From Leipzig to Abqaiq: Why Drone Defense Is Now a Whole-of-State Problem

U.S. gaps in drone defense, highlighted by retired Rear Admiral Mark Montgomery, raise questions about the preparedness of other countries. From the protection of strategic infrastructure to hybrid threats, through the lessons of Ukraine, the need to rethink national security is emerging, by integrating military capabilities, intelligence, and the resilience of civilian systems.

Retired U.S. Rear Admiral Mark Montgomery’s warning about America’s incomplete preparedness against drone threats raises a question that concerns the entire international system. If the United States, despite possessing military, technological, and intelligence capabilities among the most advanced in the world, has gaps in protecting its own installations and infrastructure, what level of preparedness can other countries exposed to the same threat assume they have?

In his appearance on The Capitol Show, featured by the Foundation for Defense of Democracies on October 16, 2026, Montgomery highlights the lessons of the war in Ukraine, the need for economically sustainable interceptors, and the protection of U.S. infrastructure and that of its Gulf allies. The problem that emerges is the gap between the speed at which threats evolve and the time it takes for institutions to adapt their resources, organization, and methods of operation.

The U.S. warning allows us to observe the phenomenon from the perspective of states, namely: the proliferation of accessible offensive capabilities alters the conditions under which a power can protect its territory and maintain freedom of action.

The geopolitical issue arises from the ability of even relatively weak actors to influence the activities of much stronger entities. To exert this pressure, it may be sufficient to disrupt a connection, threaten infrastructure, or force a government to reallocate resources for defense.

Overall military superiority must therefore contend with local vulnerabilities through which an adversary can impose economic costs, operational constraints, and political consequences. A state’s ability to operate beyond its borders also depends on the security of its territory and the infrastructure that supports its operations. The case of the Chinese balloon shot down in the United States illustrates how this security requires the integration of military capabilities, political assessments, and the protection of the population.

On February 4, 2023, a U.S. F-22 shot down a high-altitude balloon off the coast of South Carolina that Washington identified as a surveillance platform, while Beijing claimed it served civilian, meteorological purposes. The United States had the means to intervene, but had to balance information protection, personal safety, the safeguarding of sovereignty, and diplomatic consequences.

A single device had drawn in intelligence agencies, air defense, political authorities, and relations between two major powers. Although technically different from small drones, the balloon demonstrated how protecting national territory requires a broader assessment than simply the ability to neutralize an object. Even an observation mission can take on strategic significance and require a response in which military capabilities and political responsibilities are closely intertwined.

The Leipzig incident introduces a dimension directly linked to European security. On the night of August 4–5, 2026, a drone equipped with an explosive device was discovered in the cargo area of Leipzig/Halle Airport. The Dresden Public Prosecutor General’s Office and the Saxony Criminal Police confirmed that the detonator had been removed and that airport operations had been temporarily suspended.

The German government subsequently attributed the attempted attack to Russia, distinguishing this political attribution from the criminal investigations still underway. Leipzig’s significance stems from the function of its infrastructure. The airport participates in the strategic transport activities of the SALIS program, through which allied countries gain access to airlift capacity for outsize cargo.

A civilian airport is therefore also a hub for European military logistics and mobility. A country may be far from the fighting and still contribute to supporting a state involved in the conflict. Supplies and materiel may transit through its airports, ports, and rail connections, while its companies may provide equipment and services.

These activities expose it to the possibility of hostile actions against the infrastructure that makes that support possible. Threatening that infrastructure or disrupting its operation can pursue two related objectives: hindering the flow of aid and imposing economic costs, disruptions, and security concerns on the country that supplies it.

This pressure can thus extend to government decisions, seeking to weaken the political will to continue supporting the partner. These scenarios play out in the gray areas of contemporary conflict, where hostile actions can unfold while their origin, scope, and connection to a broader strategy remain unclear.

Actors can exploit this ambiguity by combining military and non-military tools, overt initiatives, and covert operations. It is through this combination that the methods of hybrid warfare are expressed: sabotage, cyberattacks, disinformation, economic pressure, and the use of intermediaries can all contribute to influencing the decisions of the opposing party.

These actions can also serve a strategic communication function, that is, to demonstrate a capacity for intervention, test defenses, or signal the costs of continuing a particular policy. The message may be accompanied by tangible consequences, such as the disruption of a service or damage to infrastructure.

Those carrying out these actions thus seek to exert recognizable pressure while retaining room to deny their involvement and complicate the response. The confrontation may unfold without escalating into open war or may accompany an ongoing conflict, extending its effects to territories and activities far from the fighting.

Drones can be deployed in both conventional combat and hybrid campaigns. Their hybrid character depends on the strategy into which they are integrated: observation, sabotage, and intimidation can be combined with other tools to influence the decisions of the opposing party.

In the Leipzig case, the German government characterized the episode as a hybrid attack, linking its response to the protection of infrastructure, support for Ukraine, and coordination with NATO and the European Union. The U.S. warning highlights that preparation for conventional warfare alone does not ensure an equivalent capacity to address hybrid threats.

A state may have efficient armed forces yet still face difficulties in recognizing and countering a campaign that combines sabotage, cyberattacks, and pressure on civilian infrastructure, a campaign that involves expertise distributed across multiple institutions. NATO analyses identify the ambiguity of hybrid actions as an obstacle to understanding the situation and making swift decisions.

Vulnerability can therefore manifest itself before a defensive response is mounted. A suspicious presence may be treated as an airport security issue, a digital disruption as a cyber incident, and damage as a criminal act. If the information gathered by different agencies remains siloed, it can become difficult to recognize potential links between these incidents and assess their strategic significance.

The hostile actor can exploit this fragmentation to delay the attribution of responsibility and make it more difficult to reach a political decision on the response. The ability to synthesize information thus becomes an integral part of defense. Today, more than ever, it is necessary to combine defense and security in threat assessment and national preparedness, while maintaining clearly defined roles and responsibilities.

The land, maritime, air, space, and cyber domains are interconnected by the functions that enable observation, communication, movement, and decision-making. The protection of individual assets or installations must be assessed together with the continuity of the system in which they operate.

The condition of other countries must be read in the context of these relationships. A large military budget does not, by itself, measure preparedness against distributed threats. U.S. gaps do not prove that every other state is necessarily less prepared, but they show that significant technological superiority can coexist with security challenges.

Ukraine highlights the value of experience. The pressures of war have necessitated continuous learning in the use of drones and countermeasures, which Montgomery cites as a valuable asset for U.S. preparedness. For European countries, the relationship between interconnected infrastructure and security measures organized primarily on a national basis takes on particular significance.

The disruption of a logistics or energy hub can have consequences that extend beyond national borders. Differences in preparedness thus become a collective problem: the Alliance’s security also depends on the continuity of the networks through which its members can support one another.

In the Gulf states, the concentration of energy and logistics functions of global significance amplifies the scope of local vulnerabilities. The September 2019 attacks on the Saudi facilities at Abqaiq and Khurais demonstrated how damage to just a few sites could disrupt a significant portion of oil production and impact international markets.

The protection of this infrastructure simultaneously concerns the security of producers, the interests of partners, and the stability of external supplies. Montgomery’s call for cooperation with Gulf allies is no coincidence. Political and military guarantees must translate into tools that are actually available where the threat arises.

Even if the primary guarantor has shortcomings, partners must assess how much they depend on its protection and what capabilities of their own they must develop. Economic sustainability cuts across all these conditions. Using an expensive interceptor may be justified by the value of the lives and infrastructure being protected. The difficulty arises when defense must be sustained against repeated attacks: stockpiles, production capacity, maintenance, and the availability of different responses then become decisive.

A hostile actor may seek to deplete defensive resources and exert sustained pressure even without causing material damage every time. Increased spending must therefore be accompanied by decisions consistent with the threat. It is necessary to assess which capabilities are being acquired, how quickly they can be updated, and how they are integrated into the national organization.

Operational experience must reach industry, research, and decision-makers in a timely manner consistent with the evolution of equipment and methods of employment. The speed of adaptation becomes a component of power, alongside the quantity and quality of available resources. For all states, the U.S. warning therefore requires a review of the readiness of the entire national system.

Military capabilities must be accompanied by information sharing, clear lines of responsibility, and the ability to respond promptly to identified vulnerabilities. When an adversary conceals its role and distributes pressure across civilian and military spheres, recognizing the pattern linking its actions becomes essential to countering it.

The state’s freedom to pursue its own interests without having its decisions influenced by sabotage, disruptions, and intimidation also depends on this capability.

Formiche.net, October 19, 2026 (English translation)

Original Italian article: https://formiche.net/2026/10/droni-e-guerra-ibrida-cosa-rivela-lallarme-usa-sulla-sicurezza-degli-stati-scrive-preziosa/