An Unmanned Aerial Vehicle (UAV) is an aircraft operated without a pilot on board, usually through remote control or automation. In security contexts, UAVs can be used for surveillance, smuggling, or attack, so defenders should monitor airspace, radio links, landing zones, and command systems for unauthorised activity.
What a UAV is in security terms
A UAV is not just a remote-controlled aircraft, it is a mobile cyber-physical system that depends on command links, navigation, onboard software, sensors, and ground control. That mix of aviation and digital control is what makes the term security-relevant.
Because the aircraft can be operated without a pilot on board, defenders have to think about the platform, the control path, and the operating area at the same time. A weakness in any one layer can change how the UAV behaves in flight or how it is used on the ground.
Why UAVs matter to defenders
Security teams care about UAVs because they can be used for reconnaissance, contraband delivery, disruptive overflight, or direct attack. The risk is not limited to the airframe itself, it extends to the communications channel, the operator, and the environment where the vehicle takes off, lands, or stages.
In practice, the most important question is often whether the UAV is authorised and controlled. If an organisation cannot distinguish legitimate activity from unauthorised activity, a UAV becomes an intelligence, safety, and incident-response problem rather than a simple equipment issue.
What attackers and operators can do with UAVs
UAVs create a compact attack surface because they rely on radio control, firmware, positioning systems, and sometimes mobile or cloud-connected management software. Interference, spoofing, hijacking, or command-link disruption can alter flight behaviour, while poor configuration can expose telemetry, video feeds, or operator workflows.
They also create asymmetric operational risk. A small platform can still force a large defensive response if it is flown near sensitive sites, used to observe routine activity, or introduced into a restricted area. For that reason, UAV incidents often require both cyber and physical response coordination.
How organisations reduce UAV exposure
Effective control starts with asset awareness, boundary monitoring, and clear policy for what is allowed to fly, where, and under whose authority. Defenders should know which radio bands, ground stations, and support systems are in use, then align monitoring to the locations and times where activity would be suspicious.
Detection works best when it combines airspace awareness with system awareness. Observing flight paths, landing zones, and command activity together helps distinguish routine operations from unauthorised use. Where UAVs support approved business activity, the control goal is to keep the operational channel visible, constrained, and recoverable.
Risk and Threat Considerations
UAVs concentrate several threat paths into a small platform, which makes them attractive for surveillance, delivery, and disruptive activity. The same qualities that make them useful, mobility, reach, and remote operation, also make them harder to attribute and easier to misuse close to sensitive sites.
Failure mechanism: Attackers or unauthorised operators exploit weak command links, poor geofencing, spoofable navigation signals, or insufficient airspace monitoring to gain control or complete a mission without early detection.
Impact: The result can be loss of confidentiality through surveillance, loss of integrity through unsafe or manipulated flight behaviour, and loss of availability or safety when the UAV interferes with operations, facilities, or people.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-18 — Wireless Access | UAV command and telemetry links rely on wireless communication paths. |
| SI-4 — System Monitoring | UAV detection depends on observing anomalous activity across airspace and control systems. | |
| Recommendation — Restrict and monitor wireless control links used for UAV operations. Correlate sensor, network, and operator telemetry to detect unauthorised UAV activity. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | UAV defence requires continuous visibility into command channels and operating zones. |
| Recommendation — Continuously monitor UAV-related assets, links, and locations for suspicious behaviour. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | UAVs depend on communications channels that benefit from defensive monitoring. |
| Recommendation — Monitor and defend radio, network, and ground-control channels used by UAVs. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Connected UAV platforms can fail when exposed management interfaces are misconfigured. |
| Recommendation — Harden UAV management surfaces and remove unsafe default exposure. | ||
Practitioner Guidance
Why practitioners should care: Treat UAV activity as a combined cyber-physical concern, not only an aviation issue. The most useful controls are the ones that reduce ambiguity about whether a flight is authorised and whether the command path is behaving as expected.
What to watch for: Unusual flight paths, repeated loitering, unexpected landings, abnormal radio activity, and unexplained devices or personnel near launch or recovery points are all indicators that deserve immediate review.
Practitioner takeaway: The best UAV controls tie together airspace monitoring, operator accountability, and communications visibility, because that is where most security decisions are actually won or lost.
Related resources from NHI Mgmt Group
- Why do unmanned vehicle communications need post-quantum protection in critical infrastructure environments?
- Unmanned Vehicle System
- How should automotive teams govern machine identities across connected vehicle environments?
- How should security teams govern OTA update approvals in connected vehicle environments?