A suspected sabotage attack against a building used by Estonian autonomous-systems manufacturer Milrem Robotics has left its production and deliveries to Ukraine unaffected, but the incident adds physical security to the constraints facing Europe’s expanding defence-technology supply chain. Estonian authorities have identified suspects and are examining possible Russian involvement, although investigators have not established responsibility.

Milrem chief executive Kuldar Väärsi said the incident had not disrupted production, its supply chain, or deliveries scheduled for this year and next. The company expects more than 200 of its robotic systems to be deployed in Ukraine by the end of 2026, placing the Estonian manufacturer among a relatively small group of European suppliers whose autonomous platforms are being tested through sustained operational use rather than occasional exercises.

The attack took place as Milrem expands manufacturing beyond Estonia. A production line established with VDL Defentec in the Netherlands is supporting a Dutch-funded programme for more than 100 THeMIS unmanned ground vehicles for Ukraine, giving the company manufacturing capacity across more than one European location.

That geographical spread provides some resilience by reducing dependence on a single factory, although defence manufacturing remains exposed to disruption through components, software, logistics, specialist personnel, and contractors. As young defence-technology companies become strategically important suppliers, cyber security and physical security begin to merge into the same industrial problem.

Autonomous systems move into production

Unmanned ground vehicles have moved beyond the demonstration stage during the war in Ukraine, where systems are being used for logistics, reconnaissance, casualty evacuation, and other tasks intended to reduce the exposure of personnel. European governments are trying to turn operational experience into procurement programmes while increasing domestic production of drones, robotics, sensors, software, and counter-drone equipment.

For manufacturers, that changes what customers expect. A company selling a prototype needs to prove that its technology works, whereas a supplier supporting military operations over several years also needs production capacity, spare parts, training, maintenance, secure software, reliable logistics, and the ability to recover when parts of its own operation are disrupted.

Milrem’s Dutch manufacturing line illustrates the shift because it creates additional industrial capacity rather than another test programme. Yet distributed production does not eliminate risk, since vehicles still depend on specialist electronics, communications equipment, software, sensors, and mechanical components that may move through a network of suppliers across several countries.

A factory can therefore remain operational while an attack elsewhere in the chain delays a critical part, and software can remain secure while a warehouse or transport route is damaged. Resilience increasingly has to be designed across the industrial network rather than treated as a protective perimeter around the manufacturer’s headquarters.

Hybrid threats reach commercial suppliers

European governments have become more concerned about sabotage, cyber operations, and other forms of interference against infrastructure and organisations connected with support for Ukraine. Estonia’s investigation fits that wider security environment, although the absence of confirmed attribution means speculation around the Tallinn incident needs to remain separate from established fact.

That distinction is commercially important as well as journalistically necessary. Companies cannot wait for perfect attribution before improving security, but they also cannot design their risk programmes around assumptions that every unexplained fire or disruption is part of a state-directed campaign.

Instead, defence suppliers need controls that work regardless of who causes an incident. Alternative sites, protected inventories, redundant communications, secure remote access, staff screening, incident response, and arrangements with key suppliers can all reduce the consequences of disruption whether the cause is sabotage, cyberattack, equipment failure, or accident.

The economics are becoming more demanding because resilience costs money before it produces an obvious return. Maintaining spare capacity or multiple suppliers can look inefficient during normal operations, yet customers buying equipment for national security need confidence that production can continue under conditions in which commercial manufacturers would ordinarily suspend operations.

European defence policy is simultaneously trying to direct more spending towards the continent’s own industrial base, which increases the strategic importance of companies that only recently would have been considered specialist technology suppliers. Robotics businesses, drone developers, and software companies can consequently find themselves facing threats and security expectations once associated primarily with large established defence contractors.

Milrem’s immediate response suggests the Tallinn incident has not changed its delivery programme, which is the operational result its customers will care about most. The broader consequence is that European autonomous-systems companies are being asked to prove two things at once: whether their technology can survive difficult operational environments and whether the industrial organisation behind it can keep producing when the supplier itself comes under pressure.