguishing both from the European institutions’ capacity to maintain essential services and collective decisions under pressure. The March 2026 energy disruption demonstrated that a Middle Eastern conflict can produce major international economic consequences without requiring attacks on European territory, while NATO’s revised September 2026 resilience requirements establish that civilian continuity is integral to credible military deterrence. The five-year outlook must therefore be centred on the interaction between adversarial intent, available capability, institutional response and the economic duration of a crisis—not on speculative predictions of a predetermined war.

Chapter 7 — Competing Strategic Hypotheses and Indicators of Escalation

Chapter judgment: Five overlapping explanations can account for Iranian behaviour affecting European security: deterrent signalling, coercive bargaining, deniable hostile operations, direct military escalation and the opportunistic amplification of a crisis by other states. The strongest discriminating evidence would not be the intensity of public threats, but authenticated operational decisions, independently demonstrated capability changes, attributable hostile activity, diplomatic exchanges and concrete partner-state assistance. The current official record justifies treating these explanations as competing strategic pathways, not assigning unsupported numerical probabilities or assuming that any one pathway excludes the others.

The difference between an adversary’s strategic objective and the activity visible to outside observers

An intelligence assessment that begins with a political declaration and proceeds directly to a prediction of military action risks confusing observable behaviour with the objective that produced it. A threatening government may seek to deter hostile operations, encourage diplomatic concessions, reassure domestic institutions, signal resolve to partners or prepare an actual military response. The same public communication can serve more than one of these purposes. Consequently, a credible assessment requires evidence that distinguishes intention, capability, preparation and execution. The absence of publicly visible preparation does not demonstrate the absence of preparation, but it limits the strength of conclusions that can be reached from open sources.

The March 2026 US intelligence assessment provides an important constraint. It assessed Iran’s regional military capabilities as significantly degraded while identifying the regime’s continued capacity to threaten American and allied interests. It also concluded that cooperation involving Iran, Russia, China and North Korea was selective, primarily bilateral and constrained by divergent national interests. Those two assessments, taken together, weaken the proposition that a threatening statement automatically signals the existence of a geographically extensive and internationally coordinated military campaign. They do not eliminate the possibility of a limited attack, covert action or future rebuilding. Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026, pp. 10–11 and 20.

A second constraint concerns the response of the threatened states. NATO’s public documentation on collective defence makes clear that the classification of an incident and the legal basis for collective action depend on its actual circumstances. Therefore, Iranian decision-makers cannot assume that an incident intended to remain limited will produce a limited European response. Equally, European officials should not treat every alarming statement as a qualifying armed attack. This creates an environment in which the costs of miscalculation are substantial for both sides. Collective Defence and Article 5 — NATO — Official Topic.

Hypothesis A — Deterrent signalling without a decision to attack Europe

Under the deterrent-signalling hypothesis, publicly expressed threats are intended principally to influence the decisions of adversaries rather than initiate a new military theatre. The proposed mechanism is the creation of uncertainty about the potential consequences of further military action. The threatened government must consider whether the adversary retains sufficient capabilities or indirect instruments to impose costs beyond those already anticipated. The strategic objective would be to change risk calculations before an attack becomes necessary.

This hypothesis has an important advantage as an explanation: it does not require the full military feasibility of every publicly described threat. A limited conventional capability, combined with uncertainty regarding covert activity or other forms of retaliation, may be politically consequential even when ambitious long-range military claims remain unsupported. However, this explanation cannot be verified through rhetoric alone. It would require evidence that public threats were connected to particular decisions by adversaries and that the threatening state subsequently adjusted its conduct in relation to those decisions.

The principal disconfirming evidence would be an independently established military operation whose preparation, authorisation and execution demonstrate that the threatening behaviour formed part of an actual attack programme. A further qualification arises when threats become so broad or implausible that they undermine the communicator’s credibility. Deterrence relies on a combination of capability and perceived willingness; increasing the intensity of a message cannot compensate indefinitely for a lack of demonstrated capability.

Hypothesis B — Coercive bargaining and diplomatic leverage

Coercive bargaining differs from general deterrence because it seeks identifiable changes in another state’s behaviour. Deterrence principally aims to prevent an action; coercive bargaining may seek to reverse an existing policy, obtain a concession, change the terms of negotiations or influence an ongoing military operation. The relevant evidence must therefore connect threatening behaviour to a particular political demand.

The March 2026 confrontation occurred in an environment involving Iran’s nuclear programme, sanctions, external military operations and internal economic pressures. These issues create multiple potential objects of negotiation, but their existence does not demonstrate that a particular statement about Europe was issued for bargaining purposes. A credible assessment would need authenticated diplomatic exchanges, official offers, formal demands or a sequence of decisions demonstrating that changes in military rhetoric corresponded to progress or setbacks in negotiations. The US intelligence assessment establishes the broader context of military degradation and economic pressure; it does not resolve the specific bargaining purpose of every Iranian communication. Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026.

An important countervailing mechanism is that threatening countries not directly responsible for a particular military decision may weaken negotiating leverage. Governments that perceive coercion against their territory or population could adopt more restrictive diplomatic and economic measures, increase military cooperation or conclude that concession would encourage further pressure. The effectiveness of coercive bargaining therefore depends on the recipient’s political incentives and its assessment of future consequences, not merely the severity of the threatened action.

Hypothesis C — Deniable hostile operations alongside public military threats

The third hypothesis concerns an attempt to impose costs through activities below the threshold of overt state-to-state warfare. Such activities can involve foreign intelligence organisations, criminal intermediaries or cyber actors, although the existence of those capabilities does not demonstrate that a specific operation has been authorised. The analytical mechanism is that attribution may be difficult or delayed, while the targeted government must nevertheless respond to an immediate security problem.

The 2026 official record provides a concrete foundation for concern. On 10 June, 24 governments condemned Iranian-linked hostile activity. British authorities subsequently attributed European attacks to an intermediary directed by the IRGC Qods Force. These findings demonstrate the existence of a formally recognised hostile-state threat involving non-conventional methods. They do not establish a future campaign across Europe, nor do they prove that any particular new infrastructure incident is Iranian-directed. Joint Statement on Iranian State Threats and HAYI-Claimed Attacks — UK Foreign, Commonwealth & Development Office — Jun 2026; FCDO Summons Iranian Chargé d’Affaires over Attacks by Proxy Groups — UK FCDO — Jul 2026.

The most significant indicator would be new official attribution establishing common direction, financing or operational control across multiple incidents. A sequence of similar incidents would be relevant to an investigation but would not, by itself, establish a single directing authority. Conversely, the arrest of an intermediary or disruption of a criminal network would not necessarily demonstrate that the broader threat had ended. The appropriate distinction is between an observable incident, its technical or criminal characteristics, evidence linking it to an organisation and evidence establishing foreign-state direction.

Hypothesis D — Deliberate expansion into direct confrontation with NATO states

The fourth hypothesis is the most consequential militarily but also the most demanding evidentially. It proposes that Iranian decision-makers could authorise attacks against European territory or military interests despite the potential consequences of confronting NATO members. Such a decision could arise from a belief that escalation is unavoidable, from an assessment that limited action would restore deterrence, or from a serious miscalculation concerning Allied responses. Those possible motives must remain hypotheses rather than attributed decisions.

The March 2026 events involving Türkiye establish that an Iranian ballistic-missile threat had already generated a direct NATO defensive response. On 5 March, NATO reported the successful identification, tracking and interception of an Iranian ballistic missile directed toward Türkiye. That event provides a documented example of the military dimension of the crisis interacting with Alliance obligations; it does not establish an Iranian plan for sustained attacks throughout the European continent. NATO Is Well Postured to Defend Allied Populations against Ballistic Threats — NATO — Mar 2026.

Direct attacks against NATO territory would create the possibility of a major collective political response. Article 5 would require the circumstances of the attack to satisfy the applicable treaty conditions, while Article 4 provides a separate mechanism for consultations. The difference matters because governments must be prepared to respond to an incident without assuming in advance either automatic escalation or the absence of collective-defence implications. Collective Defence and Article 5 — NATO — Official Topic.

Hypothesis E — Parallel pressure from strategically aligned but operationally independent states

A final hypothesis concerns the possibility that Russia, China or North Korea might independently respond to developments that also influence Iran’s strategic calculations. This does not require a formal agreement to coordinate attacks. Governments facing common competitors can benefit from events generated by one another without accepting a shared command structure or undertaking joint military action.

The distinction is especially important for European intelligence assessments because simultaneous crises can appear coordinated even when they have separate causes. Russia could pursue its own Euro-Atlantic objectives, China could adopt diplomatic or economic positions reflecting its independent interests, and North Korea could act according to its regional security priorities. Their behaviour might still affect American and European resource allocation. However, temporal coincidence, political affinity and indirect advantage are insufficient to prove coordination.

The March 2026 ODNI assessment explicitly cautioned against overstating cooperation among these four countries. It described their relationships as largely bilateral, selectively pursued and constrained by concerns about directly confronting the United States. That assessment does not exclude future changes but establishes a strong reason to distinguish strategic opportunity from verified joint planning. Annual Threat Assessment of the U.S. Intelligence Community — ODNI — Mar 2026, p. 20.

Chapter 7 — Analysis of competing hypotheses

The hypotheses are overlapping rather than mutually exclusive. Their current standing reflects explanatory consistency with the verified record and the absence or presence of specific diagnostic evidence; it does not express numerical likelihood.

Hypothesis	Most diagnostic supporting evidence	Principal limitation or contradiction	Observable evidence that would strengthen it	Current assessment
A. Deterrent signalling	Broad public threats without correspondingly established operational capability	The absence of public preparation does not exclude private planning	Authenticated links between warnings and attempts to prevent particular decisions	Strong explanatory fit; intention not proven
B. Coercive bargaining	Identifiable concessions or demands associated with threatening behaviour	The record does not establish a specific negotiated exchange	Formal diplomatic communications linking threats to proposed concessions	Plausible, insufficiently corroborated
C. Deniable hostile operations	Official attribution of Iranian-linked covert activity in Europe	Previous operations do not establish a new campaign	Additional government attributions with common operational direction	Documented capability basis; future intent unresolved
D. Direct military escalation	Military confrontation and documented missile activity affecting Türkiye	Severe force degradation; no established broad European operational reach	Official evidence of renewed military availability and authorised operations	Serious consequence, insufficient evidence for continent-wide attack claims
E. Parallel partner-state pressure	Established bilateral relationships and shared strategic concerns	ODNI identifies major constraints on integrated cooperation	Verified joint planning, operational transfers or explicitly coordinated conduct	Selective assistance credible; unified action unproven

Warning indicators must be evaluated in combinations, not isolation

A single missile-development announcement, official speech, cyber incident or diplomatic meeting is rarely sufficient to establish a major strategic transition. More informative assessments combine evidence from different domains whose relationship can be independently tested. A verified capability change accompanied by an authenticated political directive is more consequential than either observation alone. A series of criminal incidents supported by common forensic findings and official attribution is more informative than a collection of unconnected claims of responsibility. Similarly, a bilateral diplomatic meeting becomes evidence of military coordination only when its actual content or subsequent observable implementation supports that interpretation.

The resulting framework should distinguish indicators of intent, capability, authorisation, execution and strategic consequences. These categories serve different decisions. Evidence of capability can justify contingency planning without proving imminent action. Evidence of an authorised operation may require more urgent protective measures even when the intended scale is uncertain. A confirmed attack requires an incident-specific legal and security response. The difficulty is that these stages may not appear publicly in a reliable sequence, so governments must preserve the possibility that important evidence remains classified while avoiding the publication of unsupported operational conclusions.

Chapter 7 — Key judgments

The strongest strategic explanations remain coercive signalling and the potential continuation of non-conventional hostile activity, while direct military escalation must be maintained as a consequential contingency rather than a verified continent-wide operational plan. The relationship between Iran and other powers is better assessed through specific forms of assistance and observable behaviour than through the assumption of a consolidated military coalition. The decisive analytical improvement would come from evidence connecting state intent to operational decisions, rather than further repetition of political threats.

What would change the assessment: Authenticated state instructions, officially verified long-range military capabilities, multiple independently attributed operations, or documents establishing coordinated military commitments with external powers.

Open official record: Current Iranian operational authorisations, the extent of military reconstruction and verified evidence of any post-March 2026 expansion in multinational operational cooperation remain the most consequential gaps.

Chapter 8 — NATO, European Governments and the Economics of Strategic Disruption

Chapter judgment: The economic consequences of an Iranian-related crisis for Europe cannot be measured solely through military expenditure or the direct physical damage produced by an attack. The March 2026 Middle Eastern conflict demonstrated that disruption of internationally important energy flows can generate major price and supply consequences independently of military attacks against European territory. At the same time, NATO’s September 2026 revision of its seven national resilience requirements makes the protection of civilian services, military-support functions and economic dependencies an explicit component of collective deterrence. These two developments provide a stronger analytical foundation for evaluating European resilience than speculative estimates of what an adversary might destroy. They demonstrate that economic security, continuity of government, energy availability, transport, communications and national defence are operationally connected, even though they remain subject to different authorities and budgetary arrangements.

The legal architecture of escalation: consultation, collective defence and national sovereignty

The first institutional challenge concerns the relationship between a hostile incident and the authority to respond. NATO’s official explanation of Article 5 distinguishes the existence of a qualifying armed attack from the decision by an attacked Ally to seek collective action. It explains that an Ally subjected to an armed attack may request or consent to collective action and that the North Atlantic Council can consider whether the circumstances fall within the treaty framework. NATO further confirms that Article 4 consultations are available when an Ally considers its territorial integrity, political independence or security threatened, without requiring that an armed attack already have occurred. Article 4 consultations are neither a prerequisite for nor an automatic indication of Article 5 action. Collective Defence and Article 5 — NATO — Official Topic.

This distinction is fundamental to strategic crisis management. Governments may need to take protective measures, investigate hostile activity, reinforce readiness or consult allies before an incident can be legally classified as an armed attack. Conversely, even a serious incident does not automatically establish that every state must adopt the same military response. NATO’s account of collective defence also emphasises that assistance under Article 5 is determined in accordance with the treaty, allowing Allies to take the action each considers necessary. The treaty therefore combines collective obligation with national responsibility for the form of assistance. It should not be described either as a purely discretionary political statement or as an automatic mechanism requiring identical military operations by all members.

Cyber and hybrid incidents introduce additional complexity because their legal classification depends on scale, effects and circumstances. NATO recognises that sufficiently serious cyber and hybrid attacks may amount to armed attacks, but this determination remains case-specific. The presence of malicious software, an interruption of digital services or an unattributed act of sabotage does not automatically satisfy the threshold. International legal responsibility likewise requires separate consideration of attribution and the applicable rules governing state conduct. The resulting process demands cooperation between defence institutions, technical investigators, intelligence authorities and political decision-makers without collapsing their evidentiary standards into one.

For Italy, France and Germany, NATO membership operates alongside national constitutional and statutory authority and EU membership. The United Kingdom participates in NATO but not the EU’s current legislative framework for cybersecurity and critical-entity resilience. This division is operationally relevant because national governments remain responsible for substantial elements of civilian preparedness and emergency management even when the underlying military crisis concerns the Alliance as a whole.

September 2026: NATO formally elevated civilian resilience as an integral defence requirement

On 15 September 2026, NATO published its revised 2026 Resilience Baseline Requirements, providing an unusually detailed official description of the civilian capabilities necessary to support deterrence and defence. The framework consists of seven requirements: continuity of government and critical governmental services; resilient energy supply; the ability to manage controlled and uncontrolled movement of people; resilient food and water resources; capacity to manage mass casualties and disruptive health crises; resilient civilian communications; and resilient civilian transport. The document explicitly identifies civil support to military operations, host-nation support, crisis preparation, response and recovery as essential functions. 2026 Resilience Baseline Requirements — NATO — Sep 2026.

The strategic importance of this revision is that civilian systems are not treated merely as assets to be defended after military operations begin. They are part of the enabling environment that allows governments and armed forces to function throughout a crisis. NATO identifies the provision of energy, food, water, medical services, communications, transport and essential governmental functions as integral to national and collective preparedness. It also recognises that military and civilian needs may compete for resources, requiring advance arrangements for prioritisation and coordination. This has direct consequences for any attempt to impose coercive costs on European countries: the effectiveness of disruption depends partly on whether institutions can maintain the essential functions that support both society and military activity.

The revised requirements also identify several cross-cutting challenges with significant relevance to economic security. NATO explicitly includes physical attacks and sabotage, disruptive cyberattacks, emerging technologies, harmful economic dependencies, environmental shocks, repair capacity and reliance on space-enabled services. These risks are presented as interacting factors, not as evidence of a particular Iranian plan. The value of the framework is that it allows governments to evaluate resilience against a wide range of causes rather than constructing a separate response system for every possible adversary. 2026 Resilience Baseline Requirements — NATO — Sep 2026.

The requirements further emphasise formal continuity-of-government arrangements, including decision-making procedures, succession, national essential functions and the maintenance of representation within NATO under difficult conditions. This is not simply an administrative detail. In a period of strategic intimidation, the ability of a government to continue making legitimate and timely decisions reduces the potential political effect of threats intended to create confusion or paralysis. The defensive value of continuity therefore extends beyond maintaining individual services; it protects the institutional capacity through which national sovereignty is exercised.

The March 2026 oil disruption provides an empirical measure of indirect economic consequences

The clearest quantitative evidence that a conflict involving Iran can impose substantial economic costs without attacks on European territory comes from the International Energy Agency’s Oil Market Report of 12 March 2026. The IEA assessed that the conflict had produced the largest supply disruption in the history of the global oil market. Oil and product flows through the Strait of Hormuz, approximately 20 million barrels per day before the outbreak of hostilities, had fallen to a very small fraction of their previous level. The agency reported that Gulf producers had curtailed at least 10 million barrels per day of crude oil, condensate and natural gas liquids production, while disruption and a lack of viable export outlets affected refining activity. Oil Market Report — International Energy Agency — Mar 2026.

The IEA reported that Brent crude had risen by approximately US$20 per barrel from the outbreak of hostilities to around US$92 per barrel at the time of the report, after futures prices had approached US$120 per barrel during the initial disruption. It also recorded major consequences for refined petroleum products, liquefied petroleum gas, naphtha, petrochemicals and aviation-related demand. These observations provide a powerful demonstration of economic transmission: a regional military conflict can alter global energy prices, production schedules, transport decisions and industrial activity even when the ultimate consumer country has not been directly attacked. The effects depend on the international structure of supply and demand, available inventories, alternative logistics and the duration of disruption. Oil Market Report — International Energy Agency — Mar 2026.

The IEA’s response demonstrates the importance of institutional buffers. On 11 March 2026, IEA member countries agreed to make 400 million barrels of emergency oil reserves available to the market to mitigate the disruption. This was a collective response to an existing supply shock, not a prediction of future attacks. The volume should not be confused with daily supply capacity, and it cannot be converted into an exact number of days of global protection without assumptions regarding the rate of release, market availability, replacement supply and actual losses. Oil Market Report — International Energy Agency — Mar 2026.

The contrast between the supply disruption and the emergency response illustrates a broader principle: the strategic consequence of an energy shock depends on both the magnitude of the initial disruption and the capacity of institutions to absorb, redistribute and recover from it. Strategic reserves, alternative suppliers, demand adjustment and logistics are all relevant, but none guarantees immunity from prolonged disruption. The March figures are historically specific and should not be presented as current November market conditions or as a forecast of a future crisis.

Quantitative evidence: the March 2026 energy shock

Indicator	Officially reported value	Reference period	Definition and interpretive limitation
Pre-conflict oil and product flows through Hormuz	Approximately 20 million barrels/day	Before 28 Feb 2026	Approximate physical flow, not European consumption
Middle Eastern production curtailed	At least 10 million barrels/day	March 2026	Crude oil, condensate and natural gas liquids
Expected global supply decline	Approximately 8 million barrels/day	March 2026	IEA monthly projection, including offsetting production elsewhere
Brent price at report preparation	Approximately US$92/barrel	12 Mar 2026	Market observation, not an annual average
Brent increase since conflict began	Approximately US$20/barrel	Late Feb–12 Mar 2026	Change over the specified conflict period
IEA collective emergency response	400 million barrels	Decision of 11 Mar 2026	Announced emergency oil availability, not an instantaneous injection
Regional refined-product exports	3.3 million barrels/day	2025	Historical Gulf export baseline
Regional LPG exports	1.5 million barrels/day	2025	Historical Gulf export baseline
Expected 2026 oil demand growth	640,000 barrels/day	March 2026 forecast	A forecast vintage subsequently subject to revision

All figures are from the Oil Market Report — International Energy Agency — Mar 2026. They describe different units and reference periods; production losses, disrupted exports, emergency reserves and price changes must not be added together or interpreted as interchangeable measures.

NATO’s financial commitments convert resilience into a multiyear investment obligation

The economic dimension of collective defence also changed materially with the NATO summit at The Hague on 25 June 2025. Allies committed to investing 5% of GDP annually by 2035, consisting of at least 3.5% of GDP for core defence requirements and up to 1.5% of GDP for broader defence- and security-related spending. The latter category includes critical-infrastructure protection, secure networks, civilian preparedness, resilience and relevant industrial capacity. These are expenditure commitments and accounting categories, not evidence that every Ally has already reached the target or that all future projects have been funded. Defence Investment and NATO’s 5% Commitment — NATO — updated Jun 2026.

NATO’s June 2026 update reported that European Allies and Canada increased defence expenditure by more than US$90 billion in 2021 prices during 2025, an increase of nearly 20% in real terms compared with 2024. Their combined expenditure reached more than US$571 billion in 2021 prices, corresponding to approximately 2.3% of combined GDP, compared with 1.4% in 2014. These figures establish that the investment trajectory was already changing before the adopted 2035 deadline. However, the comparison of expenditure across countries must distinguish nominal and real values, the scope of defence accounting, GDP denominators and changes in national procurement cycles. The NATO figures do not support attributing all increased spending to Iran; the Alliance identifies a wider strategic environment, especially Russia’s long-term threat and the requirements of collective defence. Defence Investment and NATO’s 5% Commitment — NATO — updated Jun 2026.

The revised 2026 Resilience Baseline Requirements provide an institutional connection between those expenditure categories and practical civilian needs. NATO explains that expenditures relating to resilience, civil defence and preparedness can contribute to the broader investment category where they are based on national resilience planning or required to enable national or NATO defence plans. This creates a potential framework for financing measures that support both civilian continuity and military readiness, while retaining the requirement that expenditure meet the applicable accounting definitions. 2026 Resilience Baseline Requirements — NATO — Sep 2026.

The European Union has developed a complementary financial instrument. The Security Action for Europe programme, established by Council regulation in May 2025, provides up to €150 billion in loans to support defence-related investment and common procurement. The programme includes areas such as missile and air defence, cyber capabilities, protection of critical infrastructure and military mobility. Its financial design is materially different from a grant: loans create repayment obligations for participating member states, and the available ceiling should not be confused with expenditure already made or equipment already delivered. What Is Security Action for Europe (SAFE)? — Council of the European Union — Official Policy Record.

This difference is especially important for evaluating the economics of preparedness. A procurement authorisation does not automatically generate manufacturing capacity; an announced investment does not establish operational availability; and national commitments do not demonstrate that every critical civilian function has sufficient protection. The strategic issue over 2026–2031 is whether financial commitments are converted into measurable readiness, tested recovery mechanisms, interoperable systems and reliable industrial deliveries.

The economic cost of disruption should be evaluated through recoverability, not only immediate losses

Direct costs are the most visible component of a hostile incident: physical damage, emergency response expenditure, repairs, investigation and immediate service interruption. But a prolonged crisis can produce secondary consequences that are distributed through contracts, insurance arrangements, supply chains, energy prices, working capital and public expenditure. These effects can persist after the original incident has ended, especially where recovery depends on specialised labour, replacement equipment or multiple organisations with separate legal responsibilities.

The existence of such transmission pathways does not justify inventing a national loss figure. A rigorous economic assessment would require baseline service volumes, actual downtime, the proportion of capacity affected, replacement arrangements, direct expenditure, contractual obligations and the time needed for restoration. Where those data are not available, a qualitative dependency assessment is more defensible than a monetary estimate constructed from assumptions that cannot be verified.

NATO’s 2026 requirements explicitly recognise restoration and repair capabilities as cross-cutting resilience needs. They also identify harmful economic dependencies and disruptions to civilian support for military operations as potential sources of strategic vulnerability. The implication is that an economically important incident should be evaluated not merely by what initially stopped functioning, but by whether essential functions can continue through alternative arrangements and how quickly normal performance can be restored. 2026 Resilience Baseline Requirements — NATO — Sep 2026.

Chapter 8 — Financial and institutional exposure matrix

Economic or institutional domain	Documented baseline	Potential transmission mechanism	Relevant authority	Evidence required for monetary assessment
Energy markets	IEA March 2026 supply shock and emergency response	Import costs, fuel prices, production costs and substitution	National governments, IEA members, market authorities	Actual imports, prices, inventories, contracts and duration
NATO defence investment	5% GDP commitment by 2035, including 3.5% core defence	Budgets, procurement, industrial capacity and fiscal trade-offs	Allied governments and NATO accounting arrangements	National plans, commitments, obligations and outlays
Civilian resilience investment	Up to 1.5% GDP category within the NATO commitment	Infrastructure protection, civil preparedness and repair capability	National authorities	Eligible expenditure, implementation and tested readiness
EU defence financing	SAFE loan ceiling of up to €150bn	Common procurement, financing costs and industrial capacity	Council, Commission and member states	Loan approvals, borrowing, repayment and delivery records
Transport continuity	NATO 2026 resilience requirements	Commercial disruption and competition for civilian-military resources	National authorities and operators	Actual service interruption, capacity and recovery time
Communications continuity	NATO resilience requirements and national cyber frameworks	Loss of service, recovery costs and emergency coordination	National cyber and communications authorities	Incident records, downtime and replacement costs
Healthcare and emergency capacity	NATO resilience requirements	Emergency expenditure and continuity of essential healthcare	National health and emergency authorities	Verified demand, surge capacity and actual expenditure
Government continuity	NATO resilience requirements	Decision delays, additional crisis-management expenditure	National governments	Documented interruption and administrative costs

Sources: Oil Market Report — IEA — Mar 2026; Defence Investment and NATO’s 5% Commitment — NATO — Jun 2026; 2026 Resilience Baseline Requirements — NATO — Sep 2026; Security Action for Europe — Council of the EU.

NATO’s 2026 seven resilience requirements

This component is designed for insertion immediately after the financial and institutional exposure matrix. It visualises the seven officially defined resilience requirements, showing how civilian preparedness supports national authority and collective defence. The layout is conceptual rather than a representation of physical network dependencies. No arbitrary numerical values, risk scores or country rankings are introduced.

PILLAR III / NATO RESILIENCE ARCHITECTURE / SEPTEMBER 2026

Seven Civilian Resilience Requirements Supporting Collective Defence

The seven categories below are defined by NATO. They are institutional
requirements, not an assessment that any country or installation is vulnerable.

National Sovereign Authority and Allied Military Continuity

National resilience, civil support to military operations,
host-nation support and the maintenance of essential services
under crisis and conflict conditions.

REQUIREMENT 01

Government Continuity

Continuity of sovereign authority, essential public services and national decisions.

REQUIREMENT 02

Resilient Energy Supply

Continuity, alternative arrangements, restoration and coordination with operators.

REQUIREMENT 03

Movement of People

Safe population movement and coordination with military transport needs.

REQUIREMENT 04

Food and Water Resources

Essential civilian supplies and continuity of provision in crisis.

REQUIREMENT 05

Healthcare and Mass Casualties

Medical continuity, emergency preparedness and civil-military coordination.

REQUIREMENT 06

Civil Communications

Reliable communications, public alerts and continuity of services.

REQUIREMENT 07

Civil Transportation

Continuity and restoration of transport services supporting society and defence.

Requirement	Defensive policy outcome	Validation evidence
Government	Legitimate decisions remain possible	Continuity exercises and tested procedures
Energy	Essential supply remains available or recoverable	Operator exercises and restoration plans
Movement	Population and military needs can be coordinated	National emergency exercises
Food and water	Basic public needs remain served	Contingency and supply arrangements
Healthcare	Essential medical functions can continue	Capacity assessments and exercises
Communications	Government and public communication remains viable	Recovery and alert-system tests
Transport	Essential civilian and military movement can continue	Service continuity and restoration testing

The economic decision is not simply how much to spend, but which resilience effect an expenditure purchases

The commitment to higher defence and security expenditure creates an important financial-governance problem. A government may be able to demonstrate that spending has increased without showing that a specific capability has become operational, that a critical service can recover more quickly or that civilian and military plans are compatible. A defensible investment programme must therefore connect expenditure to a measurable public function: continuity of essential services, improved readiness, tested procedures, reliable supply, workforce capacity or shorter restoration periods. The policy value of an investment should be assessed against the performance it is intended to improve, the authority responsible for implementation, its lifecycle costs and its interaction with existing programmes.

This approach matters particularly where public and private actors share responsibility. NATO issued guidance on 16 July 2026 concerning cooperation with private-sector operators, recognising that governments depend on commercially owned resources and services for many resilience functions. Such cooperation requires clarity regarding information exchange, contingency obligations, investment incentives and the division of responsibility during crises. Private operators cannot be assumed to possess the same priorities as military authorities, while governments cannot simply transfer sovereign security obligations to commercial contracts. Guidance for Enhancing Public-Private Cooperation for Resilience — NATO — Jul 2026.

The economic objective is thus to reduce the consequences of disruption while preserving efficiency during normal operations. This may require accepting costs for redundancy, exercising emergency procedures and maintaining capabilities that are not used continuously. Those expenditures should not be characterised automatically as economic losses caused by an adversary. They can create public value through lower recovery costs, improved reliability and greater capacity to withstand non-hostile disruptions as well. The analytical challenge is to evaluate that value using documented performance rather than arbitrary claims of avoided losses.

Chapter 8 — Key judgments

The March 2026 oil shock provides direct evidence that a conflict involving Iran can generate internationally significant economic disruption without conventional attacks on European territory. NATO’s September resilience framework establishes that national civilian continuity is an integral component of collective defence, while the 2025 Hague commitments and SAFE programme provide important but distinct financial instruments for building readiness. These documents do not establish that all spending targets have been met, that procurement has generated operational capability or that European countries possess uniform resilience. The principal policy challenge is to connect financing, implementation and tested functionality while preserving the legal differences between NATO military authority, EU regulation and national responsibilities.

What would change the assessment: Officially reported improvements or deteriorations in national resilience performance, new verified expenditure and procurement data, material changes in the international energy market, or revisions to the applicable NATO and EU frameworks would change the estimate of European preparedness and financial exposure.

Open official record: Comparable national data on restoration times, continuity performance, the implementation costs of resilience requirements and actual procurement deliveries remain insufficient to produce a defensible unified European readiness or economic-loss score.

Chapter 9 — The 2026–2031 Strategic Outlook: Early Warning, Policy Options and Net Assessment

Chapter judgment: The most defensible five-year outlook is one in which Iran’s strategic position may change through military reconstruction, leadership decisions, the evolution of foreign relationships and the ability of European institutions to strengthen resilience. These variables are sufficiently consequential that a fixed prediction of either inevitable war or sustained restraint would exceed the available evidence. The official record supports several conditional pathways, but it does not provide historical base rates, sufficiently reliable capability inventories or an independently reproducible forecasting model from which numerical probabilities could be derived. Strategic planning should therefore use explicit scenarios, observable signposts and predetermined decision responsibilities rather than numerical estimates that would create an illusion of precision.

The 2026 baseline: a damaged military power confronting an increasingly organised European defence and resilience system

The starting position for the forecast is unusual because the same year produced evidence of Iranian military degradation, direct confrontation involving NATO defensive systems and substantial changes to European preparedness policy. The March US intelligence assessment described severe damage to Iranian conventional military capabilities and anticipated that rebuilding missiles and unmanned aircraft would take years if Tehran pursued restoration. NATO documented the interception of Iranian missiles directed toward Türkiye, while the Alliance later issued revised civilian resilience requirements. European governments also possessed a formal record of Iranian-linked hostile activity extending beyond the military theatre. These developments do not create a single linear trend, but they establish the principal variables through which the 2026–2031 security environment may evolve. Annual Threat Assessment — ODNI — Mar 2026; NATO Is Well Postured to Defend Allied Populations against Ballistic Threats — NATO — Mar 2026; 2026 Resilience Baseline Requirements — NATO — Sep 2026.

The outlook must recognise that military reconstruction is a process rather than a single event. A public announcement concerning production does not establish deployment, and a successful test does not establish the availability of an effective operational force. A recovery assessment should therefore rely on successive official evaluations capable of distinguishing development, manufacturing, delivery and readiness. The relevant question is whether a demonstrable change in capability alters the range of credible options available to Iran, not whether the country repeats an ambition to recover previous military strength.

European preparedness will evolve simultaneously. NATO’s 2035 spending commitment extends beyond the present forecasting horizon, while the September 2026 resilience framework is already applicable as an institutional reference. This means the 2026–2031 period should be treated as one of implementation and capability development rather than completion of all declared objectives. Public authorities may announce procurement, financing or legal reforms faster than operational systems can be delivered and exercised. The maturity of European resilience must be evaluated through observable results rather than the number of policy commitments adopted. Defence Investment and NATO’s 5% Commitment — NATO — Jun 2026; Security Action for Europe — Council of the European Union.

Scenario 1 — Managed confrontation and continued strategic signalling

Under the first pathway, Iran continues to oppose American and Israeli military pressure while avoiding a deliberate expansion into sustained armed confrontation with European NATO members. Public warnings, diplomatic disputes and selective external relationships may persist, but the principal strategic competition remains bounded by the consequences each side anticipates from wider escalation. European governments maintain protective measures and continue strengthening their military and civilian resilience, without treating every hostile communication as evidence of an imminent attack.

This scenario is compatible with the March assessment of military degradation and the documented limits of Iran’s external partnerships. It would be supported by declining evidence of new hostile operations, official diplomatic exchanges and an absence of demonstrated capability changes materially expanding the military threat. It would be weakened by authenticated orders authorising new attacks, repeated state-attributed incidents or actions indicating that Tehran had decided to accept the costs of a broader confrontation.

The economic consequence would not necessarily be a return to an entirely normal risk environment. Even managed confrontation can sustain defence expenditure, sanctions-related costs, insurance concerns and precautionary security measures. However, the absence of repeated major supply disruptions would reduce one important mechanism through which a regional crisis can transmit economic pressure internationally.

Scenario 2 — Persistent coercive activity below conventional-war thresholds

The second pathway involves continued or renewed hostile activity in forms that do not constitute an openly declared military campaign against Europe. Such activity could produce investigations, protective measures, sanctions and diplomatic responses while leaving the legal classification of individual incidents dependent on the evidence. The scenario’s plausibility rests on the officially documented existence of Iranian-linked activity in Europe; it does not assume that a new campaign has already been authorised.

The relevant distinction is between the continuation of a known threat category and the creation of a geographically comprehensive strategy. Existing government attributions make further counterintelligence preparedness rational, but they do not establish the locations, timing or participants of future operations. An accurate forecast would therefore focus on whether new official cases demonstrate common direction, whether national authorities identify changes in operational methods and whether cross-border cooperation improves the detection and disruption of hostile networks.

The principal danger of this pathway is cumulative. A sequence of individually limited incidents can require repeated investigations, increase protective expenditure and complicate diplomatic relations. The countervailing possibility is that sustained investigative cooperation weakens the networks involved and strengthens governmental resilience. The final strategic effect depends on attribution, enforcement, public confidence and the ability to maintain essential functions, not simply on the number of incidents reported.

Scenario 3 — Renewed regional confrontation with substantial European economic consequences

The third pathway involves a renewed or prolonged Middle Eastern conflict whose consequences reach Europe principally through energy markets, commercial transport, supply chains, risk expectations and diplomatic demands. The March 2026 IEA evidence establishes the relevance of this scenario more concretely than an unverified prediction of strikes against European territory. A regional disruption can alter global commodity flows and commercial behaviour at a scale that produces substantial consequences for importing economies.

The IEA’s March report documented the interruption of an internationally important supply corridor, major production curtailments and the collective release of emergency stocks. These are historical observations, not assumptions about the magnitude of a future crisis. They demonstrate the channels through which disruption can reach Europe and the importance of inventories, alternative suppliers, market responses and emergency coordination. Oil Market Report — IEA — Mar 2026.

A future regional confrontation would not necessarily repeat the same market outcome. Economic effects depend on the duration of interruption, production levels, global inventories, demand conditions, alternative flows and policy responses. The proper forecasting task is therefore conditional: determine which measurable developments would indicate that a disruption is becoming prolonged and whether available buffers are sufficient to preserve essential functions. This scenario could generate significant European costs without establishing Iranian military reach across the continent.

Scenario 4 — Direct military escalation involving a NATO member

The fourth pathway involves a deliberate or unintended armed confrontation affecting NATO territory. It could arise from an attack that the responsible authorities determine to be attributable and sufficiently serious to justify military or collective-defence action, or from a sequence of events in which successive responses expand the confrontation beyond its original scope.

The consequences would depend on the nature of the incident, the attacked state’s decisions, Allied consultations and the legal framework. NATO’s Article 5 guidance demonstrates that the threshold is not defined solely by the type of weapon employed; serious cyber or hybrid attacks may also be relevant, depending on circumstances. At the same time, Article 4 provides a distinct consultation mechanism for threats that have not produced a qualifying armed attack. Collective Defence and Article 5 — NATO — Official Topic.

The critical forecasting variable is not the general possibility of conflict, which is evident from the wider security environment, but the emergence of authenticated decisions and capabilities that make attacks on Allied territory a realistic operational option. The scenario would become more concerning if credible intelligence established hostile authorisation together with relevant operational readiness. It would be weakened by verified restraint, effective de-escalation measures and the absence of further military activity affecting Allied territory.

Scenario 5 — Concurrent crises and selective external amplification

The fifth pathway concerns the interaction of an Iranian-related crisis with separately generated pressures involving other states. It does not require Russia, China and North Korea to establish a common command structure or adopt identical objectives. The relevant strategic effect arises if several crises compete for the same diplomatic attention, military resources, financial capacity or industrial production.

The March 2026 ODNI assessment provides the necessary caution: the four states cooperate selectively and mainly bilaterally, while divergent interests constrain the scope of their relationships. A future development would strengthen the coordinated-action hypothesis only if evidence demonstrated relevant operational collaboration or direct commitments. Otherwise, simultaneous incidents should be evaluated as potentially independent developments with interacting consequences. Annual Threat Assessment — ODNI — Mar 2026, p. 20.

Five-year scenario comparison

These pathways may overlap. They do not form an exhaustive set of mutually exclusive outcomes and should not be assigned percentages that must total 100%.

Scenario	Principal mechanism	Observations supporting activation	Main European consequence	Observation weakening the scenario
Managed confrontation	Deterrence and diplomacy restrain escalation	Formal exchanges, absence of new authorised operations	Continuing preparedness and diplomatic costs	Repeated attributed attacks or verified new escalation orders
Persistent covert pressure	Non-conventional hostile activity continues	New credible attribution and common organisational links	Security costs, legal action and public protection	Verified disruption of networks and sustained reduction in incidents
Regional economic shock	Energy and transport disruptions transmit losses internationally	Official supply, flow, inventory and market data	Energy prices, industrial and commercial disruption	Restored flows, adequate buffers and sustained market normalisation
NATO-related armed escalation	A qualifying hostile incident creates collective-defence decisions	Confirmed attack, attribution and Allied consultations	Potential major military and diplomatic response	Verified de-escalation and absence of further hostile military action
Concurrent external crises	Independent or selective partner actions create combined pressure	Documented overlapping crises and actual resource effects	Competing strategic demands and investment pressures	Reduced simultaneous demands or demonstrated absence of interaction

Early warning must be tied to the authority empowered to act

An effective warning system should not merely collect alarming indicators. It should connect each category of information to an appropriate decision. Officially reported military capability changes justify review by defence and intelligence authorities. Verified diplomatic commitments justify reassessment by foreign ministries and alliance institutions. Cyber incidents require technical investigation and, where relevant, criminal or national-security attribution. Significant energy disruptions require analysis by market authorities, energy ministries and emergency coordination bodies. These responses can be related, but they should not be triggered automatically by the same evidentiary threshold.

NATO’s September 2026 resilience requirements establish that national authorities should maintain tested arrangements for continuity, cross-government coordination and civil support to military operations. This offers a suitable institutional basis for linking warnings to defensive preparation without implying that public military threats alone establish imminent attack conditions. 2026 Resilience Baseline Requirements — NATO — Sep 2026.

Chapter 9 — Early-warning and decision matrix

Indicator family	Observable official evidence	Interpretation	Responsible decision domain	Material change in assessment
Iranian military recovery	Verified tests, fielding assessments and readiness reporting	Changes in demonstrated military capacity	National defence intelligence and NATO	Evidence of operational capabilities beyond the previous baseline
Iranian political direction	Authenticated decisions, formal orders or official policy changes	Changes in authorised state intent	Foreign ministries and intelligence authorities	Credible evidence of specific hostile authorisation
Covert hostile activity	Official attribution, court records and investigative findings	Changes in operational activity or organisational direction	Police, prosecutors and security services	Corroborated common direction across multiple incidents
Cyber activity	Competent technical advisories and incident investigations	Changes in threat behaviour or actual disruption	National cyber authorities and operators	State attribution supported by incident-specific evidence
External partner involvement	Official military-transfer records or authenticated commitments	Changes in available assistance	Foreign and defence ministries	Verified operational cooperation rather than general political alignment
NATO consultations	Formal Allied decisions and official statements	Changes in collective political and legal response	North Atlantic Council and national governments	Determination that an incident meets an applicable treaty threshold
Energy disruption	IEA supply assessments, inventories and market observations	Economic transmission and buffer adequacy	Energy ministries and relevant international institutions	Prolonged disruption exceeding available adaptive capacity
Civilian resilience	Tested national plans, operator reporting and recovery outcomes	Ability to maintain essential services	National resilience and emergency authorities	Verified improvement or deterioration in continuity performance

Five-year strategic scenarios and decision thresholds

This final component is intended for insertion following the early-warning matrix. It offers a selectable view of the five strategic scenarios, followed by an auditable decision table. The interaction uses native HTML radio controls, so it requires no JavaScript. Its styling remains restricted to the component container, and it does not attempt to modify WordPress settings, global variables or external resources.

The scenarios are qualitative and overlapping. The component does not display invented probabilities, artificial risk scores or numerical estimates of future military effectiveness.

PILLAR III / STRATEGIC OUTLOOK / 2026–2031

Five Conditional Scenarios and European Decision Implications

Scenarios describe alternative pathways, not predicted outcomes.
Several may occur together. Select a scenario to inspect its
mechanism, observable indicators and decision consequences.

S1 / Managed
S2 / Covert
S3 / Economic
S4 / Military
S5 / Concurrent

Scenario 1 — Managed Confrontation

Political signalling and diplomatic pressure continue without a sustained expansion into European armed confrontation.

Indicators: Formal diplomacy, verified restraint and no corroborated new attack authorisations.

Decision implication: Maintain proportionate readiness and diplomatic channels.

Scenario 2 — Persistent Covert Pressure

Attributable hostile-state activity creates continuing investigative, protective-security and legal responsibilities.

Indicators: Official findings linking new incidents to common direction or financing.

Decision implication: Strengthen lawful counterintelligence, cross-border investigations and protection of affected communities.

Scenario 3 — Regional Economic Shock

Military developments outside Europe disrupt international energy, transport and commercial arrangements.

Indicators: IEA market data, actual supply interruptions, inventories and restoration of international flows.

Decision implication: Coordinate energy security, essential services, commercial continuity and emergency response.

Scenario 4 — NATO-Related Armed Escalation

An attributable hostile incident creates the possibility of collective political and military decisions under the North Atlantic Treaty.

Indicators: Official confirmation, the incident’s legal classification and Allied consultations.

Decision implication: Preserve national authority, credible defence and legally grounded collective decision-making.

Scenario 5 — Concurrent Strategic Pressures

Separate crises interact through military resources, diplomacy, economic capacity or industrial commitments.

Indicators: Verifiable resource effects and evidence distinguishing independent behaviour from coordination.

Decision implication: Maintain multisector preparedness without assuming an integrated adversarial command.

Decision area	Observable trigger	Responsible authority	Defensible response category
Military readiness	Verified hostile capability or confirmed military activity	National defence authorities and NATO	Review readiness and defensive arrangements
Covert-state threats	Credible attribution of hostile operations	Police and national security agencies	Investigate, protect and enforce applicable law
Cyber disruption	Confirmed significant technical incident	Cyber authorities and operators	Contain disruption and restore essential functions
Energy crisis	Documented supply and price shock	Energy authorities and international institutions	Assess buffers and coordinate emergency measures
Collective defence	Qualifying armed attack under applicable treaty conditions	National governments and NATO	Consult and determine treaty-based assistance
Concurrent crises	Verified simultaneous resource demands	Governments and relevant international institutions	Coordinate priorities without presuming common adversarial direction

Policy options: authority, expected effect, implementation burden and strategic downside

The available evidence supports several defensive policy options, but their effectiveness depends on the responsible institutions and the nature of the threat. No single measure can substitute for the entire system of military readiness, criminal enforcement, cybersecurity and essential-service resilience.

Policy option	Principal authority	Expected effect	Implementation burden and time-to-effect	Reversibility	Principal downside
Strengthen intelligence-led threat assessment	National intelligence and security authorities	Better distinction between credible threats and coercive claims	Organisational coordination; improvements may begin promptly but mature over time	Procedures can be revised	Excessive collection or weak evidentiary safeguards
Improve cross-border attribution	Police, prosecutors, security agencies and competent cooperation mechanisms	More credible identification of hostile-state activity	Legal interoperability, evidence exchange and specialist capacity	Adaptable processes; investigations can create lasting commitments	Premature public attribution or disclosure of sensitive information
Exercise civilian continuity	National emergency authorities and operators	More reliable essential-service operation and recovery	Repeated exercises, staffing and contractual arrangements; benefits require testing	Plans can be revised, infrastructure changes less easily	Cost and competition for resources
Align civilian and military preparedness	National governments and NATO	Better continuity of lawful national and Allied functions	Multiyear governance, coordination and investment	Policy priorities adjustable; major procurement less reversible	Potential diversion from civilian needs if poorly managed
Improve economic-shock preparedness	National economic and energy authorities	Greater capacity to absorb temporary disruptions	Inventory policy, market monitoring and international coordination	Emergency measures generally adjustable	Fiscal expense, market distortion or ineffective intervention
Maintain credible diplomatic channels	Foreign ministries and relevant international institutions	Opportunities for restraint, clarification and de-escalation	Continuing diplomatic engagement; potentially rapid initial effects	Generally reversible	Signals may be misinterpreted as concessions or threats
Improve strategic public communication	National governments and competent agencies	Reduce confusion and prevent unsupported claims from determining public understanding	Trained personnel, evidence standards and institutional credibility	Communication can change, reputational consequences may persist	Overconfidence, excessive reassurance or loss of trust

The allocation problem: preparedness is valuable only if it changes what institutions can actually do

The strategic value of preparedness should be judged against the decisions and functions that become possible because of it. Additional funding may improve the ability of a government to maintain essential services, but only if the expenditure produces functioning systems, trained personnel, dependable contracts and tested procedures. A new security regulation can create obligations, but its effectiveness depends on implementation and supervision. An announced military procurement programme can improve expected future capability, but it should not be treated as an operational system before equipment is delivered and made available for use.

This distinction follows directly from NATO’s revised 2026 resilience requirements and its financial commitments. The documents link civilian preparedness to military planning while recognising the need for cross-government coordination and reliable resource planning. They also provide a basis for evaluating whether investments meet defined national and Alliance requirements. 2026 Resilience Baseline Requirements — NATO — Sep 2026; Defence Investment and NATO’s 5% Commitment — NATO — Jun 2026.

For the 2026–2031 period, the principal policy priority should therefore be the conversion of institutional commitments into demonstrable performance. National authorities need evidence that continuity plans work under realistic conditions, that essential functions can recover after disruption and that civilian and military responsibilities remain compatible. Such evidence is more valuable than an arbitrary comparison of defence budgets or a numerical threat rating constructed without reliable operational data.

The intelligence collection priorities for 2026–2031

The most important intelligence requirements concern developments capable of changing the strategic assessment rather than merely adding background information. A verified expansion in Iranian operational military capability would alter the conventional threat. Authenticated evidence that senior Iranian authorities had authorised a new European operation would alter the assessment of intent. New government attributions linking hostile incidents to common state direction would alter the assessment of covert activity. Documented military commitments or operational assistance from external powers would change the interpretation of Iran’s partnerships. Conversely, verified de-escalation, demonstrable reductions in hostile activity and improvements in European continuity performance would strengthen the assessment of a more manageable security environment.

These requirements should be accompanied by an explicit distinction between evidence that changes threat severity and evidence that merely changes public visibility. A new report about a previously documented capability may not represent a new capability. A newly discovered historical incident may improve understanding of an organisation without proving that it remains active. An announcement of future procurement may alter a long-term forecast without changing current readiness. The analytical process must preserve event dates, publication dates, reference periods and the status of each capability or policy measure.

Final net assessment — Europe, Iran and the transformation of strategic deterrence

The investigation across the three pillars supports a principal conclusion: Europe’s security problem in a confrontation involving Iran cannot be reduced to an assessment of missile range, nor can it be accurately described as a single coordinated campaign by Iran and its external partners. The official record supports a differentiated threat involving historical Iranian regional military capability, substantial military degradation during 2026, documented Iranian-linked hostile activity in Europe, selective external cooperation and significant economic consequences from regional conflict. Each of these components is real within its proper evidentiary limits; none establishes all the others.

The 2026 conflict demonstrated that the interaction between military operations and economic systems can produce international disruption on a major scale. The March IEA evidence is particularly important because it establishes the magnitude of an actual supply shock rather than a hypothetical vulnerability. NATO’s September resilience requirements provide an institutional response to a broader lesson: the credibility of military defence increasingly depends on the continuity of civilian functions, effective public-private cooperation and the ability of governments to recover from disruptive events.

Iran’s possible strategic choices remain constrained by its military condition, domestic pressures and the interests of other states. Russia, China and North Korea may influence the surrounding geopolitical environment, but their relationships with Tehran should be assessed according to demonstrated assistance and actual commitments rather than assumed solidarity. Covert and cyber capabilities create additional avenues for confrontation, yet incidents require competent attribution before they can support a claim of Iranian state responsibility. Public threats can shape expectations, but their political effect does not prove the operational feasibility of the military action being threatened.

European governments should therefore avoid two analytical failures. The first is to underestimate hostile activity simply because a particularly ambitious conventional threat remains unsupported. The second is to accept an adversary’s public account of its capabilities and intentions without independent verification. Both errors can distort security policy. A disciplined response preserves readiness while distinguishing established facts, official assessments, analytical judgments and unresolved propositions.

Over the five-year horizon, the most important variable may not be the frequency of threatening statements but the relative development of demonstrable hostile capabilities and European institutional resilience. If Iran reconstructs meaningful military capacity while European preparedness remains uneven, the consequences of future crises could become more serious. If European governments convert current financial and institutional commitments into tested operational resilience, the coercive value of uncertainty and disruption may decline. Neither outcome can presently be assigned a defensible numerical probability.

Final strategic judgment: Europe’s strongest position is one in which credible military deterrence, lawful counterintelligence, resilient civilian infrastructure, reliable economic contingency arrangements and accurate public communication reinforce one another. The essential measure of success is not the absence of threats, but the ability of European institutions to remain functional, make legitimate decisions and respond proportionately when threats occur. A state seeking political advantage through strategic uncertainty gains less leverage when its adversaries can separate rhetoric from capability, attribute hostile conduct accurately and sustain essential public functions despite disruption.

---

Copyright of debuglies.com – Even partial reproduction of the contents is not permitted without prior authorization Reproduction reserved