Once a niche tool for hobbyists or militaries, drones have become increasingly accessible in recent years thanks to advancements in technology and a rapid decline in costs. This has growing implications for both public and private security. Last year, a surge of unmanned aerial system (UAS) sightings at secure U.S. military bases highlighted the risks drones pose and the challenges in detecting them. In March, a man was sentenced to prison time for illegally flying a drone over California’s Vandenberg Space Force Base and photographing the military complex.
According to Global Guardian’s 2025 Worldwide Threat Assessment, the same technology that is causing problems for the military also poses risks to companies. To prevent state and non-state actors from potentially compromising decision-making, intellectual property and assets, companies should consider counterintelligence and detection measures to identify and mitigate unauthorized drone activity before it leads to security breaches or data theft.
Potential Applications for Drones in Corporate Espionage
In the corporate arena, drones can be used as tools for surveillance and cyberattacks. For example, surveillance drones monitoring restricted industrial sites could allow users to covertly acquire sensitive information from novel vantage points, such as rival oil producers evaluating a competitor's new drilling locations. In the next five to 10 years, microdrones may be able to access buildings undetected, listen in on private conversations and capture strategic discussions and other sensitive intelligence
UAS technology can also facilitate the execution of cyberattacks. Drones can aid proximity-based network attacks, such as “nearest neighbor” hacks, which exploit weak or unsecured Wi-Fi networks to intercept data transmissions or introduce malicious code into corporate systems. While traditional means of proximity-based cyber intrusions can be easily spotted, such as a van parked outside an office building or a suspicious individual in the lobby with a laptop, drones can be more easily concealed, landing on a rooftop or hovering outside a window to breach wireless networks without detection.
Unmanned aerial systems, enhanced by AI-powered navigation, could allow cyberattackers to maintain their distance, lowering the personal risk of the spies or cyberattackers being caught or identified. As a result, those attacks are difficult to trace, which makes them increasingly effective and attractive to malicious operatives.
Drone-Based Espionage Case Studies
There are already examples of UAS technology being deployed for corporate espionage efforts. In the summer of 2022, a U.S. financial firm discovered unusual activity on its when someone gained partial access to the company's Wi-Fi network using the credentials of an employee who had already logged in from home several miles away.
The breach was traced to two consumer-grade drones rigged with network-intrusion hardware and outfitted with tools for intercepting Wi-Fi signals and capturing network traffic that were found on the rooftop near the building’s heating and ventilation system. The drones were able to impersonate a device and breach company systems to access an internal server that contained credentials for accessing other resources and storing IT procedures.
Investigators found that a few days earlier, the drones had been used to intercept a worker’s credentials and Wi-Fi information, which was then hard coded into the tools that were deployed to access secure company information.
A 2019 case demonstrated other ways in which UAS deployment can augment corporate espionage efforts. In Denmark, telecommunications company TDC sought to upgrade its network to 5G, and China’s Huawei and Sweden’s Ericsson competed for the contract. Ericsson’s confidential and lower offer was matched by Huawei, suggesting inside knowledge. An investigation uncovered that boardroom teleconference microphones were tapped as part of a multi-pronged espionage and intimidation effort that also involved drones.
A security guard observed a large drone scanning the investigation room, where a whiteboard with the investigation’s key figures of interest had been left uncovered. A few days later, TDC’s executive team spotted a large drone monitoring them, which then quickly descended and was loaded into a white van at street level.
This multi-faceted approach illustrates how drone operations can magnify the efficacy of other espionage attempts. Huawei’s drones observed confidential information and, by their very presence, may have also fostered distrust and concern within TDC’s executive team.
What Businesses Can Do
At this stage, it is very difficult for companies to counter drone threats. Once a drone has been spotted, a firm’s primary recourse is to contact law enforcement immediately. Since drones are classified as aircraft by the U.S. Federal Aviation Administration, only law enforcement agencies can legally take one out of the air, and for good reason. Signal jamming could impact planes in the sky and firing a weapon at a fast-moving flying object could pose serious safety risks, such as endangering bystanders and causing collateral damage.
Before that point, however, companies can engage with security firms to help identify vulnerabilities before they can be exploited. Drone monitoring and on-site detection systems can also monitor drone communication signals to identify and log data on drones within the area. These on-site products include cameras, radar and signal monitoring to track drones in the vicinity of an office or corporate site.
Since drones are a force multiplier most effectively used in conjunction with other attack vectors, companies should also take steps to secure their broader security infrastructure. Maintaining strong cyber, physical and human security systems can mitigate the potential threat and disrupt coordinated attacks before they escalate.
As drone capabilities continue to expand, so too will their use by nefarious actors. How businesses respond will determine whether they remain protected or become the next cautionary tale.