On August 10, the Swedish Security Service announced it had disrupted an operation planned and directed by Russia's SVR — an agent recruited inside a foreign diplomatic mission, handled by two SVR officers under diplomatic cover, tasked with feeding influence operations designed to discredit Sweden, NATO, and the EU. Säpo said it had monitored the operation at length, documenting meetings and assignments before intervening. Three days later, Poland's Internal Security Agency announced it had detained a Russian citizen preparing to kill a dual U.S.-Ukrainian citizen in Warsaw — described in reporting as the first known Russian-ordered plot against a U.S. citizen on NATO territory.
Set these beside the summer's sabotage file — an explosive-laden drone defused at Leipzig's cargo hub, proxy surveillance and arson preparations documented across NATO countries — and the picture is not of isolated incidents. It is a sustained campaign run below the threshold of war, using recruited locals, proxies, and deniable means.
Gray-zone campaigns target decision-making, logistics, and confidence — which means they run through civilian infrastructure and civilian organizations. Defense suppliers, logistics firms moving aid, energy operators, and the executives of all three are legitimate targets in this doctrine. The Warsaw plot makes the point uncomfortably concrete: individuals, not just installations.
- Recruitment precedes action. Säpo's account is a reminder that these operations run on people — approached, developed, and tasked over months. Organizations with access worth having should assume their staff are in someone's file.
- Preparation is observable. Surveillance of facilities, probing of logistics routes, and approaches to employees are collectible signals — if physical security, counterintelligence, and threat monitoring share one picture.
- Executive exposure in Europe now includes state-directed violence, a category most corporate protection programs were not built to consider.
The security services that disrupted both operations did it the same way: patient correlation of small signals over time. That is the model protective-intelligence programs need at organizational scale — cross-domain signals resolved to the people, facilities, and routes they concern, watched continuously, adjudicated by humans. Detecting the preparation phase is the entire margin in the gray zone, because the action phase is designed to be too fast to stop.