Drone Threats as an Intelligence Problem: Why Security Program Development Beats Technology Theater

My partner and I were conducting a routine armed walking patrol at a residential property in Brevard County, Florida, when an unidentified drone appeared overhead. It shadowed us street by street, maintaining altitude just out of easy reach.

Then the drone began conducting repeated, aggressive, low passes, coming within inches of my partner’s head on multiple occasions. We had no immediate defensive tool or protocol to counter it. We documented the aggressive behavior, called local law enforcement to establish a formal record in case defensive action became necessary, and completed the patrol.

A second encounter with an unidentified drone occurred at an outdoor rock concert for a national act. A drone suddenly materialized above the stage area with no press credentials or airspace authorization. The headliner refused to perform while it hovered within sight. With law enforcement support we located the operator—a vendor who had not received proper clearance—and removed the threat. Again, we had no pre-established counter-drone measures or standard operating procedure ready to deploy.

The encounters are part of a broader trend: drone-related incidents are accelerating, particularly in high-density and critical-infrastructure environments. Drone sightings grew 19.9 percent in the first three quarters of 2025, compared to 2024 figures, according to analysis from the U.S. Federal Aviation Administration (FAA) Center of Excellence for UAS Research.

The U.S. state of California reported the most sightings (183), followed by Florida (172), Illinois (122), Texas (115), and New York (94). In the Orlando area alone, the city logged 18 unauthorized drone sightings—enough to place it among the top five U.S. cities for such events in 2025, according to analysis of FAA sighting data on the first quarter of 2025.

For security practitioners operating near major airports, federal facilities, or complex restricted airspace environments, those numbers are not abstractions. They represent real operational decisions under pressure with limited legal authority and no established playbook.

The scale of the unidentified drone problem is clear. Yet most organizations still approach it as a technology procurement problem—hunting for the latest radar, radio frequency sensor, or camera system to detect the devices. This mindset creates expensive theater. Detection hardware without an intelligence backbone delivers alerts that security teams cannot meaningfully action. The result is alert fatigue, integration failures, and persistent blind spots.

Technology is essential, but it is a tool, not a strategy. A radar ping means nothing without understanding the threat actor’s intent, capabilities, and operational patterns. This is why drone threats must be framed as an intelligence problem first.

How to Create an Intelligence-Led CUAS Framework

Taking a security program development approach treats the drone threat as a human and operational challenge rather than a purely technical one. It integrates detection technology with ground operations, protective intelligence, and continuous adaptation.

The framework rests on four operational pillars:

1. Threat intelligence and program assessment. Begin with a comprehensive review of the specific threat environment. Map potential threat actors (hobbyists, activists, criminals, or more sophisticated operators), review historical UAS activity in the area, and evaluate existing perimeter security, access control, and observation layers. Where operations intersect with restricted airspace environments, this assessment must account for FAA Part 107 requirements, LAANC-restricted zones, and active temporary flight restrictions. The goal is to understand intent and capability before any hardware is deployed.
   
   
2. Mission planning and layered integration. Develop a tailored counter-drone mission plan that aligns detection systems with ground assets. Fixed and mobile radar or radio frequency sensors feed into a command node while elevated observation posts and ground patrols provide human verification. Effective integration requires clear radio discipline, structured perimeter observation protocols, and joint public-private partnerships with local law enforcement. Aerial detection that is not coordinated with ground operations produces raw data—not actionable intelligence.
   
   
3. Real-time deployment and response. When a drone is detected, the system shifts from monitoring to directed action. A dedicated Counter-UAS (CUAS) coordinator serves as the single integration point—preventing radio congestion and ensuring ground teams receive precise, actionable intelligence rather than raw alerts. Response protocols draw from proven event security models: rapid repositioning of ground teams, documentation for law enforcement escalation, and, when legal and operationally appropriate, defensive measures supported by prior incident reporting. This coordinator model has consistently been the difference between a managed incident and an operational disruption at more than 150 annual events at major Florida venues.
   
   
4. After-action review and continuous adaptation. Every detected incident feeds back into the program. Review what worked, what created false positives, and how integration can improve. Update threat profiles, refine sensor placement, and strengthen training. This pillar closes the loop, turning isolated events into institutional knowledge.

Three Questions to Ask Before Investing in CUAS

Security directors at stadiums, festivals, campuses, airports, utilities, and critical infrastructure sites face the same procurement pressure: vendors promising silver-bullet detection systems. Before investing, ask these three questions that shift the conversation from technology to security program development:

1. Can your team action every alert with context? A radar detection is meaningless without rapid intelligence validation. Does your program integrate detection feeds with ground observation (elevated posts, patrols), threat actor profiling, and a dedicated coordinator who routes precise intelligence—not raw data—to responders? In restricted airspace environments, this integration determines whether an alert becomes a manageable incident or operational disruption.
   
   
2. Does your approach account for when ground-based solutions are sufficient? Not every environment requires CUAS hardware. A robust security program development process begins with an honest assessment: enhanced perimeter security, layered observation, access control, and public/private partnerships with law enforcement may deliver better outcomes at lower cost.
   
   
3. How does the system evolve after every incident? True resilience comes from after-action review loops that feed directly back into program refinement. Does your counter-drone strategy update threat profiles, sensor placement, training, and integration protocols based on real incidents? Or does it remain static until the next vendor demonstration?

Drone technology will continue to evolve. Detection systems will become more sophisticated. Yet the organizations that thrive will be those that reframe the challenge: Drone threats are fundamentally an intelligence problem.

Security program development provides the strategic architecture to meet this reality. It integrates technology with human judgment, ground assets with aerial awareness, and isolated alerts with actionable intelligence. In high-stakes environments, from major venues and festivals to critical infrastructure and restricted airspace, this intelligence-first posture protects operations, reputation, and public safety more effectively than any standalone system.

Nic Moretto is the founder and CEO at Tactful Elite Security Solutions (TESS) Global, a Florida-licensed intelligence-led security firm in operation since 2014. With more than 20 years of experience across executive protection, armed security, and security instructing, Moretto holds Florida-state licenses across security agency operations, armed and unarmed officer roles, private investigation, and security instruction. He is a certified NRA firearms instructor, defensive tactics instructor, and situational awareness instructor. He is a contributor to EP Wired and the author of the Awareness-Driven Event Security Series: Book 1—Situational Awareness at Scale and Book 2—Advanced Force Multipliers.

© Nic Moretto