Behind the headlines.
Current incidents in Belgium, the Netherlands and Europe: what happened, what it reveals, and what changes when everyone works from one picture.
The parcels crossed borders. The evidence had to follow.
A warehouse fire and a damaged shipment can begin as separate incidents. Understanding whether they belong to one operation requires connecting evidence across companies, countries and investigative teams.
Read the analysis
The cable was damaged. The consequences spread across the city.
A power outage becomes a coordination problem long before repairs are complete. Operators, emergency services and local authorities need different information about the same streets, facilities and people needing assistance.
Read the analysis
The meeting is online. Who controls the room?
A video call brings people together. Its software, hosting, identity service and maintenance arrangements determine who controls the environment around that conversation. France’s Visio programme makes that operational choice visible.
Read the analysis
The message is encrypted. Who is in the conversation?
A government crisis team and a private operator need to exchange information quickly. A familiar messaging app makes that easy. It does not settle who controls the accounts, who still belongs in the group or what happens when a device is compromised.
Read the analysis
The grid went dark. The explanation took months.
At 12:33 on 28 April 2025, continental Spain and Portugal lost power. Reconstructing the event required evidence from across the electricity system. For a Belgian operator such as ELIA, the lesson is about connecting operational context without confusing it with grid control.
Read the analysis
The cable is underwater. The response starts above it.
A damaged undersea cable draws in its operator, coastguards, repair crews and investigators. Each sees a different part of the event. The challenge is to assemble a picture while keeping a technical failure, an accident and suspected sabotage distinct.
Read the analysis
The airport was open. Check-in was not.
In September 2025, a supplier incident disrupted check-in at several European airports, including Brussels. A problem in one shared service became a coordination problem for airlines, airport teams and passengers.
Read the analysis
An explosion on the line. Found the next morning.
Since the war in Ukraine, Europe’s railways, parcel hubs and cargo airports have become targets. The attacks are cheap, often carried out by recruits paid through Telegram, and noticed late. What that means for the operators who are now legally required to protect them.
Read the analysis
The attacker is seventeen. The order came from abroad.
In March 2026, synagogues, a Jewish school and American banks were attacked in Liège, Rotterdam, Amsterdam, Antwerp and Paris. Most of those arrested were teenagers, recruited over social media. What the series shows about how threats reach Europe today — and how they are stopped.
Read the analysis
The drone is in the air. The pilot is on the ground.
A year after the first drone alarms over Belgian bases and airports, nobody has been identified. Detecting a drone is only half the problem. The other half is getting from a sighting to a person.
Read the analysis
Antwerp seizes less cocaine. Where did it go?
In the first half of 2026, customs in Antwerp seized a third of what it found a year earlier. Then, in one week of September, came three catches — one of almost 2.4 tonnes. What the figures say, and what they don’t.
Read the analysisThe basics, explained.
Evergreen explainers on the concepts and rules behind situational awareness and critical-infrastructure protection in Europe.
The CER Directive: what critical entities must do now
Europe’s critical-entities rules are now law in Belgium, the Netherlands and Germany, and before parliament in France. They ask operators to do for physical threats what NIS2 asks for cyber: assess the risk, protect, detect, respond — and report within 24 hours. What the rules require, where each country stands, and what it means in the control room.
Read the guide
What is a common operational picture?
One shared, live view of a situation that everyone involved works from. It sounds simple — and most organisations that protect critical infrastructure still don’t have one. What it is, what goes into it, and how to tell a real one from a dashboard.
Read the guide