Something unusual happened in Saudi Arabia this September.

Drones reached critical infrastructure.

Saudi Arabia said they came from Iraqi territory.

Baghdad agreed and removed the military commander responsible for the area.

But nobody publicly identified the actual perpetrator.

Saudi Arabia chose not to retaliate.

A militarily powerful state had suffered an attack on critical infrastructure but lacked something surprisingly important:

an address to which it could confidently send the response.

That episode is useful not because drones are new.

They aren't.

It matters because it reveals a much larger structural change.

The first clock governs the availability of capabilities able to cause strategically significant disruption.

Those capabilities are becoming cheaper.

They require less specialist knowledge.

And their reach is increasing.

The second clock governs how quickly societies can respond.

That clock moves through procurement processes, legislation, budgets, training pipelines and the physical replacement cycle of infrastructure.

The first increasingly moves in weeks and months.

The second moves in years and decades.

The central security problem is becoming the gap between those clocks.

Much of the public discussion focuses on cost.

That is understandable.

A relatively inexpensive system can force a defender to consider responses costing orders of magnitude more.

But cost is only one part of the change.

Modern defence contains an uncomfortable arithmetic.

The attacker needs concentration.

The defender needs coverage.

An attacker can choose one target from thousands.

The defender does not know which one will be selected.

So it has to protect the network.

When the cost of creating the threat falls much faster than the cost of covering the system, the problem cannot simply be solved by increasing the budget.

More money helps.

But it buys a fundamentally different product on each side.

Historically, expertise protected society almost as effectively as price.

A small organisation could purchase equipment.

What it struggled to assemble was the team capable of using sophisticated systems effectively.

That barrier is now moving.

The clearest evidence comes from cyber operations.

During 2026, researchers documented increasingly autonomous agents performing reconnaissance, working through vulnerabilities, correcting errors and changing tactics with substantially less direct human involvement.

The techniques themselves are not necessarily new.

The important change is how much of the orchestration can be delegated.

This matters far beyond cybersecurity.

AI does not need to create an entirely new capability to change the threat landscape.

It only needs to reduce the amount of expertise required to use an existing one.

At the same time, inexpensive systems are becoming more autonomous and capable of operating over greater distances.

Techniques developed in one conflict are appearing in completely different environments.

Criminal organisations provide particularly useful evidence because they are not pursuing geopolitical strategy.

When cartels begin adopting capabilities developed on modern battlefields, what they demonstrate is not ideology.

They demonstrate availability.

None of these three curves needs to be exponential.

The important variable is how many actors can clear all three barriers simultaneously.

Money.

Skill.

Reach.

As each threshold falls, organisations previously capable only of local disruption can cross into a category capable of producing economic or political effects beyond their immediate environment.

That is why the change is larger than “technology became somewhat cheaper.”

The number of capable actors can grow non-linearly even if the number of hostile organisations does not grow at all.

States remain the strongest actors.

Nothing in this analysis suggests otherwise.

Below them sit proxies and semi-autonomous formations.

Below those are ideological organisations and criminal structures.

But the most important structural change may be occurring at the bottom.

Individuals and one-off paid operatives.

European security services increasingly describe recruitment through ordinary digital channels.

Social media.

Messaging apps.

Gaming platforms.

The initial request may be mundane.

Photograph a location.

Observe a vehicle.

Travel somewhere.

The person performing the task does not necessarily share the objectives of whoever ordered it.

That distinction matters enormously.

Ideological recruitment requires commitment, selection, trust and time.

Financial recruitment requires a price.

The operator no longer has to believe in the operation.

Once that happens, the boundary between organised crime, sabotage and geopolitical competition becomes increasingly difficult to maintain.

Drones receive most of the attention because they are visible.

But they are only one instrument.

The portfolio already includes physical sabotage, cyber operations, airspace incursions, attacks or interference around undersea infrastructure, political financing, information operations and the amplification of existing social divisions.

The important property of this portfolio is that each individual action can remain below the threshold that would normally trigger a major response.

Yet the cumulative effect can resemble some of the costs traditionally associated with conflict:

higher security spending;

business interruption;

emergency legislation;

political anxiety;

revised budgets;

and declining trust.

No individual event has to look like war.

The system absorbs the aggregate.

Because the problem has four different layers.

Much of Europe's civilian infrastructure was designed against accidents, fires, vandalism and conventional intrusion.

It was not designed around persistent aerial or autonomous threats.

Those facilities have service lives measured in decades.

Even unlimited money cannot replace an entire physical stock instantly.

Governments have recognised the problem.

European and NATO programmes are expanding.

Budgets are increasing.

New capabilities are being procured.

This is not a story of inaction.

It is a story of different speeds.

A programme designed to reach full capability over several years is responding to techniques that can change within weeks.

Resilience spending also has a political problem.

When it succeeds, very little happens.

The prevented incident produces no dramatic image.

The redundant system that worked correctly attracts no attention.

The repair capacity that was never required looks like unused expenditure.

Political systems therefore have difficulty rewarding exactly the investments that resilience requires.

And much of society still does not perceive itself as part of the security system.

This may be the least expensive layer to change.

Media literacy.

Basic preparedness.

Understanding recruitment patterns.

Knowing what to do during short infrastructure disruption.

None requires exotic technology.

And evidence suggests that populations exposed to these mechanisms in advance can become significantly less useful targets.

Put the speeds side by side.

A criminal group changes technique in weeks.

AI capabilities evolve in months.

Infrastructure operators change procedures over months or years.

Government procurement operates over years.

Physical infrastructure changes over decades.

That is why absolute speed is the wrong measure.

The important measure is the ratio.

A government can become three times faster and still lose ground if the environment becomes ten times faster.

And when a system cannot match the variety and speed of what it faces, it begins simplifying.

Specific cases become broad categories.

Reporting increasingly reflects what the institution can detect rather than everything that occurs.

Standards remain on paper while physical infrastructure continues operating under assumptions from an earlier threat environment.

From inside the institution, none of this necessarily looks like failure.

It looks like normal administration.

Our forecast is not state collapse.

States remain overwhelmingly powerful.

But the cost of maintaining normality rises.

Security increasingly becomes a permanent operating expense rather than a temporary programme.

Resilience shifts from trying to prevent every successful attack toward ensuring that critical functions survive and recover quickly.

Insurance may become an important de facto regulator because insurers can price changing risks faster than legislatures can rewrite standards.

Attribution may become less important as a prerequisite for response, increasing pressure on states to control activity originating from their territory.

The boundary between politically motivated sabotage and commercial criminal services becomes increasingly difficult to draw.

And comparative advantage begins to change.

Distributed infrastructure.

Domestic production of critical components.

Cheap energy.

Repair capacity.

Territorial depth.

All gain strategic value.

The characteristics that made an economy efficient under a stable environment are not necessarily identical to those that make it resilient under a more contested one.

For individuals, the answer is not to live as though catastrophe is imminent.

It is to understand your own dependencies.

Identify the everyday functions that rely on a single point.

One bank.

One income source.

One communications channel.

One critical document.

One route.

Close the two most consequential gaps.

Maintain enough basic autonomy to absorb a short disruption without immediately depending on an institution that may itself be responding to the same event.

For businesses, move beyond perimeter security.

Map the functions whose restoration would take longest.

Ask not only:

How do we protect this asset?

Ask:

How quickly can we restore the function if protection fails?

Review insurance language around external incidents and unidentified perpetrators.

And understand which contractors and operational roles possess physical access to critical facilities.

For capital, look underneath conventional diversification.

Two companies in different sectors can share the same grid, strait, port, cable route or logistics corridor.

If they do, some of their risk is the same risk.

Very little of the global environment is under individual control.

That is not the same as saying nothing matters.

Three things remain consequential.

How quickly you notice change.

How many single points of failure you choose to retain.

And:

how well you understand the mechanisms operating around you.

The last may sound intangible.

It isn't.

A society that understands an influence or recruitment mechanism before it arrives becomes harder to use.

Understanding functions as a defensive layer.

And that leads to the most useful conclusion from this analysis:

Unreadiness is not helplessness.

Unreadiness is a lag.

A lag has a size.

And therefore it also has a direction in which it can be reduced.

Systems will adapt.

The important questions are how quickly — and at whose expense.

Read the full analysis:

THE THRESHOLD HAS FALLEN
What an Iraqi drone, a job advertisement, and a cartel quadcopter have in common — and why the institutions meant to handle them are running on a slower clock.

THRIVE IN CHAOS
Decision Intelligence for an Uncertain World

Analysis → Forecast → Recommendations
Signal → Meaning → Action → Stability

Forecasts are probability-based analytical assessments, not certainties. This material supports independent judgment and does not constitute financial, legal or investment advice.