State of the Threat — Europe 2027

State of the Threat Europe 2027 — annual threat assessment cover by CES Intelligence, purple design with stylized Europe map and threat network State of the Threat — Europe 2027. The CES Intelligence annual flagship assessment, reserved for Advisory members. Photo: CES Intelligence / Generated imagery

Launching November 2026

Europe's threat environment crossed a threshold in 2026. Not gradually — measurably.

Cyber sabotage produced fires at civilian factories in NATO territory. A member state raised its national threat level for destructive attacks. Criminal networks — some recruited among minors — took payment from hostile-state handlers for arson, surveillance and infrastructure tagging. The European Union formally attributed a sustained sabotage campaign to a unit of the Russian FSB. And while all this happened, the diplomacy that will redraw Europe's security architecture for a generation opened on terms designed to exclude European capitals from the room.

This is not noise. It is the new operating environment.

State of the Threat Europe 2027 is CES Intelligence's annual flagship assessment: a strategic synthesis of the threat picture bearing down on Western Europe — state adversaries, nonstate actors, and the convergence between them — built on calibrated probability, source triangulation and explicit confidence levels. Judgment you can audit, not opinion you must trust.

Inside this edition

— Six key judgments for the year ahead — including why the Russia threat persists regardless of how the Ukraine war ends, and why the peace process itself may be Europe's most underrated strategic risk

— The adversary files — Russia, China, Iran and North Korea assessed domain by domain: military, cyber, economic, technological, space, influence — with each actor's constraints examined as honestly as its capabilities

— The fourth Taiwan Strait crisis — and what the largest single tail-risk to European supply chains since 1945 demands of boards before the 2027 window opens

— The narco-state fusion — how the same networks moving cocaine through Antwerp, Rotterdam and Morocco's Atlantic ports became a subcontractor marketplace for hostile states

— The sectoral exposure matrix — nine sectors rated against eight threat vectors, showing where adversary targeting and European resilience policy converge on the same estates

— Watch indicators — the named, observable triggers that would change our judgments, so your leadership team knows what to watch between now and the next cycle

Every threat requires a response. None rewards improvisation.

Who this is for

Boards and executive committees allocating security, resilience and strategic investments for 2027. Chief risk and security officers converging fraud, physical and cyber exposure into one intelligence picture. Executives who suspect their one-front planning assumptions are obsolete — and are right.

Members only — by design

State of the Threat is not a marketing download. It is the full analytic product — every judgment, every confidence level, every caveat — reserved for CES Intelligence Advisory subscribers, alongside the quarterly Geopolitical Risk Report and the Sector Books series.

Get the full edition

Talk to an expert about Advisory membership and how this assessment translates to your organisation's exposure.

Talk to an expert