For the last few years, Russia’s hybrid campaign in Europe has looked like a problem for governments: cut cables, GPS jamming, drones over airports, the odd warehouse fire. If you ran a technology company, it was something you read about rather than something you planned for.
That has changed. In 2026, the people who design, build and finance drones and dual-use technology have become part of the target set, and many leadership teams have not yet caught up.
From infrastructure to industry to individuals
Analysis published last week notes that most sabotage across Europe between 2022 and 2025 was not aimed at the defence industry, but the recent picture has changed sharply, with defence facilities increasingly drawn in. In April, Russia’s Ministry of Defence published a list of 21 Ukrainian and European companies it said were producing drones and drone components for Ukraine, Dmitry Medvedev then stated on social media that such organisations are a potential target for Russian forces.
Words have been followed by action. German investigators suspect the GRU was behind an arson attack in Munich on 3 September, when incendiary devices were thrown from a passing car near the headquarters of Rohde & Schwarz and Helsing. Estonia is investigating possible Russian involvement in a fire at a Milrem Robotics facility, a supplier of ground drones to Ukraine. As seen in other countries, Denmark’s PET has said Russian intelligence is actively preparing sabotage against the Danish defence industry and recruiting Danish citizens to help.
And the threat is personal. In 2024, US and German intelligence foiled a Russian plot to assassinate Rheinmetall CEO Armin Papperger, reportedly the most advanced of several schemes against defence executives across Europe. Germany is now investigating a possible plot against the head of drone maker Donaustahl. The Donaustahl chief’s own assessment is blunt: every defence company in Europe is a target.
The UK is not a bystander
This summer the FCDO held a roundtable warning British defence CEOs, including drone manufacturers supplying Kyiv, of a growing risk of Russian espionage and assassination plots. A Kremlin adviser told the BBC in August that British drone production could be targeted. Separately, a man has been charged in London with offences under the National Security Act relating to drone factories in Swindon; he has entered no plea and the case is before the courts.
Why “dual-use” leaders are exposed
Many of the most exposed people don’t think of themselves as defence executives at all. They run startups in autonomy, sensors, batteries, comms, AI or advanced manufacturing. Their products are civilian until a government contract, a component supply chain or a press release makes them otherwise. Typically they have:
- A high-visibility personal brand, because that’s how you raise capital and hire talent.
- Thin or non-existent protective security, because the company is twenty people in a converted unit.
- Families, home addresses and daily routines that are trivially discoverable online.
- Investors, board members and supply-chain partners who are themselves potential access points.
The modern method: disposable proxies
Russia’s services rarely need trained officers on the ground. They are increasing using “low-level agents”, untrained people, in need of money, recruited through messaging apps for specific espionage or sabotage tasks. Two suspects in Germany were allegedly monitoring an employee of a drone supplier to Ukraine. Separately, Russia-attributed phishing campaigns have been found to target people through Signal and other methods of communication used for their secure encryption.
Security Leaders should be aware of the hostile attacker pathway, and this should be cascaded by security awareness training to executives and staff. The first sign of hostile interest is typically reconnaissance, online, and of both business and residential buildings connected to executives and key employees. Executives and key staff should understand how to detect surveillance, know what probing and unusual approaches look like and quickly identify suspicious digital activity.
The key things to do now
- Accept the threat at board level. If your company appears on a supplier list, wins a defence contract or announces support for Ukraine, personal risk to your leadership changes overnight. Treat it as a governance issue, not an IT one.
- Audit executives digital footprint, and their family’s. Home addresses, children’s schools, gym routines and holiday photos are reconnaissance gifts.
- Understand pattern of life. Predictable commutes, regular venues and publicised speaking engagements are what hostile surveillance looks for. Vary them, and brief executive assistants accordingly.
- Test your sites properly. Assume someone will try the physical perimeter, the reception desk and the delivery bay. Covert testing tells you what a proxy with a phone camera will find.
- Train staff to spot and report. Hostile reconnaissance and online recruitment approaches are recognisable when people know what they look like. Build a no-blame reporting culture.
- Harden communications. Verify identities out of band, especially on Signal and WhatsApp, treat urgent requests from “senior colleagues” with suspicion, and understand the risks around digital leakage.
- Build relationships before you need them. Know how to engage NPSA, Counter Terrorism Policing and your local force, and have an incident plan for threats against individuals as well as sites.
A note on proportion
Good security is proportionate and evidence-led. But the documented trajectory, from infrastructure, to facilities, to named companies, to named individuals, is clear enough that “it won’t happen to us” is no longer a defensible position.
Innovation in drones and dual-use technology is now strategically important to Europe’s security. That makes the people driving it strategically important too. It’s time they were protected like it.
How Sloane Risk Group can help
At Sloane Risk Group, we understand that the threat to today’s executives doesn’t stop at the boardroom door. Hostile actors don’t respect the line between corporate and personal life, and the point where the two cross over.
That is exactly where we sit. Drawing on backgrounds in protective security and counter-espionage, we help leadership teams see themselves as an adversary would and close the gaps before they’re exploited.
Our services include security risk assessments covering both business premises and private residences, executive security awareness training, communications reviews, hostile surveillance detection training for leaders, their families and support staff, and physical penetration testing to show what a determined adversary could really achieve on your sites.
If your organisation works in drones or dual-use technology and you’d like a confidential conversation about your exposure, please get in touch.
Hayley Elvins CSyP FSyI is Founder and Managing Director of Sloane Risk Group.
