Across the US, hundreds of data centers are planned and under construction, built to power new energy-hungry AI applications. With established players like OpenAI joining with well-funded AI start-ups, companies are throwing money into these builds, with investment in data center infrastructure forecast to hit a staggering $7 trillion by 2030, according to McKinsey.

Yet the race to build infrastructure for powering the AI boom is potentially stymied by a growing threat that existing physical security models are struggling to keep up with: drones. With more than one million drones currently registered in the US, security teams are left to ponder the proliferation of the unregistered drones preferred by malicious actors who intentionally target critical sites like data centers — tapping into networks, breaching security, or causing physical damage that interrupts operations.

Response action, so far, is insufficient. Critical infrastructure security professionals and government bodies acknowledge drone-based security risks, but the data center industry has been slow to include airspace protection technologies in standard perimeter intrusion detection solutions (PIDS). For bad guys looking to target data centers for cyber theft or vandalism, this lag creates an opportunity. For security professionals, the lag increases safety and security risk.

The situation will only be remedied by intentional, forward-thinking action. For new builds, drone detection must be embedded at the design phase, which respects the danger and thoughtfully protects against these 21st-century threats. For older facilities, existing systems must be future-proofed, and frameworks reassessed. And across all data centers, the general wisdom is: If the risk of drones has not yet been considered, it should be.

How the emerging threat is taking shape

Hobbyist drone operators have normalized the sight of drones in the airspace, making it tempting to view these small aircraft as innocuous toys. But drone-related disruptions at European airports highlight how drones have evolved to become safety threats. An analysis found that drone incursion incidents increased fourfold in less than two years at EU airports. Examples like this demand that security professionals recognize the risk drones present.

This starts with looking at two key drone-based risk vectors:

• Spying - Drones are ideal for industrial and cyber espionage. A small, fast-moving object with onboard camera, listening device, or Raspberry Pi can fly over fences to evade guards and security cameras, then hover near walls or rooftops to collect high-quality images, audio snippets, or data.
• Weaponry - Drones can carry stuff, and the bigger the drone, the heavier the payload capacity. With this capability, a drone can become a device for terrorism, carrying a payload that damages a building or harms the people within it.

Incidents at data center sites currently affect little legal recourse. Yet security professionals agree there's a perfect storm brewing. Apart from bad actors, curious and careless operators are also emboldened to navigate drones in places they don't belong. More than one YouTube auditor/influencer has flown over data center sites to take photos they share online with their message. These activities, while innocent, can lay the foundation for future planned nefarious activity by others. In most cases, security staff don't get involved, because they're unaware of the incident, they're ill-informed about drone defense, or they're hamstrung by the rules related to what actions they can take in response.

Soft mitigation: The case for a multi-layered drone defense approach

Current FAA and FCC regulations limit drone mitigation measures to special conditions. In nearly all cases, data center security operators can't shoot drones down, jam their signals to stop flight, or prevent their flight path in any way, even if the drones pose a clear safety threat. Lacking the freedom to physically intercede with problematic drones, most data center security professionals wonder if they should bother detecting them at all.

The answer is a resounding yes, and here’s why: you can take meaningful action, you just have to know what you're doing and why.

"Soft" mitigation of a drone threat comes down to purposefully managing drone detection data. Site-based airspace awareness sensors that generate credible drone location and signal data empower security teams to interpret data, recognize and predict threatening behavior, and act:

• Operations staff can engage in soft-mitigation responses including talking with the pilot, partitioning systems, powering-down, or evacuation.
• On-site security teams can quickly and confidently engage local law enforcement for back-up.
• Sites with the sensor technology required for drone tracking and classification and safe kinetic mitigation will be prepared if authorities are granted.

An effective soft mitigation response requires a multi-layered approach to detecting and tracking drones. Not all sensors are good at everything, so it's important to know which types to include.

Radar is the only sensor type that detects all movement 24/7 regardless of weather or lighting conditions to offer real-time tracking and classification of registered and catalogued drones, non-signal-emitting drones, first-person-view drones (FPVs), and swarms (coordinated drone groupings).

Radar that collects and shares high fidelity data can also improve the performance of other sensors and systems. Together, all elements form a bespoke, multi-layer drone detection solution. Many options for additional sensors exist, including two common types:

• Passive RF sensors monitor the radio frequency (RF) emissions from drones and their ground control stations (GCS). By analyzing these signals, passive RF sensors can identify and locate drones based on their unique radio signatures.
• Electro-optical (EO)/Infrared (IR) sensors, commonly known as pan-tilt-zoom (PTV) cameras, use advanced camera technologies to capture visual (EO) and thermal (IR) data, providing a comprehensive picture of the airspace around your data center environment.

Avoiding a retrofit: drone defense starts on day one

As hundreds of new data centers are built to support the AI-driven digital economy, security systems must be designed to work from day one. When data center planners and security teams fail to plan for drone threats early on, they risk leaving some of the world’s most critical digital infrastructure exposed.

Waiting to address drone risk invites higher costs and greater exposure. Retrofitting security systems after a facility is built is almost always more expensive and often leaves a site partially unprotected during construction. Instead of forcing a reactive stance, incorporate drone defense from the outset by conducting a Drone Vulnerability Risk Assessment (DVRA) during the design phase of any data center project. Adjusting a line on a blueprint is far easier and less expensive than moving fences, sensors, or whole buildings once construction is underway or complete.

Futureproofing the data center means looking up

The drone threat is escalating rapidly. Staying ahead of it is no longer optional; it's essential to protecting people, operations, and sensitive data. As conflicts in Ukraine and elsewhere have shown, commercially available drones can be quickly and cheaply repurposed to create real-world disruption. Inevitably these tactics will proliferate beyond conflict zones and into civilian and commercial environments.

This pace means our notions of terrestrial security must expand to the skies. Forward-thinking operators must begin accounting for the airspace above their facilities now, not later. Just as airports and other critical infrastructure have learned, early planning is key to effective mitigation. A layered security approach combining radar, RF sensing, and other detection technologies provides the best chance to identify and address drone activity before it becomes a crisis.

This article was co-authored by Andrew Corsaro, Vice President of Consulting Services at physical security consultancy ZBeta.