Critical Infrastructure Protection Against Drones in Europe

Critical infrastructure protection is the set of measures that keep essential services running when assets such as power stations, ports, airports, water works and communications networks are attacked, disrupted or interfered with. For physical sites in Europe, the drone is now one of the threats that operators must plan for. The accepted approach combines a risk assessment, layered detection and identification, a defined set of response options owned by the right authority, and the legal duties set by EU and national law. This article explains each part for operators, security managers and procurement teams. It was written in October 2026, and the legal dates quoted should be checked against current national law.

What critical infrastructure protection covers

Definitions differ by jurisdiction, but they share a core. In the United States, federal law describes critical infrastructure as physical or virtual systems and assets so vital that their incapacity or destruction would have a debilitating impact on security, the economy, or public health and safety. The statute names telecommunications, energy, financial services, water and transportation as interdependent systems. The US Cybersecurity and Infrastructure Security Agency (CISA) goes further and identifies energy, communications, water and transportation as the four sectors on which almost all others depend. CISA lists 16 critical infrastructure sectors in total, which gives a sense of how wide the field is.

European law uses its own lists, covered below. The practical point for an operator is the same everywhere: the protected object is a service, not only a building. A fence line, a control room and a fuel supply are all parts of one chain, and the chain fails at its weakest and least visible link.

Why dependencies matter more than single assets

Infrastructure sectors rely on one another, so a failure in one spreads to others. The US National Counterintelligence and Security Center warned in November 2024 that compromise of one sector, such as communications or energy, can cause cascading harm to dependent sectors. The OECD makes a similar argument in its Government at a Glance 2025 report: resilience needs a systems approach that prioritises critical components across the whole network rather than treating assets in isolation.

For an airport, this means that a drone sighting near the runway is not only an aviation safety event. It can stop flights, which affects fuel deliveries, staffing, freight and passenger flows, and in turn the regional economy. For a port, interference with cranes or gate systems can stop a supply chain within hours. Risk assessment should therefore map what each site delivers, who depends on it, and how long that dependency can tolerate an outage.

The threat picture, and where drones fit

Official guidance treats threats as a mix of physical, cyber and hybrid. The US 2024-2025 Strategic Guidance for critical infrastructure names cyberattacks, physical sabotage, climate change and geopolitical tensions among the greatest risks. The 2024 US report cited earlier also notes that foreign intelligence entities conduct physical reconnaissance alongside cyber operations. A United Nations compendium of good practice from 2022 observes that terrorists have increasingly targeted public and private utilities across almost all sectors.

Small uncrewed aircraft suit several of these purposes at low cost: observing a site, disrupting operations by entering controlled airspace, or carrying a payload. Not every drone near a site is hostile. Most are hobbyist or commercial flights, some are lost or malfunctioning, and a minority are deliberate. That mix is the central operational difficulty, and it is why identification matters as much as detection.

The DHS fact sheet on infrastructure protection stresses that physical and cyber infrastructure are now inextricably linked. A drone with a radio-frequency payload can be a cyber threat as well as a physical one, so security teams should not split the two into separate workstreams.

Assessing risk before choosing technology

Technology should follow a risk assessment. CISA’s Infrastructure Resilience Planning Framework, updated in March 2025, sets out five steps: lay the foundation, identify critical infrastructure, assess risk, develop actions, and implement and evaluate resilience projects. It is a US document, but the sequence is a useful template for any operator. In practice, for drone risk, it translates into questions such as:

• Which parts of the site would stop a service if disrupted, and which are visible or reachable from the air?
• What does the surrounding airspace look like: nearby airfields, flight corridors, recreational flying areas?
• What approach directions give the least warning time, given terrain, buildings and water?
• Who has legal authority to act in the airspace over and around the site?
• What would the site do if detection worked but no response were available?

The answers set the detection range needed, the number of sensor positions, the staffing of the control room and the agreements needed with police and aviation authorities. The same US guidance asks regulators to hold operators accountable for risk-informed, performance-based baseline controls, which is a useful principle: measure whether a control works, not whether it exists.

Layered drone protection: detect, identify, respond

No single sensor type is sufficient. Counter-drone practice uses layers that cover each other’s weaknesses.

Layer 1: detection and tracking

Detection draws on several sensor types:

Sensing method	What it provides	Typical limitation
Radar	Position and movement of small airborne objects	Clutter from birds, buildings and waves can cause false alarms
Radio frequency detection	Detects the control link or telemetry of many commercial drones, and sometimes the operator’s position	Does not see drones that fly autonomously or emit little
Electro-optical and infrared cameras	Visual confirmation, day and night	Limited by weather, range and field of view
Acoustic sensors	Short-range cueing in quiet environments	Affected by ambient noise

Sensor fusion, which combines these inputs into one track, reduces false alarms because a radar contact that is confirmed by a camera and a radio signature is far more credible than any single reading. Vaubren Systems describes Bartizan as a self-powered sensing tower with radar, radio detection and cameras for coasts, ports, borders and critical sites. Bartizan is a concept in development. A self-powered design is relevant to remote perimeters, such as coastlines and open energy sites, where mains power and communications are not always available. Further background on this deployment style is in Vaubren’s guide to mobile surveillance towers.

Layer 2: identification and assessment

A track is not yet a decision. The operator needs to know what the object is, where it came from, where it is heading and whether the flight is authorised. That requires the picture to be shared with the control room, airport operations or port security rather than held inside a single sensor interface. Command software that brings several sensors into one live picture, records events for later review and keeps a named person responsible for decisions supports this layer. Vaubren Systems is developing Redoubt for this role: command and control software that plans missions, shows one live picture and keeps a person in command of every use of force. Redoubt is in development and evaluation.

Layer 3: response options

Response is the most legally constrained layer. Options differ in nature and in who may use them:

• Procedural responses: pausing operations, holding aircraft, moving people indoors, closing a work area.
• Notification and handover: passing a verified track to police, air navigation services or military authorities.
• Electronic measures: interference with the control or navigation link of a drone. These can affect other radio users and navigation signals, so they are normally restricted to authorised state bodies. Vaubren Systems describes Stillpoint as a portable counter-drone electronic warfare unit, a concept in development for European defence customers.
• Interception: physical engagement of a drone by another aircraft. Vaubren’s Ravelin is a fast, printed counter-drone interceptor, a prototype in testing, intended for authorised defence users.

Civil operators such as airports and energy companies generally do not hold legal authority to use the last two categories. Their responsibility is to detect, verify, record and escalate, and to have rehearsed procedures for the time between detection and the arrival of the authority that can act. For an overview of how these technologies fit together across Europe, see Vaubren’s article on counter-drone systems in Europe and its counter-drone systems page.

European regulation: CER and NIS2

Two EU directives set the baseline for operators in the Union. Both were adopted in December 2022, and both are implemented through national law, so the details differ by member state. The dates below were as published in the directives; confirm the status of national transposition with your own authority.

The CER Directive and physical resilience

The Critical Entities Resilience Directive (EU) 2022/2557, known as CER, concerns the physical resilience of entities that provide essential services. It covers sectors including energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space, and food production, processing and distribution. Member states identify critical entities, and those entities must assess the relevant risks, take proportionate technical, security and organisational resilience measures, and notify certain incidents. The directive’s measures include physical protection of sites and critical infrastructure, and detection equipment is among the examples that operators are expected to consider. Drones are therefore squarely within the type of risk that a CER risk assessment should address.

NIS2 and cybersecurity risk management

The NIS2 Directive (EU) 2022/2555 sets cybersecurity risk-management and incident-reporting duties for essential and important entities across a broad set of sectors, including energy, transport, health, water, digital infrastructure and public administration, with further sectors such as manufacturing, food and chemicals in the important category. It applies to network and information systems, but it matters for drone protection in two ways. Sensor networks, command software and recording systems are themselves information systems that must be secured. And an incident that mixes physical and cyber elements, such as a drone-borne radio attack on a wireless network, can fall under both regimes.

How the two fit together

In practice, a single operator may be a critical entity under CER and an essential entity under NIS2. The sensible approach is a joint risk register, with one owner for physical security and one for cybersecurity, and shared incident procedures that meet the reporting duties of both. Any detection and command system an operator procures should support audit trails, access control and secure update processes, because the operator carries the compliance obligations whoever supplied the equipment.

National guidance

Member states and other European countries add their own rules on airspace, police powers and critical infrastructure designation. In the United Kingdom, which is outside the EU, the National Protective Security Authority and the Civil Aviation Authority publish guidance for site operators, and drone flight restrictions are set through aviation law. Operators should rely on their national authority, aviation regulator and police for the rules that apply at their site, since powers over drones differ widely between countries.

Governance, information sharing and recovery

Protection is not only sensors. The OECD reports that governments and operators coordinate through partnerships and platforms for information sharing, joint exercises, situational awareness and mutual assistance. It also found that 70% of countries with data (19 of 27) had laws or policies that facilitate information sharing on risks and vulnerabilities, based on the 2025 report published in June of that year.

The same report shows how uneven formal policy is. Among 23 OECD countries, 14 (61%) have a national policy, strategy or programme for critical infrastructure resilience, and only 6 (26%) have one established in legislation. The average governance score was 0.59 on a 0 to 1 scale, ranging from 0.32 to 0.83 by country. For operators, the lesson is that obligations differ and that voluntary information sharing with neighbours, police and regulators is often where the practical value lies.

Recovery planning is the final element. US guidance observes that making all infrastructure impervious is impossible, so the emphasis falls on understanding critical nodes and dependencies and planning for rapid recovery. For a drone incident, this means having a plan for restarting operations safely after an airspace closure, a documented post-incident review, and a process to feed what was learned back into the risk assessment.

A practical checklist for site operators

1. Identify the services the site provides and the assets that carry them.
2. Map dependencies in both directions, including power, communications and logistics.
3. Assess drone exposure: airspace, approach routes, nearby flying activity, past incidents.
4. Agree responsibilities with police, the aviation authority and the relevant defence or interior ministry before an incident.
5. Design detection in layers and test it against realistic non-hostile traffic to measure the false alarm rate.
6. Put detection data into one picture with logging, so that decisions can be reviewed.
7. Secure the sensing and command systems under the NIS2 risk-management approach.
8. Exercise the plan with all parties, and revise it after every exercise and real event.

Where Vaubren fits

Vaubren Systems is a European defence technology company incorporated in Bulgaria. It develops aircraft, command software, sensing and electronic warfare systems as one integrated set for European defence customers: Ravelin, Glacis and Caisson (aircraft), Redoubt (command software), Bartizan (sensing) and Stillpoint (electronic warfare). Ravelin and Glacis are prototypes in testing, Caisson is a tested prototype, and Bartizan and Stillpoint are concepts in development. Glacis is a long-range vertical take-off surveillance aircraft, described on the border and coastal surveillance page, and Caisson’s resupply role is set out on the logistics page. Starfort is Vaubren’s planned development, testing and manufacturing campus in Bulgaria.

Procurement and capability teams evaluating sensing and command software for critical sites can review the full set on the systems page or contact Vaubren through vaubren.com to discuss requirements.

Frequently asked questions

What is the difference between critical infrastructure protection and critical infrastructure resilience?

Protection aims to prevent or deter harm, for example through fences, surveillance and detection. Resilience accepts that some incidents will happen and focuses on absorbing them and recovering essential services quickly. Current guidance, including the OECD and US material cited above, treats the two as complementary.

Who is allowed to respond to a drone over a critical site in Europe?

That depends on national law, but active countermeasures are generally reserved for police, military or other authorised state bodies. A civil operator normally detects, verifies, records and notifies. Check your national aviation authority and police for the exact arrangements.

Do NIS2 and CER apply to the same organisation?

They can. CER addresses physical resilience of critical entities, while NIS2 addresses cybersecurity of network and information systems across a wider group of sectors. An energy or transport operator may be in scope of both, and should coordinate its compliance work.

Why are false alarms such a problem in drone detection?

Birds, vehicles and harmless drones produce contacts that look similar to threats on a single sensor. Frequent false alarms exhaust control room staff and reduce trust in the system. Combining radar, radio frequency and camera data, and testing in the real site environment, is the usual way to reduce them.

Sources

• 42 U.S.C. § 5195c: Critical infrastructures protection
• Critical Infrastructure Systems, CISA
• Critical Infrastructure Sectors, CISA
• Safeguarding Our Critical Infrastructure, US National Counterintelligence and Security Center, November 2024
• Strategic Guidance and National Priorities for US Critical Infrastructure Security and Resilience, 2024-2025
• UN Compendium of Good Practice, 2022
• Office of Infrastructure Protection Fact Sheet, CISA
• Infrastructure Resilience Planning Framework, CISA, March 2025
• Ensuring the resilience of critical infrastructure, OECD Government at a Glance 2025
• Directive (EU) 2022/2557, Critical Entities Resilience, EUR-Lex
• Directive (EU) 2022/2555, NIS2, EUR-Lex