A drone can return safely from an intelligence, surveillance and reconnaissance (ISR) mission while the mission itself has failed.

The aircraft flew. The sensor worked. The ground station received a feed. But if the information was delayed, altered or exposed, the people using it may have made decisions on a picture they should never have trusted.

That is why cybersecurity belongs in the definition of ISR capability. Its value is measured in the confidence a commander can reasonably place in the information received, and in the authority an operator retains over the platform collecting it.

Consider a hypothetical reconnaissance drone monitoring a road ahead of a ground movement. Its connection becomes intermittent. The display continues showing the last received image, but the age of that image is unclear. A clear road five minutes ago is presented with the visual confidence of a clear road now.

No sophisticated intrusion is needed for that failure. Congestion, equipment faults or interference could produce it. An adversary who can manipulate or replay information could exploit the same weakness. The operational consequence is the same: uncertainty has been hidden from the person making the decision.

Security engineering must help make that uncertainty visible.

Protecting ISR therefore requires more than keeping footage confidential. Teams also need assurance about where a message originated, whether it changed in transit and whether it remains relevant. Message authentication can establish origin and integrity; replay protection addresses the separate risk of previously valid messages being accepted again. [1][2]

Those protections have limits. A correctly authenticated message can still contain an incorrect sensor reading. A compromised endpoint may send false information using legitimate credentials. Cryptography protects specific parts of the chain; sensor validation, endpoint security and sound analysis remain essential.

For ISR, the design question is practical: can the operator distinguish current, verified information from stale, missing or uncertain information quickly enough to act appropriately?

There is also a command problem. An ISR aircraft must receive legitimate instructions about where to fly, what to observe and which operating limits apply. An unauthorised mission update could redirect collection, leave an area unobserved or move the platform outside its intended constraints.

The Joint Air Power Competence Centre identifies interception, message forgery, replay and compromised software among the ways UAS information flows can be exploited. The relevant system extends beyond the aircraft to its control stations, links and supporting infrastructure. [3]

This matters as autonomy increases. An aircraft may continue flying without a continuous connection, but someone still has to establish its mission, approve changes and define what happens when communication is lost. Autonomy moves some decisions onboard. It leaves the need for trusted authority intact.

Cybersecurity and communications resilience must consequently be designed together. Encryption cannot restore a radio channel that has been overwhelmed by interference. Equally, a working radio link provides little reassurance if the platform accepts instructions from an unauthorised source.

For an ISR system, the meaningful requirement is to preserve legitimate control where communication remains possible, reject unverified instructions and follow defined contingency behaviour when contact is lost. That behaviour must suit the mission and operating environment: continuing collection, returning or landing can each carry different risks.

Confidentiality has a further operational dimension. Access to ISR footage could reveal what a force can see, which areas attract attention and where coverage is limited. Across repeated missions, collection patterns may reveal priorities even when individual images appear routine.

Protection must follow that information after landing. CISA's UAS guidance addresses software and firmware, operational links, and data storage and transfer. That scope matters: securing an airborne link while leaving a ground station, maintenance device or exported recording exposed leaves another route to the same intelligence. [4]

Fleet design deserves equal scrutiny. If several aircraft share credentials or depend on the same compromised ground infrastructure, one incident could affect much more than one airframe. The loss could become a gap in surveillance coverage, an interruption to tasking or a pause while the wider fleet is checked.

An attritable aircraft should therefore have a deliberately limited security impact when it is lost. Platform-specific credentials, restricted access and a workable way to revoke trust help contain that impact. Recovery time matters too: how quickly can the remaining fleet resume trusted operations?

These are questions to test before deployment. Trials should examine interrupted links, delayed traffic, attempted replay, unavailable ground infrastructure and suspected endpoint compromise. Alongside packet delivery, teams should assess whether operators can recognise stale information, whether command authority remains clear and whether recovery creates an unacceptable gap in coverage.