Home » The Colleferro explosion and the new frontier of hybrid warfare
Hybrid threats News

The Colleferro explosion and the new frontier of hybrid warfare

Italy throws its weight behind Ukraine-related Russian sanctions
The Aug. 13 explosion at KNDS Ammo Italy’s plant in Colleferro is under investigation. But whatever investigators ultimately find, the episode highlights a broader challenge for Italy and Europe: protecting strategic industrial infrastructure in the age of hybrid warfare, argued Gen. Pasquale Preziosa in an analysis published by our sister website Formiche.net

ROME — Defense factories, supply chains, energy networks and research facilities are no longer simply the economic infrastructure behind military power. They help determine a country’s ability to generate, sustain and regenerate that power — making their resilience a strategic issue in its own right.

Why it matters:: Italy’s Velletri prosecutors are investigating the fire and subsequent explosion in the plant’s powder-pressing department. Defense Minister Guido Crosetto has said that, based on currently available information, there is no indication of “anything other than an internal problem.”

  • Gen. Preziosa stresses there is no evidence to conclude that Colleferro was anything other than an accident.
  • His argument is instead about context: incidents involving strategic infrastructure now unfold in an environment where accidents, sabotage, terrorism, cyber operations and information warfare can be difficult to distinguish.

Why he matters: Preziosa is a former Chief of Staff of the Italian Air Force and currently serves as president of the Eurispes Observatory on Security and professor of geopolitics of security.

  • Italian prosecutors will ultimately determine what happened at Colleferro. Jumping to conclusions would be a mistake, but waiting for investigators does not mean ignoring the wider context, he explains: We live in an era of permanent strategic competition, where military, cyber, economic, information, cognitive and covert tools increasingly overlap — and where the line between peace and conflict is becoming harder to identify.

The big picture: KNDS Ammo Italy produces explosives for defense applications, including ammunition, grenades, fuzes, warheads and rockets. Together with Avio, it makes Colleferro an industrial hub where defense and space capabilities converge.

  • That matters because, Preziosa argues, the strategic importance of an industrial site is determined not only by its size but also by the dependencies built around it — and by the systemic consequences that a disruption could trigger.
  • Russia’s war against Ukraine has underscored the importance of ammunition, logistics, energy and industrial capacity to military power. That also makes those capabilities potential targets in strategic competition.

The new asymmetry: The economics of attack and defense have changed. A modified commercial drone can cost a few thousand euros, Preziosa notes, while its target may be worth millions or represent a difficult-to-replace link in an industrial chain.

  • Dual-use technologies have also widened access to capabilities once largely confined to states, putting them within reach of extremist organizations, proxies and even individuals.
  • Preziosa points to Leipzig/Halle airport, where German authorities found a drone carrying an explosive device in the cargo area during the night of Aug. 4-5. The investigation has been assigned to prosecutors and police structures dealing with terrorism and extremism. No attribution has been announced.

The information problem: Physical security is only one part of the challenge. After incidents involving sensitive sites, open sources can quickly produce detailed information about plants, production, suppliers, industrial links and similar infrastructure.

  • Individually, those pieces of information may be harmless. Combined, Preziosa argues, they can reveal an industrial ecosystem and its vulnerabilities — the intelligence concept known as the “mosaic effect.”
  • Artificial intelligence can accelerate that process by collecting and correlating vast amounts of open-source information.
  • The answer, Preziosa argues, is not to abandon transparency but to develop a stronger culture of information security around sensitive infrastructure.

Between the lines: An incident can also have a “second life.” An industrial accident may be exploited for propaganda. Sabotage may be carried out through an intermediary. An individual’s action may later be amplified by a state. An accident can be portrayed as sabotage — and sabotage can be designed to look like an accident.

  • That means separating three different questions:
    • what happened,
    • who was responsible
    • how the event is subsequently exploited.
  • The problem is timing. Attribution requires intelligence, judicial investigations, technical analysis, cyber intelligence and international cooperation. Information operations can begin almost immediately.
  • As Preziosa argues, the absence of attribution does not mean the absence of competition.

Zoom out: Other recent episodes show why attribution requires caution. In Sardinia, cars belonging to two researchers involved in Italy’s bid to host the Einstein Telescope at Sos Enattos were set on fire during the night of Aug. 1-2. Nuoro prosecutors are investigating the case as terrorism.

  • Preziosa also cites the Seajewel, an oil tanker damaged by explosions off Savona in February 2025. Italian prosecutors opened an investigation, while public reporting had linked the vessel to Russian oil trade and the broader “shadow fleet.”
  • The cases are different, Preziosa cautions, and should not be artificially connected. That is precisely the challenge: hybrid warfare, sabotage, crime, terrorism, industrial accidents and information operations can produce outwardly similar events while having entirely different causes.

The attribution war: Italy’s defense establishment has already identified hybrid warfare as a strategic challenge.

  • In November 2025, Crosetto presented the Supreme Defense Council with a non-paper titled Countering hybrid warfare: an active strategy. The Defense Ministry’s July 2026 policy guidelines subsequently listed countering hybrid warfare among the priorities for strengthening analysis, coordination and response capabilities.
  • The risk runs in both directions: failing to recognize an attack, but also seeing an attack where there was only an accident. A false attribution, Preziosa argues, can be as strategically dangerous as a failure to attribute.

What we’re watching: For Preziosa, the larger question raised by Colleferro is therefore not only what happened on Aug. 13, but how resilient Italy’s strategic industrial system would be if it were deliberately targeted.

  • That means considering physical security, counter-drone defenses, cybersecurity, insider threats, supply chains, intelligence, information protection, production redundancy, dispersion of capabilities and rapid recovery as parts of the same problem.
  • The logic is deterrence through resilience: a system that can absorb disruption, continue operating and rapidly restore its capabilities reduces the strategic payoff of an attack.

The bottom line: Investigators will determine what happened at Colleferro. Until then, Preziosa’s warning is against both premature attribution and strategic complacency. We may not yet know what happened at Colleferro, he argues, but we do know the strategic environment in which it happened.

Subscribe to our newsletter