Preparing for a drone attack

In each episode, we're joined by experts, who help us better understand some of the most important geopolitically related issues shaping today's risk landscape. Today's episode, focuses on the growing threat posed by drones and what organizations can do to prepare for it. To explore this issue, I'm delighted to be joined by three of my colleagues with expertise spanning threat intelligence, risk modeling and insurance solutions.

First, Patrick Rogers, who advises clients on terrorism, political violence and security threats around the world, and will help us understand how the drone threat is evolving. We're also joined by Jason Marshall, whose work focuses on catastrophe modeling and risk analytics, helping organizations quantify, and understand emerging threats.

And finally, Phil Seel, a specialist in terrorism, political violence and active assailant insurance solutions, who will discuss the risk transfer and resilience considerations, organizations should be thinking about. Patrick, Jason and Phil, thank you very much for joining me. Patrick, we seem to be hearing more about drones than we did a few years ago. Why are we seeing drones more frequently and where are they increasingly being used?

PATRICK ROGERS: Thanks, Peter. Yeah I mean, drones have become a very topical conversation in the last year in particular, especially when looking at the advancements in Ukraine, in the war there, but also, obviously, what's taken place in the Middle East. But I think the key thing to say is that, drones are not the future threat, they are already extensively used in conflicts, and also by some lower level criminal groups as well.

So the reality is that, the barrier of entry to using drones by anything from criminal groups to terrorists to activists even, significantly reduced over the last few years. As we've seen that development that, sadly, war always produces, in terms of improving technology around drones and making them much more available to everyone.

So what we have today is a range of drone systems, everything from kamikaze drones, that are intended not to come back through to quadcopters, and other things that have multi-purposes that can be used in different ways by bad guys. And I think, really, where we're seeing things develop is, as I say, criminal groups and others, starting to use these. And the fact that the reality is that in the Western world, we will start to see this more.

Already in Europe, we have actors, state actors, using drones against commercial operations. And the reality, really, is it's no longer a question of, when this technology will be used against civilian or commercial targets, it's really around, when are we likely to see it used more regularly? And what could that mean for businesses?

PETER BRANSDEN: So this sounds like an obvious challenge to those that are in charge of the safety and security of operations. But can you talk us through, exactly, how drones complicate traditional security planning?

PATRICK ROGERS: Yeah, I mean, it's almost a sort of vertical horizontal point to start with, really. So security in its design, in doctrine and methodology, is really around securing the ground. And everything above it still needed security, but it was a much easier problem. So we have organizations that have invested heavily in gates, in guards, in CCTV and so on, and even in high risk environments, where there's maybe more of a viable or plausible risk of a stand off weapon, so

something like a rocket propelled grenade or a small mortar being used. They would build in a standoff distance, and some monitoring that goes a bit further out to mitigate the risk ultimately. What drones introduce is the fact that, many of those measures, as I say, are for ground level, and there aren't strong protective measures above that.

And also, these attacks can also originate from several kilometers away, operating well beyond the line of sight. And also, it can follow unpredictable flight paths. So what that leaves organizations with, is quite a complicated issue to resolve. What we have in terms of attack versus defense is a little bit out of proportion at the moment.

So the attack method, the drones are much easier to get your hands on and use. And sadly, the defense mechanisms at the moment are very expensive, quite complicated systems. That barrier is also coming down, but it's taking a time. And we have, right now, anyway, a misalignment with that.

So you have that, as a sort of, how do we prevent it? And also, you have to start to consider things like, do you want to shoot down a drone? Depends on your operation, but that may be more costly, to shoot down something that explodes than taking it down by other means. So it's a complicated issue to resolve. And frankly, I don't think we're quite at a point yet where, certainly, commercial organizations have fully got their head around how to.

PETER BRANSDEN: Yeah complicated, indeed. And I think, many of the listeners will, myself included, associate drones with explosives and some of the weapon scenarios that you've mentioned before. But are there any other threats posed from drones beyond carrying a weapon or an explosive payload?

PATRICK ROGERS: Yes, yeah. It's a really good question. Because as you say, terrorism actually in its sense doesn't need to involve an explosive, and certainly in a drone capacity, it doesn't either. The point of terror is it can form in many different ways.

So the idea of potentially a drone, for instance, dropping a substance, could even be water, it could be oil, a powder over a crowd, could in itself trigger the impact, which could be a crowd crush, could draw them into another form of attack and so on and so forth.

So actually, a drone doesn't need to explode. And explosives is the difficult thing to get your hands on, if we think about certainly a Western environment. So being able to potentially disrupt a concert, race meet, whatever it is, a large political gathering, whatever it is, by using drones is certainly a viable risk.

And the consequences of that to businesses, potentially the same as well. You could still have significant injury, loss of life, damage to property and business interruption, and the sort of ongoing associated costs of a large police cordon, and so on, around an operation.

PETER BRANSDEN: So thanks, Patrick. We've established that drones are becoming increasingly common, and present a unique challenge from a security perspective. And I suppose the next natural question is, how organizations can assess and quantify that risk? Which is where I want to bring in Jason Marshall. Jason, when it comes to modeling this threat, what principles do you apply, and what factors matter most?

JASON MARSHALL: At a high level, we think about three things, hazard, exposure, and vulnerability. The hazard is the event itself. So what type of drone or weapon are we modeling? What is the explosive payload? How fast is it traveling? And where does it actually detonate? A near miss, a direct hit on the roof of a facility, or a drone penetrating the building itself before detonating inside, can all produce very different outcomes.

So then, there's the exposure. What is actually at the facility? How is the building constructed? What are its dimensions? What's inside it? Where's the critical equipment located? And what are the financial values associated with the structure and contents?

And then finally, the vulnerability aspect of modeling relates to how those different assets respond to the physical effects of the attack. The building itself may be relatively robust, for instance, but sensitive equipment inside could be much more vulnerable. So the goal, really, is to bring these three pieces together, that's define a credible threat, understand what's exposed, estimate how the different assets respond. And then, quantify the resulting loss, so that we can move from the physics of the event ultimately into a financial loss estimate.

PETER BRANSDEN: And in doing this very important work, what have you found to be the biggest challenges when it comes to modeling drone attacks compared to the more, let's say, traditional terrorism scenarios?

JASON MARSHALL: Yeah. One of the challenges with drone modeling, compared with the more traditional bomb blast modeling, is that you can't necessarily take a conventional two-ton truck bomb blast model, produce the explosive weight to match the payload of a particular drone, and then call that a drone model.

The geometry of this attack, of a drone attack, is very different. A Vehicle-Borne Explosive Device, or a VBIED, is generally constrained to detonating at or near ground level. And of course, the detonation is constrained to wherever a vehicle can physically access. So roads, control points, other security infrastructure, they all limit how close that vehicle can get to a target. A drone doesn't necessarily face those same access constraints, it can approach from above, and potentially deliver a smaller explosive payload, but it's much closer to or directly onto even a specific part of the facility.

And ultimately, that means precision, and the ability to attack from above become much more important, because the drone might strike the roof or target a piece of critical equipment. And so, even though the overall explosive payload may be smaller than a large VBIED, which is done in the more traditional bomb blast modeling, the location of the detonation can materially affect the resulting damage.

And that also makes understanding the facility just much more important. We need to know not just the monetary value of the site, but where the critical and high value assets are located, and how vulnerable they are to a highly localized attack.

PETER BRANSDEN: Yeah, it's super interesting. And you've clearly got your work cut out for you with this. I think when many listeners will hear the words drone attack, we will immediately catastrophize and imagine the worst case scenarios. But how important is it to focus on the plausible threats rather than extreme hypotheticals?

JASON MARSHALL: Yeah, I think that distinction is extremely important. Because technically speaking, you can construct almost unlimited worst case scenarios. But what we're trying to do, is model for clients something that's severe, but still credible. And that's where concepts such as Probable Maximum Loss, or PML, and Maximum Foreseeable Loss, an MFL, that's where the distinction can be useful.

Within PML, we're asking, what does a severe but credible loss scenario look like? Whereas with an MFL, we're pushing further toward the extreme, and we're asking what the loss could look like under a more severe but still foreseeable set of assumptions. So a slight distinction there. And in our work modeling drone attacks on a data center, for example, we looked at several scenarios.

In PML terms, you might look at a severe but credible event, like a drone directly striking the facility and detonating on impact. You're assuming a successful attack, so it's already a severe scenario. But you're not necessarily layering on a series of additional adverse assumptions. For an MFL-type scenario, for example, one could say the weapon successfully penetrates the roof, enters the facility, and then detonates internally, where the blast could interact much more directly with the structure and high value equipment.

Ultimately, understanding all these different factors and types of scenarios, they allow us to model something that gives our clients a more useful basis for deciding how much of the risk they're comfortable retaining, and how much they may want to transfer.

PETER BRANSDEN: Thanks, Jason. Understanding the threat and quantifying the exposure are, of course, important first steps, but for many of our clients and for many organizations, the next question obviously is going to be, how are those risks addressed through insurance and other resilience methods?

Which is where I want to bring in Phil Seel. Phil, if a corporate risk manager is listening to this conversation, they might, maybe, assume that their standard property insurance policy is going to respond to a drone attack. Is that always going to be the case?

PHIL SEEL: Thanks, Pete. Not necessarily. And that's one of the biggest misconceptions that we see. You see, when most people think about property insurance, they're thinking about events like fires, storms or accidental explosions. Now, a drone attack is different because you're dealing with an intentional act. And for many, that immediately raises questions around terrorism, political violence, sabotage, or even military activity.

The challenge is that those issues are often treated very differently under insurance policies. For example, if an attack is considered terrorism, there may be a terrorism exclusion. If it's linked to a state actor or a military operation, then war exclusions might become relevant. When looking at drones, it's particularly tricky as the answer isn't always obvious. Here's why.

After an attack, investigators may spend a significant amount of time trying to determine who was responsible and why it happened. And until that's been understood, that can be real uncertainty around which insurance policy responds, and whether coverage applies. Now, this generally, for us, explains why many organizations, particularly those with critical assets or significant public exposures, purchased dedicated terrorism and political violence insurance.

Those policies are built specifically for these kind of scenarios. So in summary, if there's one thing I'd encourage risk managers to do, it is not to assume that a drone attack will automatically be treated as your standard property claim.

PETER BRANSDEN: So, Phil, you touched on this, but I wanted to focus on why attribution is so important from an insurance perspective?

PHIL SEEL: Pete, simply put, attribution can ultimately determine how an event is classified, and which insurance policy responds. So if a building catches fire, it's usually pretty clear what happened. But with a drone attack, it's often much more complicated. Questions arising will be, was it a terrorist act? Was it criminal activity? Was it maybe politically motivated? Or was even a nation state involved?

And those questions, the answers to those questions can take weeks, months, or sometimes much longer to obtain. So from an insurance standpoint, that obviously matters because different policies are triggered by different circumstances. The classification of the event can really influence whether a terrorism policy responds, or whether it's a political violence policy that will respond, or if an exclusion applies.

But honestly, here's the practical reality that we see, is organizations can't afford to sit around waiting for the investigator to reach a final conclusion. The moment that an incident occurs, decision makers in an organization need to protect their employees, they need to communicate with their customers, and their stakeholders, they need to manage the media, and they need to get their operations back up and running fairly quickly. And those decisions will happen immediately.

And for us, that's one of the reasons we've seen growing interest in active assailant and malicious attacks standalone insurance solutions. Because these products can really complement your traditional terrorism and political violence coverage by focusing on the event itself rather than requiring a formal determination of a motive before coverage or support is available. So in summary, I guess, attribution is hugely important for insurance recovery. But resilience is really also about being prepared, and to be able to respond effectively regardless of how that actual event is ultimately categorized.

PETER BRANSDEN: So Phil, beyond let's say, traditional property insurance, what risk management tools should organizations be considering to help prepare for and respond to drone related incidents?

PHIL SEEL: Thanks, Pete. So insurance is definitely part of the solution, but it's important to bear in mind it's only one piece of a much wider resilience strategy. So when people hear drone attacks, most will generally think of, and focus on physical damage. So that's not wrong, but in many cases, that's only the beginning of the challenge. Because you could have, in addition to the physical damage, operational disruptions, employee casualties or concerns, impact on your customers, intense media scrutiny or and a leadership team having to make very critical decisions under a lot of pressure.

And that's where insurance falls short. And that's why the preparedness is so important. So realistically, organizations should be thinking about business continuity planning, crisis management procedures, well-defined communication plans, and knowing how they would actually operate in the hours and days following an incident.

And this is also where active assailant and crisis response solutions can be extremely valuable. Because in addition to the insurance coverage, many of these programs will provide clients with access to specialist support. So think about crisis response consultants, emergency response coordination, access to employee counseling services, access to public relations support and recovery planning expertise.

And that leads us into recovery itself because these resources can make a significant difference in how the client manages the aftermath of an event that they've incurred, and how they can navigate out of this. And then, from there, we go into what we call the recovery process.

Because at the end of the day, cover is not just about repairing the physical damage to your building or replacing damaged assets. It's increasingly much more about protecting your people, maintaining the confidence of investors and customers, restoring operations, and ultimately helping the organization move forward and beyond the incident.

And companies that tend to recover best, are usually those that have done the work beforehand. They've thought about, they've thought through these scenarios, they understand their exposures, and they clearly know who they are going to call when something unexpected happens.

PETER BRANSDEN: Thanks, Phil. And before we wrap up, I'd like to ask each of you the same question. If there's one thing you'd like organizations to take away from today's discussion on drone threats, what would it be? I'll go straight to you, Patrick.

PATRICK ROGERS: Yeah, I think it's just primarily recognizing the advancement of the threat, and how it will impact you as an organization moving forward. As I say, sadly, the train has left the station, and the technology around it is becoming more advanced and we will see this being deployed more. Some organizations are more exposed than others, but you need to understand this now as opposed to when it happens.

JASON MARSHALL: Yeah, if there's one thing I'd want clients to take away, it's the importance of understanding their portfolio at a more granular level. The better we can understand the characteristics of individual facilities, the location of critical assets, and the values at risk, the more accurately we can model and understand the exposure. And of course, as modeling technology continues to develop, it'll be really interesting to see how much further we can push that level of detail and precision.

PHIL SEEL: For me, it would be don't assume that a drone attack is simply a property loss, number one. Number two, review how your program addresses terrorism, political violence, war-related exclusions, third-party liability, and crisis response. Because ultimately, these issues will determine whether the loss is covered or not.

PETER BRANSDEN: Patrick, Jason, Phil, thank you very much for joining me today, and sharing these really helpful insights. So I think one of the key themes from today's discussion is that, while drone technology continues to evolve, organizations don't need to wait for an incident before taking action. And understanding the threat, assessing vulnerabilities, evaluating the resilience, and the insurance solutions available can all play an equally important role in strengthening preparedness.

And thank you all for listening to this Geopolcast. To receive future episodes as soon as they're released, please make sure you subscribe to the Geopolcast through your preferred podcast platform. You can also share the podcast with colleagues and friends, who may be interested in understanding how geopolitical developments are shaping today's risk environment. Thank you for listening and join us next time for another episode of Geopolcast.

SPEAKER: Thank you for joining us for this WTW podcast featuring the latest perspectives on the intersection of people, capital, and risk. For more information, visit the Insights section of wtwco.com.

Willis Towers Watson offers insurance-related services through its appropriately licensed and authorized companies, in each country, in which Willis Towers Watson operates. For further authorization and regulatory details about our Willis Towers Watson legal entities operating in your country, please refer to our Willis Towers Watson website.

It is a regulatory requirement for us to consider our local licensing requirements. The information given in this podcast is believed to be accurate at the date of publication. This information may have subsequently changed or have been superseded, and should not be relied upon to be accurate or suitable after this date.

This podcast offers a general overview of its subject matter. It does not necessarily address every aspect of its subject or every product available in the market. And we disclaimer all liability to the fullest extent permitted by law. It is not intended to be, and should not be used to replace specific advice relating to individual situations.

And we do not offer, and this should not be seen as legal, accounting, or tax advice. If you intend to take any action or make any decision on the basis of the content of this podcast, you should first seek specific advice from an appropriate professional.

Some of the information in this podcast, may be compiled from third party sources we consider to be reliable. However, we do not guarantee and are not responsible for the accuracy of such. The views expressed are not necessarily those of Willis Towers Watson. Copyright, WTW, 2026. All rights reserved.