On November 19, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) launched a new initiative to help protect U.S. critical infrastructure from threats posed by Unmanned Aircraft Systems (UAS), commonly known as drones. As part of its "Be Air Aware™" campaign, CISA released three new guides offering practical advice for infrastructure owners and operators. The guidance addresses the full lifecycle of a drone-related incident, from detection to response. With the use of drones expected to increase, this initiative aims to raise awareness and provide organizations with the tools to incorporate countermeasures against aerial threats into their overall security posture.
The new resources provide non-binding guidance and best practices for organizations to defend against malicious UAS activity. The campaign acknowledges that drones can be used for a range of nefarious purposes, including surveillance, smuggling contraband, disrupting operations, or even carrying out physical attacks.
The three guides are:
This guidance is relevant to all owners and operators of U.S. critical infrastructure, including but not limited to:
There are no mandatory compliance requirements associated with this guidance. However, incorporating these recommendations is a crucial step in maturing a physical security program to address modern, three-dimensional threats. Organizations are encouraged to integrate UAS threat scenarios into their existing security risk assessments and emergency response plans.
The malicious use of UAS poses a significant and growing threat:
Ensuring that wireless guest networks are properly segmented from internal corporate and OT networks can prevent a drone-based Wi-Fi attack from reaching critical systems.
Training employees to be aware of their surroundings and report suspicious drone activity is a low-cost, effective defense.
Establishing clear procedures for responding to a drone sighting, including who to contact and what information to provide, is essential.
CISA launches the 'Be Air Aware' campaign and releases three new guides on UAS threats.

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Help others stay informed about cybersecurity threats
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.