Richard Hilson of PFL – Access management, writes of how drones have become increasingly capable and accessible, and argues that utilities and energy operators could consider not only what an unmanned aircraft could do, but what its presence might reveal about a wider attempt to observe, probe or compromise it.
Drones have rapidly moved from niche technology to inspection and monitoring must-haves for energy and utilities operators. With assests often spread across remote or exposed locations, they offer obvious operational benefits. But the same capabilities that give drones a legitimate use, can also make them attractive to those seeking to do the complete opposite.
It’s something the UK Government recognises in its Counter-Unmanned Aircraft Strategy, where it identifies malicious drone activity affecting CNI as a serious concern, encompassing potential threats from terrorism, organised crime and hostile state actors.
Double the trouble
The challenge it seems is twofold – prepare for the unlikely scenario of a drone carrying an expoloseive or disruptive device, and also understand how a drone might gather vital information on a site’s weakness in advance of such an attack.
Traditional physical security is built around protecting boundaries, controlling entry points and monitoring activity. Fences, gates, barriers, access-control systems and surveillance all play their part in this – but a drone observes a site from above, viewing and accessing areas and activity that ground-level security wasn’t designed for.
So if we take an electricity substation, gas facility or water treatment works, that could mean gaining an understanding of the site’s layout, operational routines, and vehicle movements. And while a drone sighting does not automatically indicate malicious intent, the difficulty is in establishing whether it is, or not. This gets even trickier for a remote or hard to reach site with no, or very few, regular personnel on site.
It means operators need to consider what can be observed from outside the boundary, how unusual activity is identified, and whether the information gathered can be used to inform a wider assessment of risk. And then, can it respond effectively when something falls outside the expected pattern.
A challenge of scale
Energy and utilities infrastructure presents a particularly difficult security challenge because of the scale and distribution of the assets involved. Sky News reported in June 2026 on concerns about the vulnerability of UK energy infrastructure to hostile drones, highlighting the potential consequences for substations, pylons and cables.
The issue is not whether an individual site can be protected, but how operators assess and manage risks across an extensive network of critical assets. Likewise, the Drinking Water Inspectorate’s reporting on reservoir integrity and asset health highlights the importance of protecting treated-water storage and maintaining the integrity of water assets.
Protection is neither straightforward nor necessarily practical and in August 2026, E.ON chief executive, Leonhard Birnbaum, warned that fully protecting energy grids against drone attacks was not currently feasible, highlighting the difficulty of securing infrastructure on such a scale.
Given security measures must be proportionate to risk, the drone threat creates the perfect storm in that security professionals need to advise across a complex network of assets, against threats that until recently, weren’t part of the criminal actor’s armoury.
From detection to response
While drone technology has both evolved and become more accessible, so too has the technology to combat it. Detection systems can help identify potential drone activity, while appropriate monitoring and response procedures can help operators determine what action to take.
But the real value comes from understanding what has been detected, assessing the potential threat, coordinating an effective response, and ensuring the right technology is deployed for the site and surroundings.
Counter-drone technology is most effective when it forms part of an operational chain – or Detect, Track, Identify and Respond. First you need to establish if a drone is present, then determine its position and movement, assess what it is and whether it poses a threat, and ensure the right response can be taken.
Radar can detect and track objects in the airspace, while radio frequency (RF) sensors look for signals exchanged between a drone and its controller. Optical and thermal cameras can help verify what has been detected, while acoustic sensors listen for the distinctive sound of drone motors – each has strengths and limitations.
The final stage is turning that information into an appropriate response, and electronic countermeasures such as jamming and spoofing may be used in some authorised settings to interfere with a drone’s communications or navigation, potentially disrupting its flight or diverting it from its intended course.
But these are not universal solutions, and for most energy and utilities operators the priority is to understand what their detection systems can tell them, make sure alerts reach trained personnel, and have clear procedures for escalating incidents to the police or other authorised responders.
Crucially, when integrated with CCTV, access management, site patrols, and existing security operations, counter-drone technology becomes part of a layered defence.
The UK Government has also recognised the need for better protection and its competition on protecting physical assets from uncrewed aerial system attacks explores technologies designed to protect static critical infrastructure against hostile drones, including scenarios involving attacks on fuel supply and storage systems.
In energy and utilities, and all CNI for that matter, the aim should be to connect these elements into a coherent security strategy, rather than adding isolated technologies in response to each emerging threat.
Drones are likely to remain highly important for infrastructure operators but their increasing use also means that security teams must consider how the same technology could be exploited by others.
The answer is not to assume that every drone is hostile, nor to attempt to eliminate every conceivable risk, but to recognise that the security environment around critical national infrastructure is changing and ensure that existing arrangements evolve accordingly.
