From Ukraine's jet-powered drone campaign to NATO's Black Sea frontier and the protection of critical infrastructure.
AiSS Intelligence | Cover Story | Pilot Issue No. 1 | 26 October 2026
On 23 October, a merchant vessel sank in the Black Sea, just beyond Romania's territorial waters. The Comoros-flagged Khoryv had reported a drone attack approximately 13 nautical miles from Constanța. Of the 13 sailors aboard, nine were rescued, one was confirmed dead and three remained missing as search operations continued.
The incident followed a succession of attacks on commercial shipping near the coasts of Romania and Bulgaria, both NATO members. Six days earlier, Romanian F-16 fighters had intercepted and destroyed two jet-powered Geran-family attack drones that entered Romanian airspace over the Black Sea.
These were different incidents, raising different legal and operational questions. One involved the defence of sovereign airspace; the other, the protection of commercial navigation beyond territorial waters. Together, they exposed a security problem that the war in Ukraine has made increasingly difficult to contain within familiar geographical boundaries.
On 20 October, NATO announced additional maritime patrol aircraft, radar systems, drones, intelligence personnel and forensic capabilities for the Black Sea. Two days later, the European Parliament called for consideration of an EU naval operation to protect commercial navigation.
The response was gathering momentum. The institutions responsible for delivering it still faced a more complicated task.
Drone warfare is moving beyond the battlefield faster than the arrangements for protecting the spaces it now threatens.
The immediate challenge concerns aircraft, sensors and interceptors. The deeper challenge lies in the connections between surveillance, authority, military response and the continuity of civilian life.
Reconstructed visual inspired by Romania’s reported F-16 drone interception operation, 17 October 2026.
1. The War Moves Beyond the Front Line
Ukraine has demonstrated the tactical and operational reach of uncrewed aircraft on an extraordinary scale. Small drones observe and attack targets close to the front. Long-range systems strike infrastructure far behind it. Inexpensive decoys complicate air-defence calculations, while faster and more capable aircraft reduce the time available for interception.
The effects have not remained within Ukraine.
Romania's Ministry of National Defence reported that on 17 October its surveillance system detected aerial targets approximately 120 kilometres east of Snake Island, heading southwest. Two F-16 fighters scrambled from Borcea Air Base at 17:43. The first drone entered Romanian airspace at 17:59 and was destroyed two minutes later. A second entered at 18:01 and was destroyed at 18:05.
The ministry subsequently identified both as jet-powered Geran-family attack drones. It also reported four other brief drone incursions during the preceding week.
The interceptions demonstrated an ability to detect and defeat the threats. They also showed the narrow interval between an aircraft's entry into national airspace and the moment at which a decision had to become action.
Commercial shipping presents a different problem.
Merchant vessels moving through the western Black Sea are essential to regional trade and Ukraine's agricultural exports. The Sulina route connects the Danube to the Black Sea, providing access to ports and export networks whose importance has grown as Ukrainian maritime facilities have come under attack.
When drones strike vessels near these routes, the consequences spread beyond their immediate targets. Seafarers are placed at risk. Maritime rescue services may be required. Ports, insurers, shipping companies and governments must reassess the conditions under which commercial activity can continue.
The Khoryv sinking made the human cost particularly clear.
Romanian President Nicușor Dan attributed the attack to Russia's escalation of its war against Ukraine. The European Parliament also held Russia responsible for the recent attacks on commercial vessels. NATO, however, had not publicly attributed each of the maritime strikes to a specific actor as of 23 October.
The distinction should be preserved. Political assessments of responsibility, operational intelligence and confirmed forensic findings do not carry identical evidentiary weight.
Yet uncertainty over attribution does not remove the need for protection.
The danger to a merchant vessel is real even while investigators are establishing who launched the weapon. This is one reason maritime drone threats create a difficult security environment: protective decisions often have to be taken before the full circumstances of an incident are known.
The boundaries of the conflict may remain legally defined. Its exposure is much wider.
2. Speed Is Changing the Defence Equation
A second development is changing the nature of the defensive task.
On 22 October, Ukraine's Air Force reported that Russia had launched 210 attack drones during an overnight operation, including 110 described as jet-powered. By 09:00 that morning, Ukrainian defenders said they had shot down or suppressed 181 drones, including 87 jet-powered aircraft.
Those figures were preliminary Ukrainian operational reports, not independently verified final results. They also combined aircraft destroyed physically with those suppressed by other means.
Nevertheless, the reported number of jet-powered drones indicates a substantial change in the composition of the threat.
The earlier Shahed-derived, propeller-driven Geran family placed pressure on defenders through range, persistence, numbers and relative affordability. Jet propulsion introduces a different set of demands.
Greater speed reduces the time available between detection and engagement. It can alter the performance requirements for tracking systems, interceptors and command arrangements. Defences developed primarily against slower targets may not perform equally well against faster ones.
The challenge is best understood through the warning chain.
A sensor must detect an approaching aircraft. The information must be assessed, associated with an existing track and distributed to the relevant command authority. A response must then be selected, authorised and executed.
Sensing → assessment → distribution → decision → action.
The sequence appears straightforward. In practice, its stages are distributed across equipment, operators, organisations and sometimes national jurisdictions.
A radar may detect a target before the responsible unit receives usable information. Classification may remain uncertain. Different weapons may be available, but not equally appropriate. Engagement authority may depend on the target's position and the potential consequences for civilian air or maritime activity.
When the threat is fast, each delay consumes a larger share of the remaining response time.
Speed is only part of the problem. Numbers and target diversity impose additional strain.
Attackers can combine drones of different performance levels, decoys and missiles. Defenders must decide which threats require costly air-defence missiles, which can be engaged by specialised interceptors or guns, and which may be disrupted electronically.
That decision is both operational and economic.
Expensive interceptors cannot be expended indefinitely against every inexpensive aircraft. Yet a low-cost defensive system may be unsuitable against some high-speed targets. The search for an affordable response therefore cannot be separated from the requirement for reliable performance.
The resulting need is not simply for more weapons. It is for a layered defence in which different systems share enough information to respond appropriately.
The value of a faster interceptor is limited if the warning arrives too late. A capable sensor is of limited use if its information cannot reach the authorised decision-maker.
The performance of the whole chain matters.
Drone threats are extending beyond the battlefield, exposing commercial shipping and critical maritime infrastructure to new security risks.
AI-generated illustration: AiSS Intelligence.
3. The Black Sea Tests NATO's Security Architecture
The western Black Sea has become an immediate test of these principles.
NATO's announcement of 20 October placed considerable emphasis on maritime surveillance and information sharing. Allied contributions included additional patrol aircraft, radar systems, drones, intelligence personnel and specialists capable of examining recovered explosive material.
The composition of that response is revealing.
An alliance cannot protect an area effectively without a sufficiently reliable understanding of what is taking place within it. Before deciding whether an aircraft can be intercepted or a maritime threat engaged, military commanders must know its position, likely direction, classification and relationship to the relevant jurisdiction.
The Black Sea complicates those decisions.
Romanian and Bulgarian territorial waters sit beside international maritime routes and areas affected by the war in Ukraine. Aircraft may cross airspace boundaries within minutes. Commercial ships may be attacked outside the sovereign territory of an allied state but close enough for the consequences to affect its security and economy.
The legal basis for responding is not the same in every location.
The defence of an aircraft or installation within national territory, the protection of a commercial vessel on the high seas and a military operation conducted within a wider regional security framework involve different authorities and risks.
NATO's collective-defence commitments do not mean that every incident affecting commercial navigation automatically triggers a particular military response.
The European Parliament's resolution of 22 October reflected growing political pressure to address this gap. Adopted by 432 votes to 52, with 88 abstentions, it urged consideration of a European naval operation and additional support for Romania and Bulgaria.
It did not establish such an operation.
That distinction illustrates a recurring problem in security policy. Political recognition of a threat can develop quickly. The procedures, operational mandates and capabilities needed to respond across institutions require further decisions.
Additional aircraft and sensors may strengthen awareness. They do not, by themselves, settle questions about maritime escort missions, rules of engagement or responsibility for protecting particular vessels.
The alliance must therefore connect three requirements: a shared operational picture, clear national and collective authorities, and forces capable of acting within those authorities.
The test is as much institutional as technological.
4. Civilian Infrastructure Enters the Defensive Perimeter
The challenge extends beyond the Black Sea.
Airports, ports, energy installations, telecommunications facilities and major industrial sites have become increasingly exposed to aerial threats that were once addressed primarily through military air defence.
These facilities differ considerably from military bases. They must remain accessible to workers, service providers, transport operators and the public. Some contain hazardous materials. Others support services whose interruption may affect entire regions.
Their protection requires defensive measures that are effective without creating unacceptable risks to the very systems being protected.
Across Europe, governments are reconsidering the legal responsibilities of infrastructure operators.
France adopted legislation in August permitting approved operators of designated critical infrastructure, under prescribed conditions, to undertake counter-drone measures. Germany and other European countries have been examining how to expand or clarify defensive powers.
The European Commission's February 2026 Action Plan on Drone and Counter-Drone Security had already identified the need for stronger detection capabilities, coordinated responses and closer cooperation between civilian and military authorities.
These developments point towards a common recognition: national armed forces and police cannot provide continuous, immediate protection to every vulnerable facility.
But devolving defensive responsibilities is not a simple solution.
An industrial security team may understand the facility it protects better than an external military unit. It knows where operations cannot be interrupted, which areas contain hazardous materials and what damage a falling aircraft might cause.
It may not possess the intelligence needed to identify the origin of a threat, the authority to employ particular countermeasures or the expertise to dispose of unexploded munitions.
The use of radio-frequency interference creates further complications. Disrupting a hostile drone must not inadvertently compromise legitimate communications or navigation services.
The question is therefore not whether civilian operators should replace military authorities. It is how their respective responsibilities can be linked before an incident occurs.
An effective arrangement requires more than an emergency telephone number. It needs established channels for warning, authorisation, response, evidence handling and the restoration of essential operations.
The vulnerability is not confined to Europe. Attacks affecting airports and energy infrastructure in the Middle East demonstrate that the protection of civilian economic systems is becoming a wider security concern, even where the weapons and political circumstances differ from those in Ukraine.
The common issue is continuity.
A facility may survive the immediate attack but still suffer a prolonged shutdown. The ability to preserve essential functions, contain damage and restore operations must therefore become part of the assessment of defensive performance.
5. Rebuilding the Drone Shield
The changing geography of exposure calls for a more integrated understanding of defence.
The first requirement is dependable awareness.
Radar, electro-optical and infrared systems, appropriate radio-frequency sensors and other detection technologies have different strengths and limitations. No sensor performs equally well across every environment.
Coastal clutter, adverse weather, congested airspace and differences in drone size or construction can degrade detection or classification. Reliable surveillance often depends on combining information from several sources.
NATO Allied Command Transformation's Layered Counter-UAS Initiative is examining how multiple defensive cells can share information and operate across national and technical boundaries. Each cell combines sensors, command-and-control arrangements and effectors. The wider experiment tests how these elements can function as a network.
The programme recognises an important weakness of fragmented defence: equipment may work successfully on its own while contributing less effectively to the wider protective system.
The second requirement is decision speed with accountability.
AI-assisted classification and threat prioritisation may help personnel process information under pressure. Automation can reduce delays where data quality and operational procedures support its use.
Neither removes the need for careful evaluation.
An incorrect classification may cause a defender to miss a threat or engage a harmless object. A recommendation derived from incomplete information can still appear convincing. In civilian environments, engagement decisions may carry substantial consequences for public safety.
Human oversight, clear authority and auditable procedures remain essential.
The third requirement is a sustainable combination of countermeasures.
Electronic warfare, specialised interceptor drones, guns, directed-energy systems and conventional air-defence weapons offer different capabilities. Their effectiveness depends on target characteristics, geography, weather, safety constraints and the quality of tracking information.
No single layer can be assumed to provide comprehensive protection.
The fourth requirement is industrial adaptability.
Threat characteristics can change more quickly than established procurement cycles. NATO's accelerated counter-UAS testing programmes and European defence experimentation activities are intended to shorten the interval between technical innovation and operational evaluation.
But rapid adoption must not be confused with reduced scrutiny.
Systems require testing under realistic conditions, including interference, target diversity, environmental constraints and integration with existing command structures.
Finally, the protective architecture must extend beyond interception.
Once a drone is destroyed, unexploded payloads, falling debris and the recovery of technical evidence may require additional military and civilian specialists. Infrastructure operators also need procedures for restoring services.
A defensive system should be judged by the safety and continuity it preserves, not solely by the number of targets it defeats.
These requirements point towards a broader conception of the Drone Shield: an arrangement of surveillance, judgement, authority and action, sustained by industrial capacity and institutional coordination.
Its strength depends on how well these elements remain connected under pressure.
Protecting critical infrastructure requires integrated drone detection, real-time surveillance and coordinated counter-UAS responses, linking advanced sensors, defence systems and human decision-making. AI-generated illustration: AiSS Intelligence.
AiSS Assessment
The Security Perimeter Is Expanding Faster Than the Responsibility to Defend It
The developments in the Black Sea reveal a mismatch between the geography of emerging threats and the structures through which security responsibilities are traditionally organised.
National air defence is generally arranged around sovereign territory and identifiable military assets. Commercial shipping, transport corridors and distributed industrial infrastructure operate across a more complicated landscape of public and private responsibilities.
As drones threaten these spaces, the responsibility to respond becomes less immediately clear.
AiSS assesses that the central vulnerability is not the absence of defensive technology alone, but the uneven development of the arrangements that connect detection to lawful and timely action.
Romania's interception of two Geran-family drones demonstrates that existing military capabilities can respond effectively to particular threats. It does not establish that all maritime or infrastructure-related incidents can be handled through the same arrangements.
The distinction matters because different spaces require different forms of protection.
An approaching drone over national territory may fall within established air-defence authority. A vessel outside territorial waters may require a different operational mandate. A hostile aircraft approaching a commercial energy facility may raise questions about which public authority can authorise action and what role the operator may perform.
Each creates a different organisational threshold.
For critical infrastructure, the measure of protection must extend beyond the number of drones intercepted. An engagement may defeat the approaching aircraft yet leave debris, fire or a precautionary shutdown that interrupts essential services. Ports, airports and energy operators therefore need to assess both the defensive response and the continuity of the functions it protects.
This broadens the questions asked of a counter-drone system and the institutions responsible for its use. How quickly can a warning reach the authority able to act? Which operations must stop, and which can continue safely? How are damaged assets isolated and essential services restored? As the defended geography expands, exercises should test these decisions alongside detection and interception. A successful engagement and a resilient facility are related outcomes, but each requires its own evidence.
Three developments are likely to shape the next stage of adaptation.
First, countries and alliances will face pressure to improve shared warning and surveillance across military and civilian boundaries. Investment in sensors will be most valuable where information can be distributed rapidly to those authorised to act.
Second, layered counter-drone defence will need to become more economically sustainable. The growing diversity of threats requires a combination of capabilities rather than dependence on a single expensive or technically narrow response.
Third, critical-infrastructure protection will increasingly require formal arrangements between governments and operators. Legal authority, emergency procedures and continuity planning are likely to prove as important as the equipment placed around a facility.
These are conditional assessments, not predictions of uniform change. Countries differ in their threat exposure, industrial resources and legal systems. The pace of adaptation will vary.
Several indicators deserve attention: whether NATO's increased Black Sea surveillance develops into more defined maritime-protection arrangements; whether European counter-drone legislation establishes workable rules for authorised infrastructure operators; and whether multinational technical trials demonstrate reliable information-sharing and engagement performance under realistic conditions.
A further indicator will be the extent to which procurement decisions begin measuring infrastructure continuity and operational resilience alongside interception rates.
The experience over the Black Sea does not suggest that traditional air defence has lost relevance. It remains a cornerstone of national security. What it does reveal is that an expanding security perimeter can no longer be safeguarded by military capability alone. Protection now depends on the speed and clarity with which information moves through institutions, the decisiveness of those empowered to act, and the resilience of civilian systems that must continue to function under pressure.
Capability provides the means of defence; connectivity determines its success. Security in the modern era is not defined solely by the range of missiles or the endurance of aircraft, but by the coherence of networks—between ministries, private operators, and allied partners.
The Black Sea reminds us that defence is no longer a matter of walls and weapons, but of integration, intelligence, and institutional agility.
AiSS Intelligence — Where AI, Autonomy and Security Converge.
