New research from the University of Canberra and Innovation Central Canberra (ICC), supported by defence tech partner DroneShield, highlights that Australia’s critical infrastructure sectors — including energy, water, communications and data centres — are not adequately prepared for cyber attacks launched or facilitated by drones. This is seen as an emerging domain of threat in modern hybrid warfare and security environments.
What the Report Found
- There have been no major domestic incidents yet, but analysts caution Australia cannot assume it will remain so.
- Drones are no longer just kinetic or visual threats — they are increasingly capable of carrying communications, sensors and even cyber payloads that could interact with networks.
- Detection and response capabilities are limited, especially outside of military applications.
- Government guidance on integrating drone threats into cyber risk frameworks is considered insufficient and fragmented at this stage.
Why This Matters
Increased Accessibility & Capability of Drones
Commercial and hobbyist drones are now more sophisticated, affordable, and widely used — not just on battlefields but across civilian and industrial operations. This makes them tools that bad actors could exploit for reconnaissance, network access, or to inject malware.
Evolving Attack Surface
Critical infrastructure linked with digital systems (IT and operational technology) is increasingly interconnected, which widens the potential points of compromise. Traditional physical defences may not detect or mitigate a drone that’s being used as a mobile cyber delivery mechanism.
Future Threat Predictions
Report authors believe drone-enabled cyber attacks will evolve significantly over the next five years, meaning organisations need to act now rather than wait.
Current Mitigation Status
Government & Industry Response
- Australia’s cyber coordination and security agencies (e.g. the Australian Cyber Security Centre) provide broad cybersecurity leadership but there is no dedicated, unified counter-drone-cyber strategy yet.
- Researchers and industry advocates are pushing for more robust guidance, standards and frameworks specifically for UAV-related cyber risks.
Defence Developments
- The Australian Army is advancing integrated counter-drone capabilities (e.g., ICARUS programme) that help detect and respond to hostile or unauthorised drones — though these are currently more focused on military and tactical scenarios than infrastructure cybersecurity.
Broader Cyber Preparedness
There’s ongoing work to enhance overall cyber resilience across infrastructure sectors, including legislative reforms and collaboration efforts, but specific drone-cyber risk mitigation is still emerging and considered incomplete.
What Experts Recommend
To close the preparedness gap, analysts and authors recommend:
- Greater awareness and education about how drones can act as vectors for cyber threats.
- Better industry–government collaboration to share threat intelligence and best practices.
- Development of unified regulations and counter-UAS frameworks — including risk-based authorisations that let infrastructure operators deploy detection and mitigation tools intelligently.
- Regular review of infrastructure risk models to include UAV-related cyber vectors.
- Australia’s critical infrastructure is currently under-prepared for drone-enabled cyber attacks — a type of threat that’s evolving fast and could have serious implications if exploited.
- While there’s no major incident yet, experts urge proactive planning — including technological, regulatory, and collaborative measures — to ensure resilience.
