The airspace above the refinery is becoming part of the security perimeter

A refinery perimeter has traditionally been defined by fences, gates, cameras, and controlled access points. Drones change that geometry. An unmanned aircraft can approach from above and observe areas that ground-based controls were never designed to conceal.

That does not mean every drone near a refinery represents a threat. Commercial inspections, public-safety operations, neighboring businesses, and recreational pilots may all create legitimate activity. The security challenge is distinguishing routine flights from behavior that deserves closer attention, then responding without creating unnecessary disruption.

Why drone activity changes the refinery security picture

The Cybersecurity and Infrastructure Security Agency expects drone activity near critical infrastructure to increase as commercial and recreational use expands. CISA also stresses that most activity is likely nonthreatening and compliant with Federal Aviation Administration rules.

Some patterns, however, may indicate surveillance, testing of security procedures, or another potentially harmful purpose. Repeated passes over sensitive areas, prolonged low-altitude hovering, concealed lights, unusual attachments, or activity that appears designed to observe a security response may warrant escalation.

The first security task is establishing what normal looks like

Effective response begins before a questionable flight occurs. Refineries should identify authorized inspection flights, nearby commercial routes, recurring public-safety activity, and local areas that attract recreational pilots. Security personnel need a current picture of when planned flights are expected, who authorized them, and which parts of the facility they may cross.

This baseline helps officers avoid treating every sighting as an emergency. It also makes unusual activity easier to recognize. A drone that appears at an unexpected time, follows a sensitive process, or returns repeatedly becomes more meaningful when the site understands its normal airspace activity.

What frontline security teams should be ready to observe

Security officers do not need to identify a drone's purpose on sight. Their responsibility is to capture useful facts and escalate them through established procedures. Reporting should document:

• Time, duration, location, and direction of travel
• Size, color, lighting, flight pattern, and visible attachments
• Repeated hovering or passes near sensitive operations
• Possible operator or launch location, when observable from a safe position

Officers should maintain a safe environment, follow site post orders, and notify the designated operational or security leader. They should not attempt to interfere with the aircraft or handle a downed drone. Suspicious or grounded devices may require law-enforcement support and evidence-preservation procedures.

A drone incident is an operational coordination test

Drone readiness is not a stand-alone security assignment. A sighting may affect operations, safety, emergency response, communications, and relationships with local authorities.

Site procedures should define who receives the initial report, what information is required, when leadership or law enforcement is contacted, and how actions are recorded. Refineries should also consider how a drone incident could affect hazardous processes, restricted work, contractor movement, or emergency operations.

The FAA's May 2026 proposed rule would create a process for operators of certain critical infrastructure to petition for drone flight restrictions over their sites. Regardless of how that proposal develops, facilities still need practical procedures for activity that reaches the site today.

Preparedness matters more than hardware

Technology may support aerial awareness, but tools alone do not create an effective response. Detection systems must fit the facility, integrate with existing procedures, and undergo legal review before deployment.

The stronger starting point is a coordinated oil, gas and energy security program that connects trained personnel, post orders, reporting, operational leadership, and public-safety partners. When these elements work together, a drone sighting becomes a managed incident rather than an improvised reaction.

Bring aerial activity into the security plan

The airspace above a refinery is becoming part of the operating environment security teams must understand. Leaders should review whether current risk assessments, training, post orders, and emergency plans address suspicious drone activity.

Frequently asked questions

• What makes drone activity near a refinery suspicious? Context matters. Repeated passes, prolonged hovering, unusual attachments, concealed lighting, or activity near sensitive operations may justify closer examination.
• Does every drone sighting require law enforcement? No. Sites should distinguish expected activity from suspicious behavior and follow defined escalation thresholds.
• What should an officer record? Record the time, location, appearance, flight pattern, direction, visible attachments, and any safely observable operator location.
• Can security officers disable a drone? Officers should not attempt to interfere with an aircraft. They should follow site procedures and contact appropriate authorities.
• How should a refinery prepare? Establish normal flight patterns, update post orders, train personnel, define escalation responsibilities, and include drone incidents in emergency exercises.

Talk to an oil and gas security expert

Speak with an Oil and Gas Security expert at GardaWorld Security about building frontline awareness and coordinated response into your refinery security program.

Strengthen airspace security