Executive Summary

Insikt Group assesses that Vladimir Putin employs several key principles when making foreign policy decisions: he often views his actions as reactions to adversarial measures that threaten Russia’s strategic interests, he tests his adversary’s strength against Russia’s, and he seeks to maximize tactical and strategic flexibility. These principles guide Putin’s foreign policy decisions, including in his undermining the unity of international institutions, permitting hacktivist activity, ordering cyberattacks or influence operations, directing sabotage or kinetic military operations, and determining the use of nuclear weapons. Western public and private entities should also note that Putin almost certainly does not consider factors that have become accepted decision-making principles among Western democratic leaders, including adherence to international law, norms, and previously signed treaties; reputation among other countries; and Russian domestic public opinion.

Putin’s foreign policy goals will almost certainly remain unchanged for the foreseeable future because they are rooted in his conception of how Russia should project power. As Putin determines whether to take high-risk actions (including kinetic military operations in western Ukraine or NATO territory) in service to those goals, he is likely to weigh several factors, including his assessment of Russia’s own military capabilities and NATO’s ability and willingness to respond forcefully. Putin is highly unlikely to launch such operations in the short- or medium-term, probably because he judges that Russia’s military capabilities are currently insufficient to make them successful. However, Putin very likely desires further territorial conquest, and his decision whether to act on that desire in the long term will almost certainly hinge on his assessment of NATO’s resolve, Russia’s military capabilities, and whether he has exhausted his non-military options.

While it is impossible to predict every Russian escalation (such as a sabotage operation or cyberattack), public and private organizations can improve their ability to anticipate when there is a higher risk of an escalation that could threaten their physical, cyber, or personnel assets. Customers can use the Recorded Future Intelligence Operations Platform to monitor official Kremlin rhetoric for signs of escalation, as well as track Western policies that might prompt Russian retaliation. Public- and private-sector organizations in countries and industries Russia often targets should consider adopting heightened cyber and physical defenses and stricter security protocols for personnel.

Key Findings

• Putin’s early experiences and pre-presidential career have almost certainly helped shape his understanding of Russian history and Russia’s proper place in the world, formulate his domestic and foreign strategic goals, and drive the high value he places on centralized power.


• Putin likely views his foreign policy actions as reactive to perceived adversary provocations threatening Russia’s strategic interests.


• Putin almost certainly engages in negotiations as a means to pursue maximalist goals and give himself the time and flexibility to calibrate his level of aggression based on his evaluation of his strength relative to his adversary.


• Putin will almost certainly continue using foreign policy actions that come with varying risks of blowback to achieve strategic goals, including undermining international institutions, conducting influence operation campaigns with and without attempted electoral manipulation, conducting kinetic hybrid operations in NATO territory, using destructive cyberattacks, and coordinating military operations in Ukraine.


• A Russian invasion of NATO territory is highly unlikely in the near term, but Putin’s appetite for further territorial conquest very likely persists, and his decision to act on this impulse will almost certainly hinge on his assessment of Russia’s military capabilities, perception of NATO’s resolve, and judgment that non-military options have been exhausted.

The Origins of Putin’s Foreign Policy Goals and Strategy for Handling Adversaries

Insikt Group assesses that Russian president Vladimir Putin’s early experiences and pre-presidential career have helped shape his foreign policy goals and the way in which he handles adversaries, as his experiences and career influenced his beliefs about Russian history and his role in shaping Russia’s future.

Russia Besieged by External Enemies

Putin’s experience growing up in Leningrad (now St. Petersburg) and his family’s experience during the Nazi siege of Leningrad –– particularly his brother’s death from starvation –– almost certainly reinforced to Putin, as it did to many Russians, that Russia is constantly under threat from powerful enemies that seek to weaken it. The fact that the Nazis failed in the siege of Leningrad likely instilled in Putin a belief that he owes it to previous generations to also succeed in defending Russia against foreign intruders. This has likely helped fuel Putin’s allegations of Nazism in Ukraine, which he has argued risks spreading if Russia does not defeat it there. In the 2025 film Russia. Kremlin. Putin. 25 years, Putin stated, “The Russian citizen understands now that … he is the final line of defense, the last authority. It’s like during the war — remember, the Great Patriotic War? Russia is vast, but there’s nowhere to retreat. Behind us is Moscow.” In the last sentence of that quote, Putin invoked a WWII-era phrase commonly used by Red Army leaders, further reinforcing the similarity Putin draws between the Second World War and what he sees as Russia’s conflict with the West.

The Tragedy of the Soviet Union’s Fall

Putin almost certainly views the fall of the Soviet Union as a tragic loss of Russian geopolitical power that needs to be corrected, and his experience as a KGB officer in Dresden helped solidify that view. Putin has called the fall of the Soviet Union “the greatest geopolitical catastrophe of the Century.” In his view, it scattered ethnic Russians across several countries and resulted in diminished Russian influence over former Soviet territories. He considers himself destined to be a “gatherer of lands” to bring those scattered people back under the Russian umbrella of power.

Putin’s KGB career likely helped convince him that the fall of the Soviet Union — an event Putin considered a tragedy — was at least in part the result of poor leadership. Putin served fifteen years as a low-level KGB counterintelligence officer, including six years stationed in Dresden. Putin was stationed at Dresden when the Berlin Wall fell. In the chaos of a newly unified Berlin, a mob encroached on the KGB station. When Putin contacted local Soviet Military Command to ask for reinforcements, the officer on duty replied that he could not assist because he had received no orders. The officer stated, “Moscow is silent.” Putin went outside the station himself and convinced the crowd to leave.

This experience almost certainly taught Putin that Mikhail Gorbachev’s policies of political reforms had weakened the Soviet Union. Putin wrote in his book, First Person, “The Soviet Union was ailing. It was a deadly, incurable disease called paralysis — a paralysis of power.” Because of this, Putin has very likely harbored a dislike toward Gorbachev and has sought to correct what he sees as Gorbachev’s failures by restoring Russia to what he views as the greatness of the Soviet Union and the Russian Empire.

Yeltsin and the Need for Centralized Power

Putin’s experience watching former Russian president Boris Yeltsin struggle to consolidate power in the 1990s almost certainly reinforced in Putin the need to centralize power in one leader for Russia to regain its global prominence. During the 1990s, Russia endured a period of chaotic transition from communism. Yeltsin failed to centralize control, instead allowing oligarchs and racketeers to co-opt the country by exploiting the rapid privatization of industry and weak rule of law to illicitly seize Russia’s economic assets in an increasingly violent and lawless environment.

Shortly after becoming President, Putin corrected what he saw as Yeltsin’s mistake by systematically eliminating competing elite power centers. For example, Putin quickly subjugated Russia’s oligarchs to his rule. In July 2000, Putin held a meeting with the oligarchs in which he told them their business interests would be safe from state interference, so long as they refrained from challenging him politically. In 2003, when Russia’s then-wealthiest man, Mikhail Khodorkovsky, who owned the gas company Yukos, violated that order by financing opposing political parties, Putin seized Yukos and imprisoned Khodorkovsky.

Putin also sought to neutralize independent media outlets. For example, on April 14, 2001, officials from state-owned energy company Gazprom seized NTV, Russia’s sole major independent television network, which at the time was owned by oligarch Boris Berezovsky. Following the takeover, Berezovsky entered exile in London, where he lived until his death in 2013.

Putin also quickly took action to reduce the rights of Russia’s regional authorities, which had historically exercised various amounts of independence, making it difficult for Moscow to exert control over Russia’s vast, eleven-time-zone territory. On May 13, 2000, Putin issued a decree dividing the 89 federal subjects of Russia into seven federal districts, overseen by Putin-named representatives. In July 2000, Putin oversaw the passage of a law that allowed him to dismiss the heads of federal subjects. In 2004, Putin replaced gubernatorial elections with direct appointment — a move he stated was necessary to curb some regions’ “separatist tendencies.”

Putin’s prioritization of centralized power almost certainly extends to his decision-making process, which involves discussing decisions with a small circle of advisors while hiding his motives. For example, when Foreign Minister Sergei Lavrov and Russian Ambassador to the US Yuri Ushakov arrived in Saudi Arabia for talks with the US regarding Ukraine and other bilateral issues in February 2025, they were surprised to find out that the CEO of Russia’s Direct Investment Fund, Kirill Dmitriev, and his team were also present. Lavrov and Ushakov were allowed to participate in the talks, while Dmitriev and his team were not. This is likely an example of how Putin keeps elite circles guessing regarding his thinking and whether they remain in good standing with him.

Putin’s decision-making, particularly when it comes to core strategic priorities such as foreign policy actions, almost certainly only involves a small circle of close advisors. According to independent Russian journalists, Putin discusses his military decision-making in Ukraine with a small handful of longtime advisors with whom he holds a weekly call. Among them are Nikolai Patrushev, whom Putin has known since the 1970s; FSB Head Alexander Bortnikov, whom Putin has also known for 40 years; Secretary of the Security Council Sergei Shoigu, who has worked for Putin since 2000; and SVR Head Sergei Naryshkin, who has known Putin since the two served in the KGB 40 years ago. Putin has likely also worked with Kremlin Chief of Staff Sergey Kiriyenko on issues including information operations related to Ukraine. However, Putin likely limits contact even with those individuals. Independent journalist Farida Rustamova stated that “Only a handful of people are allowed to see him in person and they have to be at a distance. And only very few have phone access with him. But that access is only one way, as in Putin contacts them, not the other way around.”

Putin’s closed decision-making and communication processes likely motivate elites to compete with one another for political influence, which helps prevent the formation of alternate sources of power that could challenge Putin’s political dominance. For example, Rosneft CEO Igor Sechin and his allies have had an intense rivalry with former President Dmitriy Medvedev and his allies for roughly the first fifteen years of Putin’s presidency. The rivalry persisted between Sechin’s circle of hardline, former security services officials, dubbed the “siloviki,” and Medvedev’s circle of relatively more liberal technocrats. The siloviki circle includes longtime Putin advisors such as Patrushev, Naryshkin, and Bortnikov. Medvedev’s circle primarily included members of Putin’s economic advisory team.

The rivalry between Sechin and Medvedev likely played out primarily in each man seeking to undermine not only the other’s political influence, but also the political influence of each other’s circles. For example, Sechin was instrumental in the arrest, trial, and eight-year imprisonment of Aleksey Ulyukaev, who had served as Minister of Economic Development when Medvedev was President. Sechin and the FSB organized a sting operation that led to Ulyukaev being convicted of receiving a $2 million bribe for an assessment that led to Rosneft’s acquisition of oil company Bashneft. Putin, in his then-capacity as Prime Minister, dismissed Ulyukaev from his ministerial position on the same day as the sting operation, suggesting Putin’s implicit approval of the operation. Ulyukaev served six years of his eight-year imprisonment term in a labor colony (which started in December 2017) before being released on parole in May 2022.

Similar to Soviet leaders, Putin has encouraged in-fighting and rivalries among Russia’s three intelligence services, the FSB, SVR, and GRU, particularly in the early years of his presidency, likely at least in part to prevent any one of those services from consolidating enough power to challenge his influence. Tactics for encouraging those rivalries likely have included assigning overlapping responsibilities between the services. For example, both the GRU and the FSB have responsibility for foreign operations, and the rivalry between the two has likely been especially intense. Russian research firm Riddle Russia has argued that information leaks by the FSB may have exacerbated GRU intelligence failures in 2018.

Exploiting the Enemy’s Weakness

Putin’s experience as a KGB officer almost certainly helped give him an understanding of how to identify and exploit enemies’ weaknesses. He likely uses those experiences to study his adversaries and leverage their personal vulnerabilities. For example, at a meeting in 2007, Putin had a large black dog approach German Chancellor Angela Merkel, knowing she was frightened of dogs. He also refused to speak German to her — despite being fluent — instead speaking in Russian and using an interpreter. He likely intended for this tactic to reinforce the distance between him and Merkel and force her into a more awkward way of conversing.

Putin’s Foreign Policy Doctrine

We assess that Putin’s judgments that Russia has long been besieged by external enemies motivated to weaken it and that the Soviet Union’s collapse was a tragedy have helped dictate his foreign policy objectives. His foundational goal is almost certainly to replace what he sees as US hegemony with a multipolar world order in which Russia is equal to the US and China. Putin likely views a multipolar system as a return to a balance of power that existed among superpowers during the Soviet Union’s existence.

Putin’s guiding principles for achieving a multipolar global system likely include reestablishing Russia’s historic sphere of influence, pursuing multivector relationships that maximize Russia’s strategic flexibility, and promoting Putin’s conception of Russian values, partly through exploiting Russian history.

Reestablishing Russia’s Historic Sphere of Influence

We assess with medium confidence that Putin does not seek to reestablish the Soviet Union or Russian Empire through formal territorial acquisition, as he almost certainly views there being unacceptably high financial and military costs to doing so. Instead, he almost certainly seeks to establish de facto political control over what he sees as Russia’s proper sphere of influence, achieved through a combination of Russia-led multilateral organizations, select use of military power, influence campaigns, and hybrid operations. (The precise boundaries of Putin’s desired sphere of influence are not entirely clear; however, they almost certainly involve several tiers of strategic importance to Putin.)

Putin almost certainly seeks full political control over Belarus and Ukraine, likely at least in part to maintain a geographic buffer between Russian territory and NATO member states. Putin’s second-tier priority is likely political control over NATO states he considers historically Russian, such as Poland and the Baltic states, but difficult to subdue given the high cost of invading NATO territory. Putin likely views the rest of the former Soviet Union as states over which Moscow should exert some degree of political control as part of a broader sphere of influence, though he has not articulated or implicated a desire for complete control over these states.

Multivector Relationships to Maximize Strategic Flexibility

Putin has sought to maintain relations with a wide range of states, including states on opposing sides of longstanding geopolitical conflicts, likely to maximize strategic and tactical flexibility. For example, Putin has continued Russia’s longstanding relationship with India, which extends back to at least the 1950s, while also deepening Russia’s relationship with China to the point where Beijing is currently Russia’s most significant strategic partner. Russia has achieved extensive economic, military, and geopolitical alignment with both states, despite China and India having significant geopolitical conflicts with each other. China-India tensions are rooted not only in an unresolved border dispute, but more broadly, in each state’s self-conception that it is a civilizational power, and that neither Beijing nor New Delhi acknowledges the other’s claims.

China and India almost certainly promote Russia’s strategic interests and provide Moscow with strategic flexibility by, for example, offsetting US influence, supporting Russia’s objectives at the UN, and providing Russia with alternative markets for its oil and gas, thereby helping Moscow make up for revenue gaps due to US and NATO sanctions on Russian natural resources exports.

Particularly in the last ten years, Beijing has emerged as Russia’s most important strategic partner. The Russia-China relationship is almost certainly rooted in a mutual objective to replace the US-led international system with one that affords Russia and China more influence. Chinese President Xi Jinping and Putin have met over 40 times since 2012 — more frequently than either has met with any other leader. In February 2022, China and Russia declared a “no limits partnership,” and in May 2025, Putin stated that “The comprehensive partnership and strategic cooperation between Russia and China are built on the unshakable principles of equality, mutual support and assistance, as well as the unbreakable friendship between the two states and two nations.”

Russia and China have used their veto powers on the UN Security Council to support one another’s interests at the UN, often vetoing resolutions the other opposes. Russia and China have also conducted several large-scale bilateral military exercises, likely to signal to the West that they are strategic military partners that can pose a joint military threat. In 2018, China became the first country outside the former Soviet Union to participate in Russia’s Vostok (East) military exercise, which centers around contingencies in the Pacific. The Vostok exercises in 2018 involved large-scale land and sea operations and suggested that Moscow and Beijing intended to improve bilateral military cooperation. The Vostok 2022 exercise saw a more comprehensive Chinese contingent, as it represented the first time all three Chinese military components — land, sea, and air — participated in a Russian military exercise.

China has increasingly purchased Russian oil and gas since Western sanctions went into effect on Russia in 2014, likely helping Russia offset a decline in revenue from the sanctions. On May 21, 2014, China and Russia signed a 30-year, $400 billion gas deal. Starting in 2019, Russia began selling gas to China via the Power of Siberia pipeline. A second pipeline, Power of Siberia 2, is expected to be completed by 2030. As of 2023, Russia was China’s top crude oil supplier, and China buys Russian crude oil at a price that is above the G7/EU price cap, further contributing to China’s role in helping provide Russia with sanctions relief.

India has also provided Russia with critical economic lifelines and political support. Insikt Group assesses that both countries have had close ties since at least the 1950s, when the Soviet Union used its UN veto to support India’s claims to Kashmir. Geopolitical and military cooperation between the two countries has been consistent; for example, the Soviet Union backed India in its 1971 war with Pakistan, and the two countries have held annual summits since 2000. India’s External Affairs Minister Subrahamyam Jaishankar has referred to the India-Russia relationship as the one constant in global politics over the last 50 years. In the 2023 Russian Foreign Policy Doctrine, the Kremlin described the Russia-India relationship as one of a “particularly privileged strategic partnership.”

Over the past twenty years, India has purchased roughly $60 billion in Russian weapons, amounting to 65% of its total weapons imports. India is the largest recipient of Russian arms exports, including Russia’s S400 missile defense system, which India used in May 2025 clashes with Pakistan to repel Pakistani missile attacks. India has almost certainly helped provide Russia with sanctions relief, in large part by purchasing Russian oil. Russia’s share of India’s total oil imports reached a record 44% in June 2023.

Exploitation of Russian History to Justify External Interference

Particularly in the last ten years, Putin has used his conception of Russian history –– specifically the Russian language, the Russian Orthodox Church, the Soviet Union’s victory over Nazism, and the history of the Soviet Union –– to substantiate his definition of Russia’s proper sphere of influence and justify interference in former Soviet states.

Putin and senior Kremlin officials have used false allegations that Ukrainian President Volodymyr Zelensky’s government is fascist and devoted to Nazism, undoubtedly to help justify Russia’s war against Ukraine. Following Russia’s full-scale invasion of Ukraine in February 2022, Russia-backed influence operation campaigns spread the narrative that Zelensky and his government were neo-Nazis who had taken Ukraine via a coup and were intent on propagating a genocide against Russians. Kremlin propaganda outlets argued that it was therefore the duty of all Russians to denazify Ukraine.

Putin has also argued for a version of Russian history that describes Ukraine as part of Russia, undoubtedly to imply Ukraine has no legitimate claim to sovereignty and that Russia has a historical claim to control Ukraine. In a 2021 essay, Putin wrote,

During the recent Direct Line, when I was asked about Russian-Ukrainian relations, I said that Russians and Ukrainians were one people – a single whole. These words were not driven by some short-term considerations or prompted by the current political context. It is what I have said on numerous occasions and what I firmly believe.

Putin also argued in the same essay that Ukraine as a distinct entity was created by Soviet authorities, and therefore, Ukraine ceased to exist when the Soviet Union collapsed.

Putin has also used the history of the Soviet Union and the Russian Empire, which involved changing borders and the creation of new geographic entities by Stalin and other Soviet leaders, to argue that ethnic Russians are now living in states that are simply artificial creations by Russia. Putin likely argues that the history of those former Soviet republics means Russia has at least a claim for de facto control over them.

Putin invoked his reading of Russian history to justify the annexation of Crimea and argue that Crimea had always been historically Russian. When announcing the results of the referendum he used in March 2014 to justify annexing Crimea, Putin stated:

To understand the reason behind such a choice it is enough to know the history of Crimea and what Russia and Crimea have always meant for each other. Everything in Crimea speaks of our shared history and pride ... The referendum was fair and transparent, and the people of Crimea clearly and convincingly expressed their will and stated that they want to be with Russia.

Putin has also invoked his conception of Russian values and misleading historical claims, likely to help justify why Russia has a legitimate claim to exercise influence over Poland. In a 2021 essay, Putin argued that Poland has Russian roots because the people practiced Eastern Orthodox Christianity. Putin vilified the Polish Catholic nobility who Catholicized Poland in the 16th Century. In that way, Putin argued that Polish Catholics had seized control over the Russians who lived on that land and forced them to abandon their Russian values.

Pillars of Putin’s Approach to Executing Foreign Policy Decisions

Actions Often Cast as Reactionary and in Service to Strategic Imperatives

Putin almost certainly views even aggressive foreign policy actions, including election interference and the full-scale invasion of Ukraine, as necessary responses to perceived provocations by adversaries that undermine Russia’s strategic priorities. This logic likely applied to at least three major foreign policy decisions by Putin in the last fifteen years: Russia’s attempted manipulation of the US political system beginning in 2014, Russia’s annexation of Crimea in 2014, and Russia’s full-scale invasion of Ukraine in 2022.

Putin likely views Russia’s attempted manipulation of the US political system beginning in 2014, and most notably during the 2016 US presidential election, as at least in part a response to what he views as US government attempts to interfere in Russian and Ukrainian domestic politics. While Russia’s efforts to influence US politics date back to Soviet active measures, which employed many of the same tactics Russia has used in the past ten years, such as disinformation, influence operations, and exploitation of foreign media, Russia launched a distinct campaign in 2014 to influence US politics and undermine public faith in the merits of US democracy.

Putin’s decision to launch that campaign in 2014 was likely a result of a progressive deterioration in US-Russia relations in prior years, which likely raised Putin’s threat perception of the US and reinforced his perspective that the US was seeking to undermine Russia’s geopolitical influence and Putin’s own hold on domestic power. US-Russia relations had been somewhat cooperative in Putin’s early years in office, via efforts such as cooperation in counterterrorism efforts in Afghanistan and the 2002 creation of the NATO-Russia Council. However, relations began to deteriorate in 2007 due to factors such as Putin’s allegations that NATO’s expansion into former Warsaw Pact states undermined Russia’s security, and Russia’s invasion of Georgia in 2008.

Between 2011 and 2013, US-Russia relations deteriorated even further, driven in part by Putin’s perception that US intelligence services had funded large-scale anti-regime protests across Russia in late 2011 and early 2012. The protests, which were the largest since the fall of the Soviet Union, were sparked by rigged parliamentary elections and Putin’s decision to return to the Presidency following Dmitriy Medvedev’s presidential term. Putin’s allegation that the US stoked the protests likely reflected a fear that the US was encouraging unrest in Russia that could make him vulnerable. Putin also accused then-US Secretary of State Hillary Clinton of fueling the protests. He stated, “[Opposition leaders] heard the signal and with the support of the US State Department began active work.” Putin’s sense of domestic vulnerability likely was further reinforced by low approval ratings, which were between 61 and 64% between 2011 and 2013, and a surprisingly strong showing in the 2013 Moscow mayoral election for opposition leader Aleksei Navalny.

Putin’s perception that the US was motivated to undermine Russia’s strategic interests was likely reinforced when US senior officials voiced support for pro-Western demonstrators during Ukraine’s Maidan Revolution in late 2013. US Assistant Secretary of State Victoria Nuland visited demonstrators, who were calling for the resignation of pro-Russia Ukrainian President Viktor Yanukovych. Nuland’s visit followed US Secretary of State John Kerry’s statement of support for the protestors, in which he said, “As church bells ring tonight amidst the smoke in the streets of Kyiv, the United States stands with the people of Ukraine. They deserve better.” This support likely helped motivate Putin’s accusations that the US funded the protests. Indeed, Kremlin officials commonly refer to the Maidan Revolution as a “Western-backed coup.”

Putin’s perception of his domestic vulnerability, his view that the US was manipulating Russian domestic politics to undermine him, and his judgment that the US was undermining Russian influence in Ukraine almost certainly were factors driving his decision to annex Crimea in February 2014. The decision was widely popular in Russia, quickly leading to an increase in Putin’s approval rating from the mid-60s to roughly 89%. The decision also almost certainly made Ukrainian admission to NATO infeasible; NATO officials have stated that Ukraine cannot be admitted to NATO if they are in a state of war. As such, the annexation served Putin’s goal of keeping Ukraine within Russia’s sphere of influence.

Shortly after Putin’s annexation of Crimea, Russia began a multifaceted influence campaign to undermine faith in US democracy and influence US politicians to support Moscow’s strategic goals. Yevgeny Prigozhin’s Internet Research Agency, which played a key role in Russian influence operations targeting the 2016 US presidential election, launched in 2014. This campaign culminated in Russia’s attempted manipulation of the 2016 US presidential election, which Putin likely ordered in part to prevent the US from continuing what he saw as attempted manipulation of Russian and Ukrainian politics.

In 2017, the US Intelligence Community (IC) assessed in an ICA that Russia’s goals in that electoral interference campaign “were to undermine the public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency.” In that paper, the IC also “assessed Putin and the Russian Government developed a clear preference for President-elect Trump … [and] aspired to help President-elect Trump’s election chances when possible by discrediting Secretary Clinton and contrasting her unfavorably to him.” CIA and FBI expressed high confidence in this judgment; NSA expressed moderate confidence. On July 3, 2018, the Senate Select Committee on Intelligence (SSCI) released the findings of a bipartisan investigation into the 2017 IC assessment. SSCI concurred with all of the judgments in the 2017 ICA and concluded that the ICA was done in an apolitical, objective manner. In 2025, ODNI released a report alleging that the 2017 ICA was completed under an unnecessarily truncated timeline and called into question the sourcing underlying the IC’s assessment that Putin developed a preference for President-elect Trump.

Following the annexation of Crimea, Putin continued his incursions into Ukraine by launching what he termed a “special military operation” in eastern Ukraine. Putin argued that this campaign was necessary to protect ethnic Russians living in eastern Ukraine from alleged neo-Nazi activity. On May 11, 2014, pro-Russian separatists organized almost certainly rigged referendums in Donetsk and Luhansk regarding whether to declare those regions sovereign entities. Moscow claimed 89.07% of Donetsk residents and 96.2% of Luhansk residents voted for sovereignty and thus declared the Donetsk People’s Republic and the Luhansk People’s Republic.

Fighting continued at roughly a steady pace between 2014 and 2021, with little territorial gains on either the Russian or Ukrainian sides. Putin almost certainly views the full-scale invasion of Ukraine in February 2022 as necessary to protect Russia from the threat that would come from Ukraine joining NATO — a threat Putin almost certainly viewed as increasingly likely to materialize starting in 2020. In June 2020, Ukraine gained NATO Enhanced Opportunity Partner status, and in September 2020, President Volodymyr Zelensky approved Ukraine’s new National Security Strategy, which included the aim of joining NATO. In April 2021, Russia began large-scale military drills and deployed 110,000 troops to the Russia-Ukraine border, in the preliminary steps to Moscow’s invasion.

Evaluation of Enemy’s Strength and Incremental Increase in Aggression

Putin’s past high-risk actions suggest he incrementally increases his level of aggression against adversaries, likely at least in part to evaluate his adversary’s response and to slowly wear his adversary down. Putin likely determines whether to escalate further by assessing his ability to absorb the military, economic, or political cost of his adversary’s response.

For example, despite Putin’s longtime desire to control Ukraine, he did not order a full-scale invasion — or what Putin calls a “limited special operation” — of the country until February 2022. Instead, in February 2014, he annexed Crimea and ordered a small-scale, officially undeclared military operation in eastern Ukraine. In addition to the factors discussed above, this was likely to prevent Ukraine from joining NATO and to ensure Russian port access in Crimea, Russia’s only warm water port, via a limited incursion that allowed Putin to evaluate Western response.

Russia’s annexation of Crimea represented the first formal territorial acquisition by Russia since the fall of the Soviet Union. Given the unprecedented nature of the move, Putin likely sought to assess Western response, which included broad sanctions on Russian individuals and entities, before escalating further. On the first anniversary of the Crimea annexation, Putin delivered a speech in which he described Western sanctions as “not fatal,” suggesting he considered them an acceptable cost to the Crimea annexation. Putin’s actions following the annexation reinforced this calculus, as he increased undeclared military presence in eastern Ukraine throughout 2014 and ultimately illegally annexed four eastern Ukrainian regions in May 2014.

Putin’s decision to launch a full-scale invasion of Ukraine in February 2022, in which he acknowledged Russian troop presence, likely stemmed in part from a calculus that Russia had borne acceptable costs for its aggression between 2014 and 2022, including not only the annexation of Crimea and several eastern Ukrainian regions, but also Russia’s interference in US elections beginning in 2014. In June 2022, Medvedev described Western sanctions against Russia as a “cause for war,” suggesting that far from deterring Russia, the Kremlin felt emboldened to use sanctions as a reason for escalation.

We assess that Putin also generally avoids taking high-risk actions that represent a significant, non-incremental escalation, and determines his level of aggression based on the extent to which he judges an adversary poses a threat to his interests. Putin’s reaction to the assassination of opposition leader Boris Nemtsov in 2015 is illustrative of this aspect of his risk evaluation. Nemtsov was shot outside the Kremlin by a perpetrator who has yet to be identified. At the time of his murder, Nemtsov was no longer an influential figure in Russian politics. Contemporaneous public reporting suggests Putin was angered by Nemtsov’s murder, which likely stemmed from the fact that, at the time of his murder, Nemtsov was no longer a particularly influential opposition politician. Thus, Putin likely calculated that killing Nemtsov risked sparking domestic backlash without the benefit of eliminating an influential opposition leader.

Putin’s reaction to the assassination of opposition journalist Anna Politkovskaya in 2006 is another example of how Putin likely avoids taking high-risk actions unless the benefit outweighs the potential costs. When asked about Politkovskaya’s murder, Putin stated,

This journalist was indeed a sharp critic of the present Russian authorities … but the degree of her influence over political life in Russia was extremely insignificant. She was well-known in journalistic circles, among human rights activists, in the West. I repeat, her influence over political life in Russia was minimal. And in my opinion murdering such a person certainly does much greater damage from the authorities' point of view, authorities that she strongly criticized, than her publications ever did.

Maximizing Strategic Flexibility

Putin almost certainly seeks strategic flexibility, likely so he can pivot tactics to avoid losing ground relative to Russia’s adversaries. Putin likely seeks this flexibility in part by taking simultaneous multitrack actions. For example, from early through at least mid-2025, Putin has claimed to be interested in negotiating peace with Ukraine, while also waging aggressive military assaults against Ukrainian forces. This strategy likely allows Putin to cast himself as supportive of peace and argue that he is continuing to fight because Kyiv refuses to negotiate.

Putin also likely maintains strategic flexibility by maintaining multivector relations, including with states on opposing sides of geopolitical disputes. For example, Russia has maintained ties with Iran and Israel, despite those two countries’ decades-long geopolitical rivalry. Moscow and Tehran have had a strong, strategic partnership since the fall of the Soviet Union, likely premised on shared opposition to US global influence, economic and military cooperation, and Russian assistance with Iran’s civilian nuclear program. For example, Russia built Iran’s Bushehr nuclear plant, and the two had shared interest in supporting former Syrian president Bashar al-Assad during the Syrian civil war, which began in 2011. Since Russia’s full-scale invasion of Ukraine in February 2022, Iran has become an increasingly important military partner, most notably by supplying drones and missiles and by assisting Russia in circumventing Western sanctions.

Moscow has almost certainly sought to balance its strong, consistent ties with Iran with maintaining ties with Israel. Though the Russia-Israel relationship has been uneven, the two states have sought pragmatic coordination since 1991, when Soviet backing of Arab states gave way to a USSR-Israel detente. Russia’s strong coordination with Iran likely limits the extent of cooperation between Moscow and Israel; however, the two have emphasized shared regional interests, such as countering Asad. During the 2025 Israel-Iran conflict, Putin likely sought to showcase his regional flexibility in the Middle East by calling Israeli Prime Minister Benjamin Netanyahu and Iranian president Masoud Pezeshkian and offering to act as a mediator. A Kremlin readout of Putin’s calls with the two leaders noted, “It was agreed that the Russian side will continue close contacts with the leadership of both Iran and Israel, aimed at resolving the current situation.”

In addition, Putin’s use of undeclared special forces to carry out operations in places such as Africa likely is part of his effort to maintain strategic flexibility. Not acknowledging those operations likely allows Putin plausible deniability, should the operations not succeed, or if Putin calculates the operations could undermine Russia’s interests if conducted overtly. Putin deputized Wagner Group, a group not formally connected to the Kremlin, which has been replaced by Africa Corps, to conduct influence operations and military special operations across Africa on behalf of Russia.

Rejection of Western Norms

We assess that Putin generally does not operate in accordance with Western geopolitical norms, including by adhering to international law and treaties and conducting negotiations to end conflicts. Putin has implied that the international legal system is, in fact, the US imposing its will on the globe. For example, in a 2007 speech in Munich, Putin stated, “Independent legal norms are, as a matter of fact, coming increasingly closer to one state’s legal system.”

Instead of complying with Western legal norms, Putin likely views treaties and the appearance of negotiations as tools for influencing his adversaries. Putin has violated treaties several times in recent years. For example, the annexation of Crimea represented a violation of the Budapest Memorandum, which Russia signed in 1994 and which stipulated that Russia would respect Ukraine’s sovereignty and borders. Russia has also repeatedly violated the Minsk Agreements, which outlined a ceasefire deal that was intended to end hostilities between Russia and Ukraine in eastern Ukraine.

Putin almost certainly views negotiations not as a conversation in which opposing sides compromise to end a conflict, but rather as a tool for projecting strength to his opponent and maintaining a narrative that Russia is a rational actor interested in peace. For example, Putin has repeatedly stated he is prepared to negotiate an end to the Russia-Ukraine war, while maintaining maximalist demands he likely knows are unacceptable to Kyiv, including Ukraine never joining NATO, Ukrainian withdrawal from Russia-occupied territories in eastern Ukraine and Crimea, and Ukraine committing to a neutral, non-aligned, non-nuclear status. When Kyiv rejects those demands and continues to fight, Putin has stated that Kyiv is not interested in peace or genuine negotiations. Putin likely uses this approach to project strength, give himself time and flexibility to ramp up military aggression, and cast himself as interested in peace and Kyiv as only interested in fighting.

Putin’s Calculus for Taking Select, Increasingly High-Risk Actions

When Putin decides to take foreign policy actions, he likely operationalizes the above-described pillars, including casting decisions as reactionary, evaluating his enemy’s strengths relative to his own, maximizing strategic flexibility, and rejecting Western norms. Putin likely proceeds incrementally up a ladder of escalatory foreign policy actions that carry with them increasingly more risk of blowback, as he pursues his foreign policy goals.

Exploiting Procedures to Undermine International Institutions

Putin likely considers exploiting Russia’s membership in international institutions to stonewall actions he considers contrary to Moscow’s interests to be a low-risk but effective way to undermine his adversaries’ ability to respond to Russia’s actions collectively, assert Russian strength, and promote a multipolar world order. Russia’s voting behavior at the UN since its founding in 1946 has shown consistent efforts to exploit Russia’s status as a permanent Security Council member to prevent the UN from passing resolutions that undermine Russia’s strategic interests. Since 1946, the Soviet Union/Russia has exercised its veto power more than 140 times — more often than any other Security Council member. Russia has escalated this practice under Putin, vetoing 37 UN resolutions, which is more than all other Security Council members combined. Putin almost certainly views the resolutions Russia has vetoed, including one strengthening nuclear non-proliferation measures and those criticizing the actions of Russian ally and Syrian president Bashar al-Assad during the Syrian Civil War, as undermining Russia’s strategic interests.

While the UN is the international institution Russia has most often procedurally undermined; for example, Moscow exploited its membership in the World Health Organization (WHO) to prevent Ukraine from joining the WHO’s Executive Board in 2023. Russia called the ballot process for determining executive board members “merely procedural and not an election, since the member-states cannot vote against any single candidate in the ballot.” Russia’s efforts were not successful, as 123 member states supported Ukraine’s bid.

Low-Sophistication Hacktivist Attacks

Putin likely considers hacktivist attacks a way to register Russia’s opposition to an adversary’s action with relatively low risk of retaliation. Though Putin and the Kremlin likely do not directly control pro-Russia hacktivist groups, Putin almost certainly allows this activity to continue because it allows Russia to voice its discontent with adversaries’ actions in a low-risk, deniable way. Attacks include distributed denial-of-service (DDoS), ransomware, doxxing, and website defacements, and the resulting damage can vary widely depending on the vulnerability of the target and the importance of affected infrastructure and data.

Hacktivist attacks by pro-Russia hacktivist groups loosely connected to the Kremlin have surged since Russia’s full-scale invasion of Ukraine in February 2022. These attacks often target Russia’s adversaries after they take actions undermining Russia’s strategic interests, further reinforcing that these attacks likely are useful for Putin as a way for Russia to register its discontent. For example, on February 19, 2024, pro-Russia hacktivist groups NoName057(16) and the Russian Cyber Army launched DDoS attacks against Japanese government websites after Japan offered support for Ukraine (including a Japan-Ukraine conference in which the Japanese Prime Minister expressed his commitment to supporting Ukraine in its reconstruction), causing temporary website outages.

Malign Influence Operations

Putin likely views influence operations that do not seek to manipulate elections as a relatively low-risk way of undermining public faith in Western democracy, exploiting fractures within the populations of democratic countries, exacerbating divisions among Western democratic states, and promoting pro-Russia narratives. The near-constant dissemination of disinformation by Russian state cyber units since the Soviet period suggests Putin and his predecessors view disinformation as a core part of their strategy for undermining adversaries, as opposed to a high-risk action to be used selectively.

Soviet active measures campaigns targeted Western states in similar ways to Russian influence operation campaigns under Putin. Soviet intelligence services used a wide range of tactics, including forged documents, disinformation, political influence campaigns, and Soviet-controlled front groups in campaigns meant to advance Soviet interests. Specific campaign goals were also similar to Putin-era campaigns and included influencing the policies of the United States, undermining public confidence in US leaders and institutions, disrupting relations between the US and its allies, and propagating the notion that the US is not a force for good in the world.

Influence operations under Putin have had similar goals to Soviet active measure campaigns and have used similar tactics. For example, a large-scale influence campaign called Döppelganger used cloned websites, fake articles, and social media manipulation to promote pro-Russia narratives and shape Europe’s media landscape. Examples of cloned websites include nato[.]ws, which Russia used to mimic the official NATO website and publish forged press releases alleging claims such as that NATO members had agreed to double the alliance’s military budget and were considering deploying Ukrainian paramilitary troops to France to suppress protests.

In addition, Operation Overload, also known as Matryoshka or Storm-1679, has used a range of tactics to manipulate public opinion in Western states in favor of Russian strategic interests. Tactics include impersonating reputable media outlets and using AI-generated content such as deepfakes and voice cloning to make materials appear authentic. Campaigns under this operation have included using deepfakes of Moldovan government officials to generate videos in which the officials cite Operation Overload materials as though they are credible and authentic. Moreover, in June 2025, inauthentic social media accounts attributed to Operation Overload impersonated journalists from Euronews and Politico and shared edited front pages of international newspapers claiming Ukraine is responsible for a June 1, 2025, train derailment in Russia, almost certainly to undermine public opinion of Ukraine.

Electoral Interference

Putin likely views influence operations that include attempted electoral manipulation as high risk, as these campaigns aim to directly undermine the democratic process of target countries and thus risk greater blowback. The fact that Putin refrained from attempting to manipulate US elections until 2014, and likely only in response to what he saw as the US attempting to support anti-regime protests in Russia and Ukraine, reinforces his probable calculus around the risk of electoral manipulation.

Putin likely has directed Russia’s state cyber units to leverage access to social media platforms and networks of proxies across Europe and the US to prop up pro-Russia politicians and parties. He likely emphasizes shaping electoral politics in countries that are either in Russia’s traditional sphere of influence (to prevent Russia’s influence from backsliding) or countries with pivotal roles in shaping NATO policy, including Germany, France, and the US.

Recent Russian attempts at electoral manipulation showcase the risk of blowback and the difficulty in successfully shaping electoral outcomes. Following Russia’s attempted interference in the 2016 US presidential election, the US launched an FBI investigation that resulted in a grand jury indictment of twelve Russian military intelligence officers, imposed broad sanctions on the GRU and FSB for their role in the operation, and imposed sanctions and travel bans on additional entities and individuals, including the Internet Research Agency and its founder, Yevgeny Prigozhin. Russia interfered in Moldova’s November 2024 presidential election via a $104 million campaign that included a vote-buying scheme organized by fugitive Moldovan oligarch Ilan Shor on behalf of pro-Russia candidate Aleksandr Stoianoglo. Despite these efforts, however, pro-Europe candidate Maia Sandu won the election.

Russia also unsuccessfully attempted to influence Romania’s 2024 presidential election. A Russian influence campaign primarily on TikTok and with over $1 million in funding likely helped pro-Russia, anti-NATO candidate Calin Georgescu win a surprise victory in the first round of the election. However, authorities discovered this interference, annulled the results, and detained Georgescu. Romania held another election in May 2025 and elected pro-Western candidate Nicusor Dan.

Insikt Group assesses that the difficulty of successfully manipulating elections and the risk of blowback or annulment of manipulated results reinforces the risk of this tactic. However, Putin is unlikely to reconsider attempting to manipulate elections, as he almost certainly judges that installing pro-Russia candidates is critical for influencing policy, undermining faith in institutions and political parties, and exacerbating socio-political fissures in targeted countries. Instead, he is likely to order Russian influence entities to employ tactics with greater plausible deniability, such as coopting local journalists to propagate messages and using more sophisticated techniques to impersonate accounts and individuals.

Sabotage Operations against Public and Private Entities in NATO Territory

Insikt Group assesses that Putin increasingly views physical sabotage operations against NATO states as an integral part of his strategy for weakening his NATO adversaries and making it more difficult for them to undermine Russia’s strategic interests, particularly in Ukraine. Putin likely views these operations as a way to execute a shadow war against NATO without risking invoking Article 5 by launching an overt, conventional war against NATO states.

Between February 2022 and December 2024, the Helsinki Commission tracked 150 cases of Kremlin-backed hybrid operations in NATO territory. This is almost certainly a low estimate, as it includes only those incidents that have been attributed to Russia. NATO Secretary General Mark Rutte stated in December 2024 that NATO needed to adopt a “wartime mindset” due to Russia’s hybrid operations, arguing, “Hostile actions against allied countries are real and accelerating. These attacks are not just isolated incidents. They are the result of a coordinated campaign to destabilize our societies and discourage us from supporting Ukraine.”

Putin almost certainly does not directly oversee all state-ordered sabotage operations; however, he likely has communicated broad target sets and modus operandi to the state units that have responsibility for these operations, including GRU Unit 29155 and the Special Tasks Department (SSD). The SSD –– which was formed in 2023 in response to Western military aid to Ukraine –– has been charged with organizing assassinations and sabotage, infiltrating Western companies and institutions, and recruiting foreign agents.

Over the past year, Putin has demonstrated a willingness to have Russian state sabotage units increasingly target military and civilian spaces in Western European states such as Germany and France, often via individuals either paid by Russian intelligence services or independently motivated to carry out pro-Russia attacks. Moving forward, Putin is likely to be more willing to encourage sabotage operations against Western European military and civilian infrastructure if NATO provides additional support to Ukraine, and as NATO pursues its plans to increase military spending.

Offensive Cyber Operations

Insikt Group assesses that Putin views offensive cyber operations, including the deployment of malware and other destructive cyberattacks, as an effective way to augment Russia’s military operations in Ukraine, degrade supply lines from NATO states to Ukraine, and gain insight into NATO and Ukrainian plans and intentions.

Putin has used Russia’s state cyber units to launch cyberattacks against Ukraine in support of Russia’s kinetic military operations. For example, in January 2022, GRU Unit 29155 launched WhisperGate, a wiper malware attack that overwrote the master boot records of Ukrainian government systems. In December 2023, Russian APT group Sandworm launched an attack against Kyivstar Telecom, which disrupted mobile and internet services in Ukraine, thereby degrading air raid warning systems and other critical services.

In December 2023, Ukraine’s Computer Emergency Response Team (CERT-UA) reported that Russian state cyber unit APT28 was targeting entities in Ukraine and Poland with phishing campaigns in an attempt to leverage previously unseen malware. APT28 used MASEPIE to load PowerShell scripts called Steelhook to steal Chrome browser-based data, which APT28 sent to its C2 server. To establish persistence on the infected system, MASEPIE loaded a backdoor called OCEANMAP that allowed for discreet command execution. The European Cyber Conflict Research Initiative noted that this campaign demonstrated APT28’s ability to rapidly deploy multiple stages of an attack before detection.

Putin has also demonstrated a willingness to target NATO states with offensive cyber operations, likely in part to disrupt supply chains and aid to Ukraine in a way that avoids invoking Article 5. For example, in May 2025, GRU Unit 26165 hacked border security and surveillance cameras in Ukraine and neighboring countries to monitor and hinder the transfer of aid from NATO states into Ukraine. GRU Unit 29155 has targeted critical infrastructure in NATO states, including government services and energy infrastructure.

Insikt Group assesses that Putin has used Russia’s cyber-espionage capabilities to gather information from Ukrainian systems that serve Russia’s war aims. For example, on September 4, 2023, CERT-UA reported a phishing campaign in which BlueDelta leveraged Headlace information-stealing malware to target critical energy infrastructure in Ukraine. Throughout three phases, BlueDelta used phishing emails, legitimate internet services, and living-off-the-land binaries to extract intelligence from key networks across Europe.

Kinetic Military Campaigns

Putin likely views military campaigns as high-risk actions; nonetheless, he is willing to undertake them when he judges he is losing influence in a strategically important state and the costs of invasion are bearable. All of Putin’s invasions — Georgia in 2008 and Ukraine in 2014 and 2022 — have followed large-scale, pro-West protests that resulted in the replacement of a pro-Russia leader with a pro-West leader. This suggests Putin’s decision to invade a state is likely precipitated by a perception that he is losing influence over territory that could act as a physical buffer between Russia and NATO.

Insikt Group assesses that Putin’s military actions against other states have escalated in intensity since his invasion of Georgia in 2008, which was his first foreign military incursion. Russia’s operation against Georgia in 2008 was a short-lived operation in which Moscow sought to assert its influence over Georgia following the 2003 Rose Revolution, which resulted in the ouster of pro-Russia leader Eduard Shevardnadze and the election of pro-West Mikheil Saakashvili. Russia’s casualties were limited in this conflict to 67 servicemen. The conflict resulted in Russia exercising de facto control over two breakaway, disputed territories — South Ossetia and Abkhazia — but Russia did not claim to annex any territory.

Putin’s annexation of Crimea in 2014 almost certainly represented an escalation in aggression, relative to his incursion into Georgia, because Putin claimed to have formally annexed territory. Putin cast the annexation of Crimea as necessary after the pro-West Maidan revolution, which he called a coup:

Those who opposed the coup were immediately threatened with repression ... In view of this, the residents of Crimea and Sevastopol turned to Russia for help in defending their rights and lives, in preventing the events that were unfolding and are still underway in Kiev, Donetsk, Kharkov [Kharkiv] and other Ukrainian cities.

By invoking Donetsk and Kharkiv in this speech, Putin also articulated his justification for interfering in eastern Ukraine, which he claimed was necessary to protect ethnic Russians there.

In Putin’s March 2014 speech, he also alleged repression of ethnic Russians in Kyiv, thereby beginning to build a justification for what would be his full-scale invasion of Ukraine in February 2022. However, Putin almost certainly did not have the troop mobilization for such an invasion in 2014. He likely also had not yet made a decision to invade. While it is nearly impossible to determine with high confidence why Putin decided to launch a full-scale invasion, he likely did so because of the actions Ukraine took in 2020 to integrate into NATO. In June 2020, Ukraine gained NATO Enhanced Opportunity Partner status, and in September 2020, President Volodymyr Zelensky approved Ukraine’s new National Security Strategy, which included the aim of joining NATO. In April 2021, Russia began large-scale military drills and began massing 110,000 troops on the Russia-Ukraine border, in preliminary steps to Moscow’s invasion in February 2022.

Moving forward, Putin is likely to make decisions about where to invade based on a combination of targeted states’ actions towards integration with the West, Putin’s assessment of Russia’s own capabilities, and Putin’s calculation regarding likely NATO retaliation. While it is impossible to predict fully where Putin might intervene, examining his views regarding former Soviet states — particularly Poland and the Baltic States — suggests they are likely more probable targets than states without historically Russian populations. In February 2025, Danish intelligence services assessed that, should Putin view NATO as weak and not committed to Article 5, he could be willing to invade the Baltic States or Poland within five years of the Ukraine war ending or becoming a frozen conflict.

Putin’s assessment of Russia’s military capabilities is nearly impossible to ascertain with open sources; however, the fact that Russia’s current military operations in Ukraine lean heavily on drone attacks and that he has not made another attempt to take Kyiv following his failed attempt in February 2022 suggests Putin likely judges he does not currently have the military capability to restart broad-scale, personnel-heavy operations outside of eastern Ukraine at this time.

Nuclear Weapons Usage

Insikt Group assesses that Putin will almost certainly not launch tactical or strategic nuclear weapons, even in an all-out war with a nuclear peer state or organization, including the US, NATO, or China. Putin has refrained from placing nuclear weapons on formal heightened readiness, despite Ukraine launching drone attacks at Moscow and a half-dozen Russian military bases, strongly suggesting that even a direct attack in Russian territory is not sufficient for Putin to even ready his nuclear weapons for imminent use.

Russia does not mention proactive use in its nuclear doctrine documents. Russia’s Nuclear Deterrence Policy states that Moscow could launch a nuclear strike in response to a nuclear or weapons of mass destruction (WMD) strike on Russia or one of its allies, a conventional attack that threatens the existence of the Russian state or its territorial sovereignty, ballistic missile launches targeting Russian territory, or attacks on Russia’s core military command and control structures. Russia’s Nuclear Deterrence Policy also specifies that an attack from a non-nuclear state only triggers nuclear weapons use if that state’s attack is supported by a nuclear state. This is consistent with Mutually Assured Destruction and Rational Deterrence Theory, which states that nuclear actors signal the intention of conducting retaliatory strikes largely to deter other nuclear powers from striking them. In this way, nuclear weapons use is rendered exceptionally unlikely by all parties.

Putin is undoubtedly aware of the catastrophic damage Russia would suffer in a nuclear war and the near guarantee of radiation exposure in Russian territory following a strike on continental Europe. Thus, we assess that using a tactical or strategic nuclear weapon would be tantamount to suicide for the Russian state, especially if the adversary is capable of responding with a retaliatory nuclear strike.

Using a strategic or tactical nuclear weapon would almost certainly require Russia’s very existence as a state to be in jeopardy, likely due to all-out war by a peer state or entity, such as the US, NATO, or China. Even then, Putin would have to calculate that nuclear war, with its virtual guarantee of retaliatory strikes that devastate Russia as well as its adversaries, is preferable to continuing to fight conventionally or surrender. Given that Putin has shown no indication of glorifying nuclear weapons use or being an irrational actor, and since there have been no publicly observable indicators that he has placed his nuclear weapons on formal high alert, even after direct attacks by Ukraine (supported by NATO) on Russian territory, it is almost certain that Putin will refrain from using nuclear weapons, even during an all-out war.

Insikt Group assesses that Russia’s nuclear weapons arsenal acts primarily as a deterrence tool for Putin. He likely uses threats of nuclear weapons and changes to Russia’s legal thresholds for usage to try to dissuade the US and NATO from escalating aggression against Moscow. Since February 2022, Putin has threatened to use nuclear weapons, although Insikt Group has not identified any evidence that he has taken concrete steps to prepare his arsenal for imminent use. For example, at the end of February 2022, Putin announced he would lower the legal threshold for using nuclear weapons, a change he codified in November 2024. At the same time, Putin also ordered his strategic deterrence forces to be placed on a “special regime of combat duty,” but did not formally raise Russia’s level of nuclear readiness. Instead, Putin kept his nuclear forces at their baseline alert level, which in the Russian system is called “constant combat readiness.” In July 2024, Russian forces held tactical nuclear exercises, likely to signal to NATO Russia’s alleged preparedness to use tactical nuclear weapons.

Additional ways Putin could use his nuclear capability to dissuade Russia’s adversaries from escalating military aggression against it include resuming nuclear tests, which Putin has threatened; incorporating nuclear weapons use into Russia’s standard annual military exercises; and significantly expanding the number of deployed strategic warheads beyond the 1,550 warhead limit imposed by the New START treaty, from which Russia withdrew in 2023.

Recommendations for Monitoring Putin and the Kremlin to Better Anticipate Escalation and Protect Cyber and Physical Assets

It is impossible to anticipate every escalatory step Putin might take; however, public and private sector organizations can improve their ability to anticipate escalation by leveraging the Recorded Future Intelligence Operations Platform and open sources to systematically monitor Putin and senior Kremlin officials’ rhetoric and track Western actions that often prompt Russian aggression. Organizations in locations or industries particularly vulnerable to being targeted with Russian cyber or sabotage operations should take extra precautions, as outlined below.

Committing to these steps increases the likelihood that organizations are able to detect when an escalation may be imminent and take necessary precautionary measures to protect physical assets, cyber networks, and people.

Cyber Precautionary Measures:

• Move SOC analysts to 24/7 coverage.


• Increase frequency of log reviews and threat hunting sweeps.


• Prioritize processing of alerts related to known adversary TTPs (for example, MITRE ATT&CK mapping for known Russian APT groups).


• Remove non-essential administrative rights until the threat subsides.


• Require all accounts to reauthenticate with multi-factor authentication.


• Enhance network connectivity monitoring to any third-party suppliers that have cyber or physical presence in the targeted area.


• Accelerate patching of high-priority vulnerabilities.


• Enable the strictest phishing filtering policies for inbound emails from external servers.


• Geo-block internet traffic from Russia if possible.


• Coordinate with local law enforcement, including by sharing threat reporting.

Facilities Preparedness Measures:

• Restrict facility access to essential personnel only.


• Increase the frequency of external and internal perimeter patrols by security personnel.


• Ensure all CCTV cameras are operational and cover entry and exit points, power sources, communications, and HVAC systems.


• Ensure CCTV and alarms are on isolated, secure networks.


• Monitor live feeds in real time during heightened alert periods.


• Test backup generators.


• Ensure there are tamper-evident seals on critical network and power components.


• Review evacuation and lockdown procedures.


• Ensure staff know how to identify and report suspicious activity near key facilities.

Measures to Protect Personnel:

• Remind all staff of procedures on how to identify and report suspicious emails, texts, and calls.


• Provide secure transport for high-level staff in high-risk regions.


• Review evacuation procedures.


• If in a particularly high-risk region and if in receipt of reporting that a physical sabotage operation is imminent, consider moving critical staff to a safe room.


• Remind staff of how to notice and report tailing, photographing, or unusual questioning, to help protect against Russian intelligence operations.

Monitoring Rhetoric by Putin and His Proxies

Putin regularly makes statements that provide insight into his thinking and plans. Monitoring these statements and those of several key officials who speak on his behalf can help public- and private- sector organizations anticipate when Putin might be signaling an intent to escalate.

Customers should use the Recorded Future Intelligence Operations Platform to read Insikt Group reporting and analysis on Putin, as well as monitor mentions of Putin in the sources Recorded Future collects. Customers can also use the Recorded Future Intelligence Operations Platform to monitor individuals who regularly speak on Putin’s behalf, including Kremlin spokesman Dmitriy Peskov, Russian Foreign Minister Sergey Lavrov, and Russian Foreign Ministry spokeswoman Maria Zakharova.

Interested parties should also read English-language translations of major addresses by Putin, as they nearly always contain indications of Putin’s threat perception and preparedness to escalate. The following are examples of regular times Putin makes speeches, and the next scheduled iteration of that speech.

• Annual Address to the Federal Assembly (February or March 2026)


• “Direct Line with Vladimir Putin,” a press conference in which Putin answers questions from citizens (mid-December 2025)


• New Year’s Address (December 31, 2025)


• Victory Day Speech (May 9, 2026)


• St. Petersburg Economic Forum (June 3-6, 2026)

Lavrov, Peskov, and Zakharova also speak regularly, although their schedules are not always known in advance. Peskov, for example, does not have a regular schedule for press conferences, though he makes statements multiple times a week that directly reflect Putin’s thinking; Zakharova holds a press briefing roughly every week, usually on Wednesdays or Thursdays; and Lavrov does not have a regular speaking schedule but makes regular public statements that describe Russian foreign policy priorities. Lavrov also makes a major speech every January that lays out Russia’s foreign policy goals for the year.

The English-language versions of Russia’s wire services –– TASS and Interfax –– are the best sources for Peskov’s statements. The Kremlin’s English-language website has translations of all of Putin’s speeches. The English-language version of Russia’s Ministry of Foreign Affairs website has translations of Lavrov’s and Zakharova’s statements and press briefings.

While reading these speeches and statements, organizations should take note of language that implies Russia is looking to justify continued aggression, even as the Kremlin claims to be committed to peace. Organizations should also take note of times when senior Kremlin officials describe Western states’ policies as “hostile” or part of an “anti-Russia agenda,” as these statements have in the past preceded aggression by Russian state or Russia-aligned cyber and sabotage threat actors.

Organizations should note language such as “Russia is always open to negotiations and desires peace, but the root causes of the conflict must be addressed.” This sort of language suggests the Kremlin is working to justify continued aggression in Ukraine and is, in fact, not committed to de-escalation.

For example, in April 2025, Peskov stated, “The [Russian] president remains open to political and diplomatic methods of resolving this conflict,” but that the root causes of the conflict cannot be resolved quickly. The term “root causes” refers to the Kremlin’s allegation that the conflict was started by a Western-backed coup in Kyiv that installed Zelensky, and that, therefore, a lasting peace cannot be achieved without Zelensky resigning and Ukraine vowing to never join NATO.

Interested parties should also note instances where Putin or his proxies refer to policies passed by other countries as “hostile” or part of an “anti-Russia agenda,” as those statements sometimes presage aggression by Russia-nexus cyber threat actors who aim to amplify Russian interests.

In late April 2022, for example, Putin condemned the decision by Romania and other European countries to supply military aid to Ukraine by stating, “If someone intends to intervene in the ongoing events from the outside, and create strategic threats for Russia that are unacceptable to us, they should know that our retaliatory strikes will be lightning-fast.” Within one day of that statement, pro-Russia hacktivist group Killnet launched a series of DDoS attacks against Romanian government websites.

Finnish security authorities also noted a surge in Russian cyber-espionage activity in the second half of 2022 after Peskov called travel restrictions imposed on Russian citizens by countries such as Finland examples of the “anti-Russian agenda” in August.”

Beyond monitoring statements by Putin and his proxies, organizations can gain insight into Kremlin priorities and whether the Kremlin is preparing domestic audiences for future aggression by watching Russian state television’s signature weekly news program, Vesti Nedeli. This program, which has aired every Sunday evening since it premiered on September 16, 2001, constitutes direct Kremlin messaging and is available with English subtitles.

Taking Note of Western Actions That Often Prompt Russian Aggression

In recent years, Russian escalation — especially hacktivist attacks and sabotage operations — have often followed or been concurrent with Western actions the Kremlin views as undermining Russian interests. Public- and private-sector entities, especially those in EMEA, should consider adopting heightened security measures during those times. This includes increased cyber DEFCON levels and perhaps enhanced physical security measures if entities are operating in frequently targeted areas or sectors.

Russia-nexus cyber threat actors often time their attacks to coincide with Western actions they see as undermining Russian interests, such as the passage of sanctions packages, travel bans on Russian government officials, new aid packages for Ukraine, restrictions on Russian trade with the EU, and even the removal of Soviet monuments from NATO territory. Public and private sector organizations can use the Recorded Future Intelligence Operations Platform to monitor NATO and Western government actions via sources such as the US Department of the Treasury’s Office of Foreign Assets Control (OFAC), which issues US sanctions; NATO’s official website, which tracks Ukraine aid discussions; and major European news sources.

Organizations should note that Russia often escalates aggression, such as sabotage operations and military operations, in the days surrounding Russia-Ukraine negotiations and major events such as NATO Summits. As such, organizations that directly or indirectly support Ukraine’s war effort and organizations located in countries Russia often targets with hacktivist attacks and sabotage operations, such as Poland and the Baltic States, should take extra cyber and physical precautions during those times.

Considerations for Organizations in High-Risk Countries or Industries

Though all public- and private- sector organizations, particularly in the EMEA, should actively monitor rhetoric by Putin and his proxies and be alert to Western actions that could prompt Russian retaliation, there are particular industries and states Insikt Group assesses are at higher risk of being targeted with hacktivist attacks or sabotage operations. Entities in these states and industries should be particularly vigilant and should consider incorporating at least some of the preparedness measures described above into their normal operating procedures. High-risk countries include NATO’s eastern flank (Estonia, Finland, Latvia, Lithuania, and Poland) and states that supply weapons and materials to Ukraine or shelter Russian defectors (Bulgaria, France, Germany, Spain, and the UK). High-risk industries include transportation, government, critical infrastructure (especially undersea data cables and grid assets in the Baltic Sea region), and defense-industrial entities.

Outlook

Insikt Group assesses that Putin’s foundational foreign policy goals are almost certain to remain unchanged in the foreseeable future, because they are rooted in his conception of how to reestablish Russia as a powerful state. In service to those goals, Putin is almost certain to continue undertaking actions specified above, including undermining international institutions; influence operation campaigns with and without attempted electoral manipulation; kinetic hybrid operations in NATO territory; destructive cyberattacks; and military operations in eastern Ukraine.

We assess that Putin considers a Russian invasion of NATO territory unlikely to succeed at the moment, judging from European intelligence agency assessments that Russia is several years away from being able to successfully invade NATO territory. That said, Putin’s belief that Poland is historically Russian and his view that Ukraine does not have a legitimate claim to sovereignty suggest his foreign policy goals require significant control over both states. As such, the extent to which Putin intervenes in those states is likely less a matter of desire and more a matter of whether Putin assesses an intervention would be successful.

Putin is almost certainly closely watching the level of US support for NATO and Europe’s efforts to bolster their own military and other deterrence capabilities, and we assess he could decide to escalate aggression against NATO territory if he judges his own capabilities are sufficient and that NATO’s response would be weak.

A sustained fracturing of NATO could embolden Putin to escalate non-military aggression in NATO territory, particularly against NATO states he considers part of Russia’s rightful sphere of influence. This type of escalation could allow Putin to exercise significant control over those states while minimizing the risk of invoking Article 5 with a military invasion.

In a subsequent paper, we will leverage the framework developed in this paper to assess what we would likely observe if Putin decided to try to significantly increase Russian influence in NATO territory. Using two states as case studies, likely Poland and Romania, we will assess the tactics Putin likely would use, including cyber operations, disinformation, sabotage operations, weakening of the business environment, and direct hacking of domestic electoral infrastructure. We will assess implications for public- and private-sector entities in those countries and will provide recommendations for how organizations can mitigate the resulting risks to their cyber assets, facilities, personnel, and business outcomes