The threat from Russia is expected to increase in the coming years, according to Sweden’s domestic security service Säpo, which said Moscow remains the country’s main security threat even as tensions linked to Iran and the wider Middle East have added new risks inside Sweden. The assessment was presented on Wednesday, 18 March, in Säpo’s annual 2025–2026 security report.
Säpo said Russia has become more willing to take risks and more offensive in its methods, especially through covert influence operations, intelligence gathering, cyber activity and attempts to exploit vulnerabilities linked to Western support for Ukraine. The agency also said China remains the main long-term threat to Sweden’s economic security.
Why Säpo says Russia remains Sweden’s main threat
In its latest assessment, Säpo said Sweden is operating in a more volatile and uncertain security environment, and that the trend is still moving in a worse direction. According to the agency, Russia remains the largest threat to Sweden, above all because of its objectives in the region and its broader hostile activity against Europe.
Charlotte von Essen, the head of Säpo, said the focus should not rest only on the latest crisis in the Middle East, even if that has worsened the overall security picture. The deeper structural driver, according to the agency, is Russia’s increasingly aggressive behaviour in Europe since the full-scale invasion of Ukraine.
Säpo said Russian activity is marked by a more offensive use of hidden influence operations, efforts to obtain technology and sensitive know-how, and attempts to bypass sanctions. It also warned that sabotage linked to Western military and political support for Ukraine remains part of the threat picture.
Suspected sabotage cases and cyber attacks in Sweden
One of the most notable elements in the report is the scale of suspicious activity reviewed by the security service over the past year. Säpo said it examined hundreds of suspected incidents and events, including cases that raised concerns about sabotage.
At the same time, the agency was careful not to go further than the evidence allows. Swedish authorities said they have not established foreign state responsibility for physical sabotage inside Sweden so far. That distinction matters. The warning from Säpo is serious, but it does not amount to a public claim that Russia has already carried out proven physical attacks on Swedish critical infrastructure.
What the agency does say is that Russia has tasked intermediaries with mapping sensitive sites in Sweden, and that Sweden has seen attempts at destructive cyber attacks. In other words, the concern is not hypothetical, but part of a broader pattern of hybrid pressure already visible across Europe.
Sweden’s NATO role has changed the security context
The warning also comes in a new strategic setting. Sweden joined NATO on 7 March 2024, ending two centuries of military non-alignment and becoming the alliance’s 32nd member. That shift has tied Sweden more closely to the security of the Baltic and Nordic regions, but it has also made the country more exposed to the wider confrontation between Russia and the West.
For Stockholm, this means the domestic security discussion can no longer be separated from the military and geopolitical changes around the Baltic Sea, the High North and the war in Ukraine. Säpo’s language reflects that reality: it links the threat against Sweden directly to Russian goals in the neighbourhood and to the broader European response to Moscow’s war.
The report also fits into a wider European debate on resilience, supply chains and sanctions enforcement. The EU has kept in place and expanded restrictive measures on Russia, while pressing companies and public authorities to prevent sanctions circumvention, technology leakage and the export of dual-use goods that could support Russia’s war effort.
Iran, lone actors and China add pressure to the threat picture
Although Russia remains the main threat, Säpo said the security picture has also worsened because of recent developments involving Iran and the Middle East. According to the agency, the current crisis raises the risk for American, Israeli and Jewish targets in Sweden, while Iran is also seen as capable of acting through proxies or criminal networks.
Säpo maintained Sweden’s terror threat level at 3 on a five-point scale, meaning an elevated threat remains in place. The agency said the most likely danger still comes from lone actors or small groups using simple means against easily accessible targets. It also pointed to a worrying trend among some younger individuals, where violence itself can become more central than any clear ideology.
Alongside Russia and Iran, the report says China remains the main long-term challenge to Sweden’s economic security. That reflects a broader European concern over industrial espionage, strategic dependencies, control over sensitive technologies and foreign access to critical infrastructure.
What Säpo’s warning means for Sweden and the Nordic region
The immediate message from Säpo is not that Sweden is facing an imminent conventional attack. The message is that the line between peace, coercion and sub-threshold aggression is becoming less clear. Influence operations, cyber attacks, intelligence work, proxy actors and suspected sabotage all belong to the same grey-zone environment.
For Sweden, that means stronger protection of critical infrastructure, more scrutiny of business ties and supply chains, and closer coordination with Nordic and European partners. It also means a more permanent security mindset than the one that shaped much of the post-Cold War era.
For the wider Nordic region, the report is another reminder that the consequences of Russia’s war against Ukraine are not limited to the battlefield. They are also reshaping domestic security, economic policy and democratic resilience across northern Europe. In that sense, Säpo’s assessment is not only about Sweden. It is about how a Nordic NATO member and EU partner is adapting to a longer period of confrontation on Europe’s northern flank.
