Freedom of Information data released this week puts the figure at 340 drone-related security incidents at or near Ministry of Defence sites in the twelve months to August 2026. In 2024 it was 126. In 2025 it was 250. Nobody at the MoD has said who is flying them.

The numbers
2024: 126 incidents
2025: 250 incidents
2026 (to August): 340 incidents

That is close to a threefold rise in two years, and the MoD's own explanation only partly accounts for it. The department says some of the increase reflects better detection equipment and improved reporting, not purely a bigger threat. It has also restricted airspace over 204 defence sites and put £750 million behind new counter-drone systems, so it is not treating the trend as noise.

What the MoD has not done is name a source. Not a country, not a group, not even a category of actor. The incidents sit on the books as unattributed.

A statement from Moscow, in the same week

The data landed days after Russia's foreign ministry summoned the UK's deputy head of mission in Moscow to protest British weapons supplies to Ukraine, and warned that British facilities used to support strikes on Russian territory "shall be considered a legitimate target." The Foreign Office dismissed the warning as deflection from Russia's own invasion of Ukraine and reaffirmed its support for Kyiv.

No one, official or otherwise, has linked that statement to any of the 340 incidents. But a near-daily unauthorised drone presence over defence sites lands differently in a week when a named state actor is publicly discussing legitimate targets, and security teams tracking physical risk rarely get to treat geopolitics and perimeter security as separate problems.

Former defence minister Tobias Ellwood, who has been raising this well before this week's figures, said surveillance drones "could relatively easily be adapted to carry weapons." His sharper point was this: "We are doing nothing about protecting our critical national infrastructure."

What Ellwood is actually pointing at

On its own, the MoD data reads as a defence story: military bases, a defence budget, a defence bill working its way through the Lords. But it's really a perimeter security story that happens to have started at a military fence line, and the response so far has stayed on the military side of that fence.

The Armed Forces Bill, debated in the House of Lords on 2 September, would give military personnel the legal power to shoot down drones near bases, bringing the UK into line with neighbouring countries that already have that authority. Set against the £750 million counter-drone investment, military sites are getting new money, new technology and a new legal power at roughly the same pace the incidents are rising.

Ports don't have that. Energy sites don't have it. Water infrastructure, major stadiums and transport hubs don't have it either. If Ellwood is right that non-military critical infrastructure is comparatively unprotected, the more useful question isn't how the MoD is responding. It's what an equivalent response looks like for a site with neither the MoD's budget nor its legal cover to act on what it sees overhead.

That question is harder to answer than it should be, because no one outside government has published a comparable incident count for non-military sites. The sector being asked the hardest questions about drone threat and response is, for now, the one with the clearest picture of its own numbers.

A live example of the gap

On 16 September, departures were briefly halted at Heathrow after a suspected drone sighting near Terminal 5. Twelve minutes, one runway sweep, and normal operations resumed. No one, not Heathrow, not the Metropolitan Police, not NATS, not the Civil Aviation Authority, has confirmed a drone was actually there.

That is the gap in miniature. A civil site of genuine national significance has an incident, responds sensibly, and is left without the attribution or confirmation infrastructure to say definitively what happened. A comparable incident at a defence site now sits inside a formal, funded, increasingly well-instrumented reporting and response system instead.

What this means for security teams outside the wire

For CNI, transport, ports and major venue security leaders, three things in this data are worth carrying into planning conversations rather than filing away as a defence-sector curiosity.

The rate of rise is the first. A near tripling in two years doesn't plateau quietly on its own, and "better detection is finding more of what was already there" is a different claim from "the threat hasn't changed."

The attribution gap is the second. The MoD, with more resources than almost any other operator in the country, still can't say who is behind the incidents it's counting. Sites without that reporting infrastructure should assume they know even less about what they're looking at.

The investment signal is the third. Wherever government puts new money and new legal authority tends to become the reference point regulators and boards ask about later. A defence-sector response that visibly outpaces the civilian one sets up a comparison that board-level risk conversations will eventually have to answer, whether or not anyone in the room raises it first.

What happens next

The Armed Forces Bill continues through the Lords. The MoD's 204 restricted sites and £750 million programme will keep generating data of their own. None of that answers the question Ellwood raised, because it isn't really a defence question. It's an infrastructure question, and the infrastructure it's about isn't the infrastructure currently being funded.

Register your interest for The Security Event 2027  

Subscribe to The Security Briefing for monthly updates!