By David Honour
For the past two decades, many high-profile businesses have looked at the terrorism threat from the ground up. The visible signs are familiar: bollards, concrete planters, hostile vehicle mitigation barriers, strengthened façades, security-rated street furniture, controlled access points, vehicle stand-off distances, and protective measures around crowded entrances. These defences reflect hard lessons from attacks in which cars, vans, and lorries were used either as weapons or as delivery systems for explosives. This work remains essential. Vehicle-borne threats have not disappeared. But the rapid evolution of drone warfare should force businesses to ask whether their protective security assumptions are now incomplete. Many organizations have hardened the ground-level, but they have not yet given the same attention to the low-altitude airspace above and around their sites.
And that may become one of the most important protective security questions of the next decade.
The conflicts in Ukraine and Iran have accelerated public understanding of what drones can do. Relatively inexpensive commercially available technology has been adapted for surveillance, targeting, disruption, propaganda, and attack. Small drones have become tools of reconnaissance and precision attacks. Larger systems have extended reach and payload. Swarm-like activity has shown the potential for saturation, confusion, and psychological impact.
The key lesson for organizations is not that an attack on your office, factory, headquarters, or public venue by a weaponised drone is imminent; but that the threat is a real and increasing possibility. The explosive-laden vehicle attack of a decade ago can be delivered with as much impact by a drone and with much reduced risk to the attacker. The threat environment has changed and corporate security and resilience programmes have to catch up.
A new layer of exposure
Traditional protective security thinking often starts with the perimeter. How does someone get close to the building? How is access controlled? Where could a hostile vehicle approach from? Where do people queue? Where are the vulnerable points at street level?
Drone risk adds a different perspective. What is exposed from above? What can be observed, approached, disrupted, or reached without crossing the physical perimeter at all?
For some businesses, the answer may be relatively limited. For others, the exposure may be substantial. Roof plant, loading bays, energy infrastructure, control rooms, data centres, security posts, public entrances, executive arrival points, external event spaces, and congregation areas may all look different when viewed from the air.
The risk is not only physical attack. Drones can be used for hostile reconnaissance, testing security reactions, filming layouts, monitoring routines, identifying vulnerabilities, or creating public alarm.
A suspicious drone over a corporate headquarters may not cause physical harm, but it can still trigger evacuation decisions, operational disruption, reputational concern, employee anxiety, social media speculation, and police involvement.
This makes drone risk an operational resilience and business continuity issue, not simply a security technology issue.
Severe but plausible scenarios
The possibility of a terrorist drone attack against business targets is plausible. The direction of travel is clear: drones are increasingly accessible, increasingly capable, and have become normalised in recent conflict environments. Tactics observed in war zones have a long history of being studied, copied, simplified, or adapted by non-state actors, activists, or state-sponsored terrorists.
Taking things to a more severe level, a coordinated, swarm attack on a number of business premises is one possibility; as is a coordinated multi-city drone attack against several corporate or public-facing sites. It would generate fear, huge media attention, and operational disruption even if the physical damage was limited. But turning such a scenario into an effective attack still involves barriers, such as materials sourcing, timing, target selection, technical reliability, avoiding detection, and achieving the desired effect.
The threat is real, and the impact could be high, but the logistical difficulties of carrying out such attacks may mean that the likelihood is low as things stand for such severe scenarios.
For many businesses, the more realistic near-term threat may not be a sophisticated weaponised attack, but reconnaissance, nuisance activity, disruption, intimidation, or a single unsophisticated drone incident, such as a non-weaponised drone being flown through an office window.
Yet the above should not be reassuring or lead to complacency. Businesses have often been slow to act on emerging risks until an incident actually occurs. The central question is whether drone risk is already credible enough to be included in protective security, crisis management, and business continuity planning. For many high-profile organizations, critical infrastructure operators, public venues, and businesses with symbolic value, the answer is yes.
Responding to the threat
One of the dangers with emerging threats is that they create a market for simple answers. Drone risk is no exception. Detection systems, sensors, radars, radio-frequency tools, cameras, and counter-drone technologies all have a role in some settings. But technology should not be the starting point.
The question isn’t: what counter-drone system should we buy? Instead organizations need to ask: what are we trying to protect, what drone scenarios are credible, what would we need to know, what decisions would we need to make, who would make them, and what lawful options would be available?
For most businesses, particularly outside the highest-risk categories, the first priority is not active drone defence. It is understanding the risk, reducing vulnerability, detecting suspicious activity, responding sensibly, and integrating drone scenarios into existing security and resilience exercises.
Active countermeasures can also be legally and operationally complex. Businesses should not assume they can jam, capture, or physically disable a drone. In many jurisdictions, those options are tightly controlled and reserved for the police, military, or other authorised bodies. A poorly considered response could create greater safety, legal, or public order problems than the original drone sighting.
What organizations can do
Steps that can be taken include:
- Add drones explicitly to the protective security risk assessment. This should not be buried in a specialist technical appendix. It should sit alongside terrorism risk, physical security, major incident planning, public safety, crisis communications, cyber-physical risk, and business continuity. The assessment should ask which sites are attractive, symbolic, sensitive, crowded, or operationally critical. It should consider whether the organization has high-profile executives, controversial activities, critical infrastructure dependencies, hazardous materials, public-facing premises, major events, or assets that could be disrupted by drone incidents.
- Conduct an aerial vulnerability review. This does not need to be over-engineered. It should examine roof-level assets, exposed infrastructure, external gathering points, vehicle and pedestrian flows, security control points, CCTV coverage, lighting, signage, access routes, and neighbouring properties. The objective is to understand what a drone could observe, reach, disrupt, or exploit.
- Strengthen hostile reconnaissance awareness. Reception teams, security staff, facilities teams, contractors, and event staff should know what suspicious drone activity might look like and how to report it. They should also understand that a drone incident may be part of a wider pattern, especially if combined with photography, unusual enquiries, repeated visits, perimeter probing, or online interest in the site.
- Establish reporting and escalation procedures. A drone sighting should not lead to confusion about who is called, what information is captured, whether police are contacted, who decides on evacuation or sheltering, and how the incident is logged. Staff should know not to approach a downed or suspicious drone, not to interfere with potential evidence, and not to improvise unsafe responses.
- Build relationships before an incident. Businesses with credible exposure should speak to local police, counter-terrorism security advisers where appropriate, landlords, neighbouring occupiers, local authorities, event organizers, insurers, and security providers. Drone risk often crosses property boundaries. A site may be affected by activity launched, observed, or reported from elsewhere.
- Consider proportionate physical mitigation. This might include relocating or shielding vulnerable equipment, improving roof access control, reducing visible target cues, managing queues and congregation points, reviewing window and façade exposure, protecting control rooms, or using design changes to make hostile reconnaissance less useful. Some of the most effective measures may be mundane rather than technological.
- Assess whether detection technology is justified. For some high-risk sites, it may be. But detection only has value if it leads to a decision. A control room that receives an alert but has no procedure, authority, or trained operator is not meaningfully protected. Technology must be connected to governance, response protocols, lawful options, police liaison, and exercises.
Exercise the scenario
Perhaps the biggest gap is exercising. Many organizations have rehearsed fire, evacuation, cyber incidents, lockdown, public order disruption, and crisis communications. Far fewer have exercised a drone scenario.
A useful tabletop exercise might begin with a drone reported over a corporate headquarters. No one knows whether it is recreational, criminal, journalistic, activist, or hostile. It appears to hover near the roof plant before moving towards a crowded entrance. Social media posts begin to appear. Employees ask whether they should leave. Security staff are uncertain whether to evacuate, shelter, or keep people inside. A second site reports a similar sighting. A journalist calls the press office. Police ask for details. Senior leaders want options.
This kind of exercise exposes the real issues: not only whether the organization can see the drone, but whether it can make defensible decisions under uncertainty:
Should people be moved or kept away from glass? Should entrances be closed? What is said to staff? Who speaks to police? What is the threshold for invoking the crisis team? How is CCTV preserved? What if the drone lands? What if it crashes? What if nothing happens, but the story spreads online?
Martyn’s Law and the broader duty to prepare
In the UK, Martyn’s Law gives this discussion added relevance. The Terrorism (Protection of Premises) Act 2025 is intended to improve preparedness at qualifying premises and events. It is not specifically a drone law, but it reinforces a broader expectation: organizations responsible for public premises and events should think seriously about how terrorist attacks could affect people on their sites and what reasonably practicable measures should be in place.
Drone scenarios should form part of that thinking where proportionate. For some venues, the primary concern may still be marauding attack, hostile vehicle attack, or improvised explosive devices. For others, drones may add a further dimension to existing vulnerabilities. The point is not to create a new compliance burden for its own sake. It is to make sure preparedness reflects the way threats are evolving.
From ground threat to air threat
The shift from hostile vehicle mitigation to hostile aerial mitigation does not mean replacing existing protective security assumptions. It means extending them.
Businesses already understand that security has to be layered. They know that deterrence, detection, delay, response, communication, and recovery all matter. Drone risk should be approached in the same way.
The organizations that are best prepared will be those that treat drone risk as part of a wider resilience system. They will understand their vulnerabilities, train their people, coordinate with authorities, test their decisions, and keep the issue under review as technology and tactics evolve.
The question for business leaders is therefore not whether every organization needs a counter-drone system. Most do not. The question is whether the organization has recognised and assessed the risk.
For years, protective security has focused on keeping hostile actors away from buildings, people, and critical assets at ground level. That work remains vital. But the low-altitude threat layer is no longer theoretical. Drones have changed the geometry of attack, reconnaissance, and disruption.
The author
David Honour is editor of Resilience Forward.
