An EPRS analysis identifies gaps in drone detection and the response to hybrid attacks

Gaps in drone detection, the difficulty of identifying those responsible for attacks, and the fragmentation of the response among authorities limit Europe’s ability to counter hybrid campaigns, according to an analysis by the European Parliamentary Research Service (EPRS), updated on 26 October. The document shows how actions with relatively low costs can disrupt infrastructure and services, forcing states to make difficult decisions about the timing and scale of intervention.

In brief

The EPRS analysis identifies vulnerabilities in drone detection, attribution of responsibility, and response coordination. Neutralising a threat does not automatically resolve the issue of deterring the campaign of which it may be part.

A single incident does not prove a hybrid campaign. What matters is the coordination of actions, the strategic objective, and their combined effects; hybrid threats do not necessarily involve the use of military force.

The ENISA report from 2026, cited by EPRS, analyses incidents from 2025. Public administration accounts for 31.8% of the events recorded in the dataset analysed, without this share measuring the severity of the effects or all attacks carried out in the EU.

The European roadmap provides for an initial capability of the European Drone Defence Initiative by the end of 2026 and full operation by the end of 2027. These are objectives to be achieved, not confirmation that the system is already fully operational.

The operational response rests primarily with the Member States, while the EU supports coordination and can use diplomatic instruments and sanctions. The EPRS analysis does not adopt new measures, and the Parliament’s September resolution expresses a political position.

For European defence, the problem begins before interception. Systems designed for conventional air threats must also identify small, slow-moving drones or those flying at low altitude. Once the object has been detected, authorities must determine who can intervene and with what means. Repeatedly using expensive interceptors against cheap aircraft can put pressure on resources, while closing an airport or interrupting the activity of a logistics hub creates costs even without destroying the infrastructure.

Identifying who launched the drone is a separate difficulty. EPRS summarises expert assessments according to which uneven detection, fragmented legal powers, and attribution that is too slow can prevent an effective response. Actions are sometimes designed to appear to be unrelated incidents, so that authorities respond to each episode without detecting the broader campaign.

The analysis, entitled “Hybrid warfare — A test for Europe’s defences”, is authored by Linda Tóthová, with contributions from Laura Zghibarta. It examines the use of migration as an instrument of pressure, drone incidents, and cyberattacks. It is an information document for the work of European parliamentarians, and its assessments belong to the authors; it does not automatically represent the official position of Parliament.

The link between these areas lies in the objective pursued and in coordination. Pressure exerted on borders can be combined with information manipulation to amplify political tensions. In another scenario explained by EPRS, a cyberattack disrupts infrastructure, an information operation heightens uncertainty, and a subsequent action exploits the pressure created. The cumulative effect may exceed the impact of each incident considered separately.

This does not mean that every data theft, hostile drone, or act of sabotage is part of a hybrid campaign. The assessment must take into account the actors, objectives, and links between actions. EPRS also distinguishes between hybrid threats, which do not necessarily involve the use of military force, and hybrid warfare, described as a more escalated phase of confrontation. The mere use of the same technology establishes neither the nature of the operation nor responsibility for it.

In the field of drones, the European response seeks to combine sensors, electronic warfare systems, and interception capabilities. The European Drone Defence Initiative, EDDI, aims at interoperable capabilities and multilayered defence, in cooperation with NATO. The analysis highlights the importance of the eastern border, as part of a broader effort to protect European airspace and infrastructure.

The Commission’s defence preparedness roadmap sets two distinct milestones. An initial EDDI capability is planned by the end of 2026, and full operation by the end of 2027. These are implementation targets; the announced timetable does not demonstrate that the equipment has already been installed or that all components are operating together.

In cyberspace, the consequences can range from the unavailability of a public website to the disruption of essential services. The ENISA Threat Landscape 2026 report, published in September and cited by EPRS, covers the 2025 calendar year. Public administration accounts for 31.8% of the events recorded in the dataset analysed. This share does not describe all attacks in the EU and cannot, on its own, be used to compare the severity of effects across sectors.

In public administration, attacks aimed at overloading and making online services unavailable, known as DDoS attacks, predominate. ENISA states that the reported impact was often limited to temporary disruptions or merely claimed disruptions of public websites. Separately, the use of similar techniques and infrastructure by criminals, ideologically motivated groups, and state-linked actors complicates the identification of responsibility. Artificial intelligence can increase the speed and scale of hostile operations, without its use by itself demonstrating who is behind an attack.

Member States retain primary responsibility for the operational response. At European level, existing instruments allow for coordination, diplomatic measures, sanctions, and support for protecting infrastructure. Through its conclusions of 16 March 2026, the Council of the EU reaffirmed the use of available instruments to prevent, deter, and counter hybrid campaigns, while respecting the competences of the states.

Through the resolution adopted on 16 September, the European Parliament called for closer cooperation with NATO, improved information sharing, and accelerated measures to defend against drones. The resolution expresses a political position and does not itself create new binding legislation. For the experts synthesised by EPRS, the difficulty remains turning information about repeated incidents into a coordinated and proportionate response, fast enough to reduce the advantage of those organising them.

https://2eu.brussels/ro/news/dronele-sabotajul-si-atacurile-cibernetice-testeaza-apararea-europei-arata-o-analiza-a-parlamentului-european