Drone inspection: what should defenders check first?

Start with the data path and the update path. A drone used for inspection is a networked device that records imagery and facility layouts, so check where that data is stored, who can push firmware to it, and whether the drone and its phone or tablet sit on a separate network from your corporate systems.

Why treat a drone like an IT asset?

CISA and the FBI describe unmanned aircraft systems as information and communications technology devices that can receive and transmit data. Each connection point is a possible route for compromise. Their January 2024 guidance names three avenues: data transfer and collection (often through a phone or tablet controller), patching and firmware updates, and a broader data surface as drones and docking stations join a network.

That guidance focuses on Chinese-manufactured drones in US critical infrastructure and cites national law as the reason for concern. You do not need to agree on the geopolitics to use its structure. The same questions apply to any vendor: who can read the data, and who controls the code that runs on the device.

What should you inspect first?

Work in this order. The first three take an afternoon.

1. Where does collected data go? Find the app on the controller, and check what it uploads and where it stores flight logs, photos and maps. Sensitive imagery of a plant is intelligence, even if no one hacks anything.
2. Who pushes firmware? Find out whether updates arrive automatically from the vendor, whether you can hold them for review, and whether they are signed.
3. What is the controller? A personal phone with other apps is a weaker anchor than a managed device. Note the operating system, its patch level and its other installed apps.
4. How is the network drawn? CISA's guidance recommends isolating, air gapping or segmenting the network with separate networks, VLANs or VPNs, so malware or a breach cannot spread to the enterprise network.
5. Which accounts exist? The guidance recommends phishing-resistant multifactor authentication for organizational accounts and data.
6. What software is inside? Ask the supplier for a software bill of materials. If they cannot provide one, note it as a procurement risk.

What standards help?

Several standards frame the work, though none is a drone checklist.

• NIST SP 800-82 Revision 3 is a guide to operational technology security. It covers systems that monitor or control physical processes, and it treats safety and reliability as constraints on any security control.
• The ISA/IEC 62443 series assigns responsibilities to asset owners, integrators and product suppliers, and its part 4-1 covers a secure product development lifecycle.
• CISA's guidance is organized by lifecycle: plan and design, procure, maintain, operate.

Check which of these your regulator or customer actually requires. Do not cite a standard in a procurement document without reading its scope.

What if you rely on a contractor's drone?

Put the same questions in the contract. Ask where flight data is processed, how long it is kept, who can access it, and how fast the contractor patches. Require notice of any firmware change. A drone you do not own is still a device that sees your site.

What to do

1. List every drone, controller, docking station and app in use, owned or contracted.
2. For each, record where data is stored and who can access it.
3. Move controllers and docks to a separate network segment.
4. Put firmware updates through a review step before fleet rollout.
5. Request an SBOM and a vulnerability disclosure contact from each supplier.
6. Add the drone fleet to your normal asset inventory and patch process.

Quick check

Sources

• CISA and FBI: Cybersecurity Guidance, Chinese-Manufactured UAS (January 2024, PDF)
• NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
• ISA: ISA/IEC 62443 series of standards

Last reviewed: 18 October 2026.