Belgium 2025: Lessons from a surge in drone incursions 

In late 2025, a significant wave of unexplained drone sightings disrupted operations at major airports, military bases and critical national infrastructure (CNI) in Belgium. 

The incidents raised urgent questions about security, surveillance and national resilience. 

Roke’s Intelligence team used Crucible®, its global intelligence and geopolitical risk reporting tool, to analyse these incursions. The results combined 175 data sources into one interface, delivering a week’s worth of work in minutes. In this article, we explore the results Crucible® generated, how it achieved this, and what the analysis means for security forces looking to counter incursions from uncrewed aerial systems (UAS) such as drones.  

Crucible® displays incidents geospatially, which can reveal concentration patterns in specific regions and provide a complete visualisation of each event. Allied to this is its temporal analysis of multiple events to identify whether incidents are clustered into distinct periods – an indicator of whether they are random or part of a coordinated campaign.  

Crucible® integrates multiple data sources, including Armed Conflict Location and Event Data (ACLED). This source provides detailed vignettes for each incident: timelines of events; direct quotes from security forces, and evidence of response inadequacies and classification failures.

Additional sources such as local media outlets (e.g., TV Limburg, regional sources) help verify and enrich this data. 

The platform also has the capability to overlay infrastructure capabilities as part of its analysis. This combines CNI mapping to correlate incidents with their proximity to key facilities such as gas power plants, water infrastructure, airports, military bases and nuclear facilities.   

Crucible® reported 21 incidents of unexplained drone sightings over two separate 24-hour periods (November 4-5 and November 12-13). These were primarily concentrated in the eastern region of Belgium, an area dense with critical national infrastructure. 

The clustered nature of the incidents suggests they were coordinated and part of a concerted campaign rather than random activity. The key locations targeted by the drones included multiple military sites and Air Force bases (Florennes, Vlanden), Brussels and Liège airports, and a nuclear power plant in Vlanden – violating a no-fly zone. 

The analysis clearly outlines a confused and delayed response from authorities. Belgian police could not identify drone types or operators, describing it as “almost impossible” to trace pilots. Response teams were mobilised but often arrived after the drones had departed, and one incident involved a pilot being targeted with a laser beam. The delay in response times did not improve over time, with clear evidence of repeated targeting – for example, “third consecutive day of sightings at this location”. 

The incidents analysed through Crucible® demonstrate that without effective detection and classification tools, security forces cannot respond effectively. The reported confusion and inability to identify threats underscore the need for integrated systems that provide:

• Strategic intelligence: Where to deploy resources 

• Tactical detection: What the threat is 
• Appropriate effects: How to counter it 

Crucible® can provide the foundational layer of strategic intelligence needed provide a consolidated, regional, national and international picture to policy makers to inform response options and to defend against future drone incursions.

It does this by providing a holistic operational view impossible to achieve from localised sources alone. This includes real-time monitoring and correlating drone incidents across regions, pattern recognition, and prioritisation of deployment zones for counter-UAS systems. 

For the tactical detection layer, defenders need a system to deploy counter-UAS detection systems at priority sites, which includes a classification capability to identify drone types, as well as visual and acoustic sensors for comprehensive detection. 

Roke’s CORTEXA GUARDIAN is a small, rapidly deployable Counter-UAS solution.  

CORTEXA GUARDIAN is an example of Roke’s ability to fuse software with the best off-the-shelf technology (including a range of effectors).. This offers a modular, open standard approach that serves as the foundations to construct a full Counter-UAS system, whether you need a portable system for use in the field or hardware mounted on bases and vehicles. As the drone threat shifts, CORTEXA GUARDIAN can evolve to counter it. 

Supporting the strategic and detection levels is the effects layer, which deploys Electronic Warfare (EW) capabilities to jam Radio Frequency (RF) control links, trigger return-to-base (RTB) functions, and force UAS into controlled landings for recovery and analysis. However, RF effectors are ineffective against fibre-optic drones, increasingly used in conflicts like Ukraine. Instead of an RF effector, these drones require kinetic solutions such as nets, projectiles or physical counter-drones.

The Belgian case underscores the growing threat from unidentified UAS.  Belgium has already sought external support from NATO partners. The findings from Crucible® suggest integrating EW troops with counter-UAS training and prioritising protection of the eastern regions, where the incidents concentrated, as next steps to address this threat.  

Belgium, like other EU nations, will always face additional Counter-UAS challenges due to Schengen open borders, which allow operators to move freely. Developing cooperation protocols and sharing intelligence on UAS incident patterns across EU countries can help to address this.  

Finally, nations must clarify responsibility for counter-UAS operations and establish integrated command structures agreed between military and specialised police intelligence units, to avoid being caught unawares. This can empower security forces to shift from a delayed, reactive “surge response” to a proactive “overwatch” position, which is essential to future resilience.