Unmanned vehicles with varying degrees of autonomy will likely change the way military operations can be conducted, but they also introduce risks that require new ways of thinking security. In particular, the safety ramifications of cyber attacks should be seen as equally critical as the loss of classified data. Developing a cyber defence capability that can detect and manage these potentially harmful events also without human intervention thus becomes a fundamental requirement. In this paper, we commence such work by exploring how to disrupt the functionality of an actual military unmanned ground vehicle given an internal attacker, and how the resulting data can be used to design an an effective detection capability.