C-UAS perspectives on critical infrastructure resilience

Thought leadership

The rapid proliferation of unmanned aerial systems (UAS) is introducing a new dimension to the security challenges faced by critical infrastructure operators. As drones become increasingly accessible, cost-effective and sophisticated, they can create vulnerabilities that conventional physical and cybersecurity measures may not fully address. Organisations therefore need to consider the airspace surrounding their assets as an additional layer of their security perimeter and evaluate how drone-related threats could affect operations, physical security and business continuity.

Managing these emerging risks requires more than deploying technologies designed to detect or counter drones. Organisations should adopt a comprehensive, risk-based approach that brings together threat and vulnerability assessments, protection of critical assets, surveillance and detection capabilities, as well as clearly defined response procedures. Resilience depends on being able to detect, analyse and assess potentially unauthorised drone activity quickly, while ensuring effective coordination with the relevant authorities and stakeholders when an incident occurs.

The regulatory environment also adds another layer of complexity. European frameworks, including the CER and NIS2 directives, are increasing expectations around resilience, risk management, preparedness and organisational accountability. At the same time, infrastructure operators may face uncertainty over the measures they can lawfully implement in response to a drone incident. Understanding the interaction between regulatory obligations, operational requirements, and available security capabilities is therefore becoming increasingly important.

As drone adoption continues to expand, stronger cooperation between public authorities and private-sector operators, clearly allocated responsibilities and greater regulatory alignment will become increasingly important. Organisations that assess their exposure to drone-related risks today and integrate C-UAS considerations into their broader resilience strategies will be better positioned to protect critical assets, maintain operations and safeguard the continuity of essential services.

300+

More than 300 drone-related incidents affecting state, private and critical infrastructure have been recorded since 2022 in European countries not involved in armed conflict

Source: PwC Italy's Critical Infrastructure Security Task Force

Why this is now a Luxembourg question

Drone incidents are no longer confined to conflict zones. 2026 turned drone risk from a policy discussion into an operational question for organisations in Luxembourg.

The exposure is concentrated: an international airport and cargo hub, energy and transport networks, data centres and telecoms, EU institutions, financial market infrastructure and high-profile public events, all within a small, cross-border territory.

For a critical entity designated under the new CER law, drone scenarios belong in its resilience risk assessment from the start, not in a later update.

Key considerations for critical infrastructure operators include:

Assessing how different UAS capabilities, operating patterns and potential threat actors could affect specific sites and assets.

Prioritising critical functions, sensitive areas and potential points of disruption rather than treating the entire site perimeter in the same way.

Connecting drone detection and response with physical security, surveillance, access control, incident management and cybersecurity processes.

Establishing procedures not only for detection, but also for identification, assessment, escalation, response and post-incident analysis.

Ensuring that C-UAS capabilities are supported by clearly defined responsibilities, trained personnel and appropriate coordination mechanisms.

Using exercises and simulations to identify gaps between technical detection capabilities, operational procedures and the response of relevant stakeholders.

How PwC Luxembourg can help

We connect four dimensions that are often handled separately: risk, regulation, operations and technology. Our Luxembourg regulatory and public sector teams work with PwC's European counter-drone and drone technology specialists.

Assess
Site-level drone threat and vulnerability assessment, aligned with your CER and NIS2 risk management.
Design
Governance, decision rights, escalation procedures and a clear map of who may act, agreed with public stakeholders.
Evaluate
Detection and response options, integration needs and vendor solutions tested against your scenarios and legal limits.
Validate
Tabletop and live exercises across the full response chain, followed by a prioritised implementation roadmap.

The aim is not more technology. It is a proportionate capability that works in your operating environment and within Luxembourg's institutional set-up.