EU Research Warns Drone Detection and Intelligence Gaps Leave Europe Exposed to Hybrid Threats
A new EU research briefing identifies weaknesses in drone detection, intelligence attribution and coordinated responses to hybrid threats targeting European infrastructure and defense industries.
Europe faces significant weaknesses in detecting small drones, identifying the actors behind suspected sabotage and coordinating responses to hybrid threats, according to a new analysis published by the European Parliamentary Research Service (EPRS).
The briefing, titled Hybrid Warfare: A Test for Europe's Defences, was updated on October 26, 2026, and examines how drone incursions, cyberattacks, infrastructure sabotage and information manipulation can be combined to pressure European governments without triggering conventional military conflict.
Prepared by researchers Linda Tóthová and Laura Zghibarta, the analysis highlights persistent challenges involving threat detection, intelligence attribution and fragmented responsibilities between national and European authorities.
The findings are particularly relevant to Central and Eastern Europe, where defense manufacturers, military logistics networks and critical infrastructure have faced increasing security threats.
Europe Struggles to Detect and Attribute Drone Threats
According to the briefing, at least 16 NATO member states have reported drone airspace violations or discovered drone remnants during the previous two years.
Such incidents frequently occur near military facilities, airports and strategically important infrastructure.
The analysis identifies weaknesses in surveillance coverage, the detection of small and low-flying drones, and the ability of authorities to establish who is responsible for suspicious activity.
Traditional air defense systems were primarily designed to counter conventional military aircraft and missiles.
The increasing use of inexpensive drones presents a different operational challenge, particularly when authorities must determine whether an incident represents criminal activity, reconnaissance, an isolated provocation or part of a coordinated hostile operation.
The briefing cites expert assessments warning that fragmented legal responsibilities and slow attribution can undermine effective deterrence.
The cost imbalance is another concern.
Responding to inexpensive drones with costly interceptors or deploying fighter aircraft can impose substantial financial and operational burdens, even when no physical damage occurs.
Intelligence Analysis Must Connect Separate Incidents
One of the briefing's central arguments concerns the importance of identifying relationships between apparently unrelated security incidents.
A cyber intrusion, a disinformation campaign and an act of physical sabotage do not automatically constitute a coordinated hybrid operation.
However, when different activities are deliberately combined to achieve a strategic objective, their cumulative impact can be more significant than the individual incidents.
The analysis describes scenarios in which cyber operations disrupt critical infrastructure, information manipulation amplifies public uncertainty and further actions exploit the resulting pressure.
For intelligence services and private-sector security analysts, this creates a complex investigative challenge.
Assessing such operations requires examining actors, objectives, infrastructure, communication patterns and possible connections across national borders.
The difficulty is not simply collecting more information, but distinguishing unrelated events from coordinated campaigns using reliable evidence.
European Defense Manufacturers Face Espionage and Sabotage Risks
The briefing also examines threats to military production facilities, logistics networks and critical infrastructure.
Defense companies can be exposed to both cyber intrusions and physical security threats, particularly when they contribute to military assistance for Ukraine.
Recent cases demonstrate the operational relevance of these concerns.
In September, AdriaDefense reported that Estonian authorities attributed an arson attack targeting Milrem Robotics to Russian security services.
The Estonian company manufactures unmanned ground vehicles used by Ukrainian forces. Russia rejected the accusation.
More recently, Poland announced that it had identified a Russian GRU unit allegedly involved in hybrid operations across Europe.
Polish authorities have not publicly released the identity of the unit or the intelligence supporting their assessment.
The EPRS briefing underscores why such investigations are increasingly relevant to defense manufacturers.
Hostile intelligence collection can expose production capabilities, personnel, supply chains and critical infrastructure, potentially creating opportunities for subsequent disruption.
However, the report also cautions against automatically classifying unrelated security incidents as components of a single hybrid campaign.
Cyber Intelligence Becomes Part of Industrial Security
Cyber operations represent another significant component of Europe's hybrid threat environment.
The EPRS analysis cites ENISA's 2026 Threat Landscape, which found that 73% of targeted organizations in its dataset were classified as essential or important entities under the NIS2 Directive.
Public administration was the most targeted sector, followed by business services, transport, manufacturing and banking and finance.
The briefing highlights increasing overlap between techniques used by cybercriminals, hacktivists and state-linked actors.
Similar infrastructure and attack methods can make attribution difficult, allowing perpetrators to obscure their identities and objectives.
For strategically important manufacturers, this reinforces the need to combine technical cybersecurity monitoring with broader intelligence concerning geopolitical developments, hostile networks and operational threats.
EU Expands Counter-Drone Funding
The European Union is introducing new initiatives intended to improve detection, preparedness and coordinated responses.
The European Drone Defence Initiative (EDDI) is expected to establish a multilayered architecture incorporating surveillance sensors, electronic warfare systems and interception drones.
According to the EPRS briefing, initial radar and supporting infrastructure are targeted for deployment by the end of 2026, with the initiative expected to begin operating by the end of 2027.
The European Commission also announced an additional €130 million in October 2026 for counter-drone capabilities under the Border Management and Visa Instrument.
This brings EU financing for surveillance and counter-drone technology under Home Affairs funding instruments to more than €500 million.
For European manufacturers, these initiatives could generate additional demand for radar systems, electronic warfare technologies, command-and-control software and intelligence analysis.
However, deploying additional sensors will not automatically resolve the challenge of attributing hostile operations or coordinating decisions between national authorities.
Implications for European Intelligence and Defense Industry
The briefing illustrates a broader change in how European security risks are assessed.
Defense is increasingly concerned not only with intercepting physical threats but also with identifying hostile networks, understanding their intentions and connecting events across digital and physical environments.
For defense manufacturers, intelligence capabilities may become increasingly important in protecting employees, facilities, sensitive technologies and international supply chains.
The EPRS analysis suggests that Europe's response will depend on improving detection, information sharing, legal coordination and the ability to assess hostile activities as part of a wider strategic picture.
That creates opportunities for counter-drone technology developers, cybersecurity providers and intelligence analysis companies, while also placing greater importance on evidence-based attribution and cooperation between public and private institutions.
The briefing itself is a research document prepared to support the European Parliament's work. Its assessments do not constitute a new formal policy decision by the Parliament.
