New UC report finds Australia lagging in preparedness for drone

Researchers from Innovation Central Canberra (ICC) at the University of Canberra have partnered with Australian tech company DroneShield to assess the cyber-attack risk profile facing critical infrastructure as drone technology becomes more sophisticated and more widely accessible across the country. This comes as a new UC report warns that Australia’s critical infrastructure remains unprepared for emerging drone cyber threats.

“We know how drones have changed traditional warfare, but are we oblivious of the role they play in cybersecurity? That’s a worry, and an opportunity for our drone and cyber industry,” Frank den Hartog, Cisco Research Chair in Critical Infrastructure at the University, said in a media statement.

“This research highlights the need for greater education, more industry collaboration, improved knowledge-sharing, and broader consideration of counter-drone capabilities across critical infrastructure sectors,” den Hartog added. “We need to encourage operators to periodically and critically review how drones are used within their operations, assess the cybersecurity implications of increased adoption, and explore strategies to integrate drone risk into existing security and resilience programs.”

The project began with a team comprising den Hartog and ICC students Andrew Giumelli and Simone Chitsinde, undertaking targeted analysis and interviewing critical infrastructure operators to further understand the cyber threat environment through the use of drones. The team spoke with representatives from six critical infrastructure sectors in Australia, including energy, transport, healthcare and medical, data storage and processing, water and sewage, and communications sectors.

The UC report emphasizes that drones are no longer an emerging technology. Their capability, affordability and accessibility have increased dramatically in recent years, and malicious actors are experimenting with drone-borne cyber techniques overseas. Within the five years, as drone and cyber capabilities continue to evolve, operators may need to reassess the likelihood and relevance of drone-enabled cyber threats.

The outcome underscores the value of industry working with ICC when progressing complex, high-consequence technology. ICC’s model is built around student-led applied research, giving organisations a secure and collaborative environment to pressure test ideas, refine system-level thinking and draw on multidisciplinary capability. This approach helps industry partners move faster, reduce uncertainty and ensure their innovation pathways remain aligned to real-world operational needs.

“Damaging or interfering with drones in both kinetic and non-kinetic means may therefore be a criminal offence in Australia, with exemptions for authorised entities such as law enforcement and defence agencies,” the report detailed. “However, mass-produced and widely available civilian drones can easily be acquired. With minimal technical training, they can be operated by individuals, hobbyists, or even malicious actors, which creates vulnerabilities that challenge existing defences.”

Moreover, investigating whether such threats are practical and whether the currently limited deployment of drone detection capabilities across Australian critical infrastructure may be obscuring an understanding of the threat landscape, we conducted a structured literature review as well as stakeholder interviews with eight critical infrastructure operators.

The UC team said that their literature review revealed that past research often focused on the vulnerabilities within drones and their protocols rather than drone-enabled cybersecurity threats. It also revealed that security concerns are still primarily framed in terms of kinetic attack vectors, such as physical disruption. However, the alleged 2022 incident of a drone-enabled cyber compromise in a U.S.-based financial services firm was identified as accentuating both the rarity of publicly available cases and the lack of sustained scholarly attention to this threat vector. The incident, however, also shows that this attack vector is real.

From the team’s interactions with critical infrastructure operators, they learned that this lack of awareness and attention in the literature is mirrored in practice. “Many operators expressed limited awareness of drone-enabled cyber threats, treating them as a currently low-probability scenario. This perception is reinforced by the absence of recorded incidents in Australia, and the assumption that adversaries would likely use more conventional means of cyber intrusion.”

They added that government guidance was also cited as minimal, leaving operators without structured frameworks for assessment or effective defensive solutions.

The researchers also found that the lack of recorded incidents carries multiple implications for Australia’s cybersecurity posture. First, it could make stakeholders believe that current physical and cybersecurity measures are adequate to deter opportunistic attacks. Second, it may indicate that Australian critical infrastructure presents less attractive targets compared to international counterparts, possibly due to geographic isolation, geopolitical environments, scale of economy, or lower threat actor presence.

Flagging this as most concerning, the report observed that “it could also mean that incidents are occurring but may remain undetected or unreported due to the currently limited monitoring capabilities specific to drone-based vectors.”

Based on their findings, the UC researchers said the results highlight the need for further action across government, operators, researchers, and industry to secure Australia’s critical infrastructure against drone-enabled cyber attacks. They called for targeted education and knowledge-sharing initiatives to raise awareness of the threat among operators, and for threat modeling to explicitly incorporate drones as potential cyber vectors rather than treating them only as kinetic risks.

The researchers also urged government, industry, and operators to collaborate on mitigation strategies that align with Australian regulatory constraints, while encouraging operators to critically review their own use of drones in daily operations and apply the same risk governance standards used for other security measures. They further recommended joint simulation exercises involving government, operators, and researchers to generate real-world data, and a sustained program of research to build a stronger evidence base on the threat vector and the potential consequences of drone-enabled cyber threats.

Last October, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) reported that critical infrastructure continues to be a target for state- cyber actors, cybercriminals, and hacktivists. This is due to the sensitive data that critical infrastructure organizations hold and their role in providing services that support Australia’s national resilience, sovereignty, and prosperity.

In the U.S., the Cybersecurity and Infrastructure Security Agency (CISA) released three new guides in October to help critical infrastructure operators understand and reduce risks typically associated with unmanned aircraft systems. The resources, part of CISA’s Be Air Aware campaign, cover UAS detection technologies, how to assess and report suspicious drone activity, and safe handling practices for downed drones. The new guidance strengthens the campaign’s focus on helping organizations prepare for and respond to drone-related security threats.