The Threat Spectrum: Drone Incident Response in Peacetime, Crisis and War

The Threat Spectrum · Part 1 of 2

When security leaders discuss airspace mitigation, the conversation almost inevitably defaults to hardware: the range of a new radar, the clarity of a thermal camera, or the reach of a radio frequency (RF) jammer.

Yet hardware is only half of the airspace security equation.

The operational reality of drone incident response is dictated by the environment in which you operate. The modern drone threat spectrum falls into three counter-UAS (C-UAS) operational states: peacetime, crisis, and wartime.

Each carries its own Rules of Engagement (ROE) and, just as importantly, its own chain of command.

The hardest moment in airspace defence is therefore not operating within any single state. It is the transition between them.

Peacetime Drone Incident Response: Zero Collateral Damage

In peacetime, airspace security is rooted in law enforcement, public safety, and regulatory compliance. This is the everyday reality of Critical National Infrastructure (CNI), airports, stadiums, and urban campuses.

Here, the site operator usually leads on its own security. A major airport, for example, will typically detect and track drones, assess the risk to flight operations and alert the right authorities, although in some countries detection sits with air traffic control, the police or the military. Yet in most European jurisdictions, the authority to mitigate rests with the police or designated state agencies. This division of responsibility for the sky shapes every decision a security team can take.

Kinetic measures over populated areas are out of the question, and indiscriminate RF jamming can disrupt emergency communications and aviation navigation. Peacetime counter-drone ROE therefore prioritise early detection, continuous tracking, pilot localisation, and controlled mitigation by authorised agencies.

Wartime Rules of Engagement: Absolute Mitigation

At the opposite end of the spectrum sits wartime. When defending military sites or frontline positions, as in Ukraine, the Law of Armed Conflict, part of international humanitarian law, governs operations.

Command sits firmly with the military. Incoming drones are presumed hostile, and operators are authorised to deploy heavy electronic warfare (EW) and kinetic effectors against loitering munitions and coordinated swarms. Distinction and proportionality still apply, but collateral risk becomes part of a tactical calculus rather than an absolute prohibition.

Drone Incident Response in a Crisis: Navigating the Grey Zone

Between these extremes lies the most complex and fastest-growing environment: the crisis state.

Sites in nations bordering active conflicts, such as Lithuania or Poland, are not at war, yet they face repeated airspace violations, temporary airport closures, and persistent hostile surveillance. This is the grey zone, where hybrid threats are designed to stay below the threshold of armed conflict.

It is also where responsibility becomes shared. The airport or energy operator still runs its site, but national agencies, police, and often the military step in with their own authority, assets, and priorities. The ROE can escalate within hours, and so can the question of who is in charge.

Who Owns the Sky?

Each operational state brings a different owner for the decisions that matter:

• Peacetime: Detection usually sits with the site operator, though in some countries it belongs to air traffic control, the police or the military. Mitigation rests with police or designated agencies.
• Crisis: Command is shared, and national agencies or the military may take control of the response while the operator continues to contribute its sensor picture.
• Wartime: The military owns the airspace, and civilian operators become supporting stakeholders.

This is not theoretical. When drone sightings closed Gatwick Airport in December 2018, the military was called in with its own counter-drone equipment to support the police. When a crisis breaks, new actors arrive with their own systems and procedures. The question is whether they plug into your operation or start from zero.

Handing Over a Drone Incident: The Critical Moment

The moment responsibility moves between authorities is the moment of greatest vulnerability. Civil-military drone incident handover must preserve continuity. Grey-zone tactics are often designed to exploit exactly these seams. A seamless transition depends on several capabilities working together.

Interoperability by Design

Incoming sensors and effectors must integrate with the site's existing architecture, not replace it. A mobile military radar arriving at an airport should feed the same operational picture within minutes. This demands open, standards-based command and control (C2) interfaces rather than proprietary protocols.

Secure, Tiered Data Sharing

A civilian airport and a national defence force operate at very different security classifications. Role-based access ensures each stakeholder sees what its mandate requires, with all data encrypted, auditable, and held within a trusted, sovereign framework.

One Picture, One History

Handover fails when two organisations look at two different screens. A single Common Operating Picture (COP) ensures every track, alert, and decision is visible to everyone who needs it. A new commander should inherit a drone's position, full track history, and every action already taken.

Transferable Decision Rights

The system must know who is authorised to cue a camera, request mitigation, or approve it. These rights should transfer cleanly from site security manager to police commander to military officer, with every change logged. And when the crisis ends, control must be handed back just as cleanly, without losing coverage or evidence.

In the Loop or On the Loop

As responsibility shifts, so does the relationship between operator and machine.

With a human in the loop, the system detects, tracks, and recommends, but no mitigation happens until an operator approves it. This is the natural model for peacetime, where accountability outweighs speed.

With a human on the loop, the system engages autonomously within pre-defined parameters. The operator is notified and supervises, retaining the power to override, but does not approve each action. When a swarm arrives within seconds, this is the model that wartime increasingly demands.

In a crisis, both may run side by side: the site operator in the loop for civilian-grade responses, a military unit on the loop with its own effectors, all on the same picture. Any shift in autonomy must itself be an authorised, auditable decision.

Built for Every Stage of a Drone Incident

None of this is possible with static, proprietary hardware locked to a single set of ROE. Technology-agnostic, field-proven counter-drone systems decouple C2 software from hardware, allowing operators to accept partner assets on demand and scale effectors as their mandate changes.

True airspace security is no longer measured by performance in a single state. It is measured by how seamlessly a site moves between them: sharing data securely, transferring command without friction, and keeping every authority on the same picture when it matters most.

But the operational state is only half the picture. Part 2 of this series looks at the other half: the threat itself, and who has the authority to defeat which drone.