Ask an investor what a European defence technology company is worth and the conversation turns to software, patents and growth. Ask the procurement officer responsible for buying its equipment and the question is a different one: how many units can be delivered each month, and what happens if the assembly line is hit. That is the right question, because the real value of a defence technology company lies in its ability to keep producing while a determined adversary tries to stop it.
The primes have spent decades hardening their production lines, which is why they still hold ten-year contracts. Moscow has drawn the same lesson from Ukraine, where output has mattered more than design, and has concluded that interrupting a European supplier’s production is cheaper than stealing its technology. This August the Tallinn premises of the robotics firm Milrem were set alight in an attack Estonia has attributed to Russian security services, and last month a Swindon man was charged with passing the locations of local drone factories to what he believed was Russian intelligence, although he has yet to stand trial. The full list of known incidents is set out below.
Most of these companies are founder-led, so critical knowledge and relationships sit with one or two people, and few could restart the line if that person left. Founders also travel and speak in public, which makes them the obvious approach for a hostile intelligence service.
The value may lie in the software, but the hardware is often assembled by a contract manufacturer on an industrial estate, staffed by people nobody has vetted, and the security requirements set by the prime rarely reach that far down the supply chain.
Rapid hiring means trust is often established by little more than a CV, while Russia, Belarus and China run patient programmes to exploit exactly this kind of workforce. A company that would never let an unvetted visitor onto the shop floor might give a new employee the design files on their first day.
Every board ought to know how long it would take to resume deliveries if it lost its founder, its assembly partner or its main site tomorrow, and finding out means applying three disciplines to the company.
Defend: Bring the contract manufacturer within the company’s own security framework, vet its staff and control who can reach the design files.
Sustain: Rehearse a succession plan so that the loss of one person does not halt production, and qualify a second source for critical components.
Recover: Have a second site ready and agree the response plan before a crisis, so that customers are still supplied in the weeks that follow.
A defence technology company is worth whatever it can keep building while someone is trying to stop it, and one that can defend, sustain and recover will find that its valuation largely takes care of itself.
Alma Risk already works with a number of European defence technology companies on these threats, and if any of this sounds familiar, I would welcome the conversation.
The Associated Press has counted around 200 incidents of sabotage and malign activity across Europe blamed on Russia since February 2022. The cases below are those connected to the defence supply chain, newest first, with the status of each as last reported.
