What's Changing

On 31 August the National Prosecutor's Office opened an investigation into foreign-intelligence activity and a terrorist-type offence over a fire started with an incendiary device at WB Electronics in Skarżysko-Kamienna; warehouse premises were destroyed and the damage is at least 15 million złoty (Prokuratura Krajowa, 31/08/2026). The next day the deputy interior minister said protection plans at key defence plants must be richer than at this one, promised recommendations and more police presence, while defence24's deputy editor judged the fence to be at allotment-garden level and put the duty of protection on the firms; counter-drone systems cannot be used in Poland in peacetime (money.pl, 01/09/2026).

On 2 September the head of counter-intelligence at Denmark's PET said Russian services were actively preparing sabotage against the Danish defence industry, named arson, and urged the firms to raise their own security (Kristeligt Dagblad, 02/09/2026). Ten days later, after explosions at an Emco depot, Bulgaria's interior minister found “a neglect of the conditions under which explosives and ammunition are stored” and said: “Since the owners cannot take measures, the state will step in and do what is necessary. We see a lot of shortcomings, not only in this enterprise,” he said. Emco answered that the warehouse had passed seven ministry inspections this year and that none of more than 10 similar incidents had been solved (The Sofia Globe, 12/09/2026). In the same fortnight Estonian investigators were probing possible Russian involvement in a fire at a supplier of unmanned ground vehicles to Ukraine, and Slovakia foiled an arson attempt on a drone maker (Atlantic Council, 03/09/2026).

The rulebook these sites fall outside is fresh. Under the CER Directive “Member States shall identify critical entities by 17 July 2026”; the Directive covers eleven sectors, from energy to food, and defence manufacturing is not among them (European Commission, accessed 16/09/2026). The Commission's guidance of 10 July addresses “drone attacks, hybrid threats and other antagonistic threats” for the entities that are designated (European Commission, 10/07/2026). The EU money aimed directly at the plants is the line CEPA found in the EDIP work programme, which “offers recipients up to €500,000 per project to physically protect production sites” (CEPA, 23/04/2026).

Why This Matters Now

This lands on defence primes and their tier-2 suppliers, on procurement agencies, on interior ministries that now inspect and instruct, and on the underwriters behind new production lines. The assumption to revise is that site security is a fixed overhead the firm carries at pre-2022 levels. On this summer's evidence it is a standard the state sets after each incident, with no money attached. Boards should cost the standard an interior ministry would impose after a fire at their own site, put that figure into current bids, and decide whether to seek designation or keep the cost private. This report's reading is that the demand arrives either way; the choice is whether it arrives priced.

Decision-action posture for this signal: Prepare — three governments have already told plant owners to raise security, but no designation, contract standard or funding line yet exists, so the protection cost should be sized and written into bids before the May 2027 CER obligations and the next EDIP calls fix it from outside.