Monthly Archives: October 2026

On October 13, 2026, the government of New South Wales opened a procurement for drone detection across its prisons, after two suspected contraband deliveries in a fortnight and three arrests. Radio frequency detection and radar were named as the priority technologies. Three days later, Thailand’s civil aviation authority suspended general drone permits over a restricted zone in Bangkok to support the police counter-drone centre during the International Monetary Fund and World Bank meetings, with any flight connected to the event required to apply in advance, obtain special authorisation and coordinate with that centre.

Two procurements, two continents, and neither of them is a national security programme. One is a corrections service trying to stop contraband arriving over a wall. The other is a civil aviation regulator protecting an airspace for a week.

This is the part of the market that has moved fastest in the last two years, and it has moved in a direction the industry did not plan for. The customer is no longer a specialist who understands radar cross sections. It is a facilities manager, a prison governor, a police inspector or an airport operations officer. They read the same tender documents we do, and they bring a different set of questions.

Why Civil Agencies Became the Fastest Growing Buyers

Four places in ordinary civil life have turned into drone problems in a short space of time, and each of them carries a legal duty that has nothing to do with national policy.

The first is the correctional estate. A prison is a walled perimeter with a known population and a contraband economy that has discovered a delivery route above the wall. The prison estate in the United Kingdom reported 1,497 drone incidents in a single year. A service that counts incidents at that volume is not asking whether drones are a problem. It is asking what to buy first.

The second is civil aviation. An airport does not close because of a policy preference. It closes because the tower cannot assure separation while an unidentified object is inside the approach path. The cost is measured in diverted arrivals and missed connections, and the person who has to explain it is an operations director.

The third is the public event. A summit, a finance meeting, a stadium fixture or a national celebration produces a temporary restricted zone with its own rules, its own permit process and a fixed date. There is no time to build anything permanent, and no tolerance for a system that needs three months of site work.

The fourth is the city itself. A police force that receives reports of drones over a hospital, a substation or a crowd has to respond with the staff it already employs, on the shift roster it already runs.

None of these buyers is looking for a national capability. They want an operational answer to a nuisance, a safety risk or a crime, and they want it inside an existing legal framework and an existing budget line.

The Three Costs a Civil Buyer Actually Counts

Civil agencies evaluate a counter-drone system differently from a specialist buyer, because three costs dominate their calculation and range is not one of them.

The first is acquisition, and it is the least interesting. Every supplier can quote a price for a box, and the boxes are more similar than the brochures suggest.

The second is regulatory friction. A device that transmits needs a licence, a licence needs a process, and the process needs a decision maker who may not exist for this category of equipment in that jurisdiction. A device that only receives needs none of that. For an agency that has a date on the calendar, the difference between a four-week deployment and an eighteen-month approval is the entire project.

The third is operating labour. Every additional screen, every additional login and every additional report is a person-hour taken from a roster that is already full. A system that needs a dedicated operator is a system that a prison cannot staff at night and an airport cannot staff at peak. A system that runs unattended and leaves a record someone can review in the morning fits the staffing these organisations actually have.

There is a fourth cost that appears later and surprises buyers: the cost of a false alarm. A civil site with a genuine operational job has no spare people to investigate three tracks an hour, and an operator who is asked to investigate noise stops investigating. Sensitivity without a workable false alarm rate is not a feature. It is a staffing problem disguised as a specification.

Why Passive Comes First

Passive detection means receiving only. The sensor reads the radio link between an aircraft and its controller, and it transmits nothing of its own.

That one property produces three advantages that civil buyers value above range.

It removes the licensing question. A receiver that emits nothing does not require a frequency authorisation in most jurisdictions, which means it can be installed and used while a legal review of other options is still underway.

It removes the interference question. A prison inside a residential area, a hospital campus, a port and an airport all share a low tolerance for radio emissions of unknown effect. A passive sensor adds nothing to the local spectrum, so it can run beside aviation radio, public safety radio and building systems without a coordination study.

It produces evidence as a by-product. A passive sensor that logs what it hears builds a record of the radio environment over time, which is the raw material for both operational decisions and legal proceedings. For an organisation that may have to justify an action in front of a regulator, a court or a public inquiry, that record is not a bonus feature. It is what makes the purchase defensible.

The Authority Gap Is Normal, Not a Failure

The New South Wales case is worth reading closely, because it describes a problem that has nothing to do with technology.

The procurement is for detection. The prison officers’ union simultaneously asked for a change in the law so that officers could use portable electronic equipment to force a drone to land. The service can buy the ability to see an aircraft approaching with a payload. Under current law it cannot act on what it sees.

This gap is not unusual and it is not evidence of a bad purchase. It is the normal sequence in civil procurement. Detection is legally simple, technically mature and easy to justify to a finance committee. Response is legally complex. It needs an authorised operator, a defined procedure, a record of the decision and an accountable chain that survives review. Most agencies reach detection first because that is the part they can approve, and they add response when the legal framework catches up.

Suppliers who treat that sequence as an obstacle tend to lose the deal. Suppliers who design for it, so that a detection-only installation can later accept an authorised response module without being replaced, tend to keep the customer for a decade.

A Response Ladder Where Only the Last Step Is Conditional

The response question is where the language in this industry gets sloppy, and where the compliance boundary matters most.

A useful frame has four levels. The first is awareness: the site knows something is present. The second is characterisation: the site knows what it is, where it came from and where it is going, which is what passive radio frequency detection with direction finding provides. The third is documentation: the event is recorded with time, position, track and classification, in a form that survives review. The fourth is action, and action is where authorisation, local law and operator qualification decide what is available at that site on that day.

The first three levels are unrestricted in most jurisdictions and they carry most of the value, because a documented detection is enough to trigger an existing procedure. That procedure might be a patrol dispatch, an airspace notification, a search of a compound or a prosecution. All of them work without any device that affects the aircraft.

The fourth level is conditional. Any capability that affects an aircraft in flight must be deployed under authorisation and in accordance with applicable local law, with a named operator, a defined procedure and a record of the decision. That is not a disclaimer bolted onto a product page. It is the design constraint that determines what a supplier should offer an organisation whose legal position is not yet settled.

Matching the Form Factor to the Site

Three shapes cover most of what a civil agency needs, and the choice is decided by the site rather than the specification sheet.

The handheld detector answers the officer or the duty manager who has to check something now. The H3 Pro detects at up to three kilometres, follows more than eleven aircraft at once and responds in under five seconds. It weighs under 600 grams without the antenna, runs more than four hours on its internal battery, works from minus 25 to 65 degrees Celsius and operates from a moving vehicle at up to 80 kilometres per hour. That last figure is what makes it a patrol tool rather than a fixed post.

The portable case answers the site with no infrastructure and no data to build any. The HD5 covers a continuous 100 MHz to 6 GHz span, runs six to seven hours on a replaceable battery, presents on a 13.3-inch screen, and travels as one closed case under 14 kilograms. It is what gets switched on at a summit venue, a construction compound or an emergency cordon where there is no power, no mast and no control room. Its range depends on the protocol being read and on how clean the local spectrum is, so the honest figure is conditional rather than a single headline.

The vehicle answers the moving perimeter. VM covers 30 MHz to 6 GHz for detection at up to three kilometres, holds about 3 degrees of direction-finding accuracy against a hovering target and about 10 degrees while moving, and operates at vehicle speeds up to 80 kilometres per hour. The unit weighs about 60 kilograms in an IP66 housing rated from minus 40 to 60 degrees Celsius. Where a response option is fitted, it is enabled only for authorised operators under the procedures described above.

For a permanent site, the DF Series passive direction finding sensors read the control link without transmitting. DF10 in its current V2.0 configuration covers 70 MHz to 8 GHz across minus 25 to 60 degrees Celsius. One unit gives a bearing; several units reporting to one platform give a position, which is why the fixed part of a civil deployment is usually specified in numbers rather than in range.

What a Civil Tender Should Ask For

Because these buyers are new to the category, the questions they write into a tender matter more than the answers they receive.

Ask for a false alarm rate measured over a stated period at a comparable site, not a detection probability. Ask what the system does when the network is unavailable, because a prison wing and a temporary venue both lose connectivity. Ask who owns the recordings, and whether they can be exported in a format a lawyer can read. Ask what happens at the end of the support period, and whether the installation still detects. Ask how a second site would be added, because the second site always comes.

None of those questions favours one supplier. All of them make the tender harder to answer with a brochure, which is the point.

The Bottom Line

The civil market arrived without a strategy document, because it was created by individuals solving local problems: a governor with contraband over the wall, an operations director with a diverted arrival, a commander with a summit in three weeks.

They buy detection first because detection is what they can approve, deploy and defend, and because a documented track is enough to trigger the procedures they already run. Response comes later, when the law catches up and the budget allows it.

For LZ TECH, that is the sequence our passive product line is built around, with the command layer ready to accept an authorised response module when the customer’s authority to use one exists. An agency that starts with detection has not bought an incomplete system. It has bought the part of the problem that can be solved this year.

On October 13, 2026, Teledyne FLIR announced the Ranger R10-3DX, a compact counter-drone radar, at an industry exhibition in the United States. The company states a detection range beyond three kilometres against small drones, with a single panel covering 90 degrees in azimuth and up to 60 degrees in elevation, four panels combining into 360-degree coverage, and artificial intelligence classification built in. Delivery is planned for the first quarter of 2027. Those are manufacturer figures, not independent verification, and a buyer should be able to say so plainly.

Three days earlier, on the evening of October 10, operations at Jose Maria Cordova airport outside Medellin stopped at about 22:28 because of a suspected drone and resumed at about 22:45. The regional governor said a counter-drone system was activated and the aircraft was brought down, and that the operator, origin, and intent were still under investigation.

Two events, one technical and one operational, describe the same gap. A radar can tell you that something is up there. It cannot tell you what it is, and the decision that follows depends almost entirely on that second question.

Two Sensors, Two Different Questions

Radar answers questions about physics. Is there an object, where is it, how fast is it moving, in which direction, and is it closing? Those answers are available at long range, in darkness, in fog, and without any cooperation from the aircraft. They are also deliberately unspecific. A radar return from a quadcopter and a return from a large bird can look similar at the edge of coverage, and a return from a delivery drone and a return from a police helicopter can occupy the same track for several seconds.

Optics answers questions about identity. What shape is it, how many rotors, what colour, what is suspended beneath it, which operator is holding a controller, and does the object behave like a machine or a bird? Those answers are specific, and they require a clear line of sight, decent visibility, and enough magnification for the sensor to resolve the object rather than a dot.

Neither sensor produces a decision on its own. The radar produces a candidate. The optical system produces an identification. The confirmation layer is the handoff between them, and its quality decides whether the organisation acts, waits or stands down.

A Compact Radar Number Needs a Condition

The three kilometre figure in the October announcement is a good example of a number that means less than it appears to.

Radar range against small drones is a function of the target’s radar cross section, its altitude, the local clutter environment and the amount of processing the system is allowed to spend on a single detection. A specification quoted without those conditions describes the best case the manufacturer observed, not the range a customer will see from a rooftop in a city.

This is not a criticism of one product. It is the normal condition of the whole category, and it applies to our own hardware as much as anyone’s. The useful discipline for a buyer is to ask four questions of any compact radar: against what cross section, at what altitude, in what clutter, and with what false alarm rate. A radar that reaches a given distance but generates a steady drizzle of false tracks is not a long-range radar. It is a machine that trains operators to ignore it.

The elevation coverage in that announcement is worth noting for a different reason. Sixty degrees of elevation from a single panel matters in urban and airport settings, because the aircraft of concern are often above the horizon line of a flat panel installation and because a site surrounded by tall structures produces returns from an unusual geometry. Coverage in elevation is the specification that quietly decides how much of the sky a site is actually watching.

The Handoff Is the Hard Part

Integrating a radar with an optical system is straightforward in a demonstration and difficult in an installation, and the difficulty is concentrated in three places.

The first is coordinate registration. A radar reports a target in its own frame, the optical system points in another, and the two frames are separated by a mounting offset, an alignment error, and, on a mobile platform, a changing attitude. If registration is off by a fraction of a degree, the optical system looks at empty sky while the aircraft crosses the edge of its field of view. On a fixed mast, this can be corrected once. On a vehicle, it has to be maintained continuously.

The second is time. A radar track and an optical image are useful together only if they describe the same instant. Our own software releases tightened time synchronisation to under one second across the platform, and even that requires care, because a target moving at twenty metres per second travels twenty metres in the interval. The optical field of view at long range is narrow, and a twenty metre error can put the target outside it.

The third is cueing logic. Which track gets handed to which camera, in what order, and what happens when two tracks converge. A system that sends every track to the nearest camera will spend its time slewing between targets and confirming none of them. A system that prioritises by proximity to a protected asset, by closing speed and by track persistence confirms the ones that matter first.

Seventeen Minutes at an Airport

The Colombian event is a useful case because it is short and completely ordinary.

A suspected drone appeared, an airport stopped, a system was activated, the aircraft came down, and operations resumed. Seventeen minutes of closure is a good outcome by the standards of the last few years, where single events have shut airports for hours. It is also seventeen minutes of diverted arrivals, holding aircraft, missed connections, and a regulatory report, and it happened because someone had to make a decision under time pressure with incomplete information.

That is the operational argument for the confirmation layer. The cost of a false positive at an airport is a closure that did not need to happen. The cost of a false negative is an aircraft on the ground or worse. Neither error is cheap, which means the site cannot optimise for sensitivity alone. It has to optimise for the time it takes to turn a candidate into an identified object, and for the confidence attached to that identification when it is made.

A counter-drone installation that reports a detection in two seconds and takes four minutes to confirm it has not solved the airport’s problem. It has moved the uncertainty from the radar operator to the watch commander.

Where Optical Confirmation Sits in a Product Line

Two optical roles need separating, because they answer different questions and are often confused in tenders.

The scanning role belongs to a system that searches on its own. VAR300 carries a 46x identification and tracking lens from 7 to 320 mm and a 23x search lens from 5.9 to 135.7 mm, both at 1920 by 1080, alongside an uncooled 640 by 512 infrared core with a 25 to 75 mm lens. Against a Mavic 3-class target, the reference figures are detection beyond one kilometre and tracking beyond 1.5 kilometres by day, and 0.5 kilometres detection with 0.8 kilometres tracking at night. Azimuth is continuous 360 degrees, elevation runs from 0 to 15 degrees, maximum tracking speed is 120 degrees per second, and the unit weighs up to 37 kilograms in an IP66 housing rated from minus 20 to 60 degrees Celsius. It can separate a multirotor from a bird and hold a bearing to within 2 degrees, which is what makes it useful as a confirmation source when a radio frequency sensor raises the first alarm.

The tracking role belongs to a system that is pointed. T100 is guided by a radar or a radio frequency sensor rather than searching on its own, and it is built to identify and follow what someone else has already found. Its lens runs from 6.1 to 561 mm at 2688 by 1520, with a 5 to 50 mm 4K wide camera and a 640 by 512 infrared core at 15 to 100 mm. Against the same Mavic 3 class target, the reference figures are identification beyond two kilometres and tracking beyond three kilometres by day, and one kilometre identification with 1.5 kilometres tracking at night. On a larger target, the figures extend to four kilometres identification and five kilometres tracking by day. It carries 200 TOPS of local compute, which allows classification on the device and retraining of the model against local conditions. The gimbal covers 360 degrees in azimuth and minus 90 to plus 90 in elevation; the unit weighs 29 kilograms and is rated IP66 from minus 30 to 65 degrees Celsius.

For LZ TECH, the distinction matters in a tender. A site that buys a pointing tracker and expects it to search has bought a system that will only look where someone tells it to look. A site that buys a scanning system and expects long-range identification has bought a system with a wider field of view and a shorter reach. Both are correct purchases for the right job, and both are wrong purchases for the other one.

Building the Layer Without Overselling It

The radar side of this chain is also where the temptation to quote a single figure is strongest, and it is the reason our optical answer is built the way it is. T100 is a pointing tracker, not a searching sensor. It takes a track from whatever radar or radio frequency sensor the site already owns, or from whatever radar the project selects, and turns that track into an identification. The design choice keeps the confirmation layer independent of one radar supplier, which matters both in projects where the radar is still being chosen and in sites that already run a radar they intend to keep.

A tracker that works with one radar is a tracker that forces a sensor purchase. A tracker that accepts a standard track input can be deployed on the customer’s schedule instead of the supplier’s. That difference decides whether an upgrade is a purchase order or a three-year programme.

It also sets the honest limit of what we publish. The radar’s range belongs to the radar, and it depends on the target cross section, the altitude and the clutter of the site it is watching. We do not quote a distance for a radar that has not been selected, because the number would describe a configuration the customer does not own. What can be stated without qualification is the tracker’s own performance, measured against a named aircraft class in stated day and night conditions, which is the set of figures given above.

The layer works when three conditions hold. The radar has enough elevation coverage for the site geometry. Registration between radar and optics is maintained by alignment on a fixed mast and by continuous correction on a vehicle. And the command platform treats a confirmed track differently from an unconfirmed one, so that an operator sees one object with a confidence level rather than two sensors arguing.

That last point is a design choice with operational consequences. A system that displays a radar track and an optical track as two separate items doubles the workload of the person deciding. A system that fuses them into one object, with radar geometry and optical identity attached, gives that person something they can act on.

The Bottom Line

The market has spent several years competing on detection range, and the October radar announcement is a reminder that range is now a commodity argument. Compact radars with useful coverage and integrated classification are arriving from multiple suppliers, and the differences between them are smaller than the marketing suggests.

The differentiator that remains is the handoff. How quickly a candidate becomes an identified object, how reliably the two sensors agree on where that object is, and how clearly the command layer communicates the difference between a track and a confirmed aircraft. An airport does not close because a radar detected something. It closes because a person decided, and the confirmation layer is what that person’s decision rests on.

On October 14, 2026, DroneShield published its fourth-quarter software update. The release adds flagging for unfamiliar or unclassified signals to its radio frequency detection systems and upgrades electro-optical and thermal recognition. The company reports a 44 percent improvement in thermal classification, an 18 percent improvement in fixed-wing recognition and an 8 percent improvement in recall. It also lets several DroneSentry-X Mk2 nodes coordinate an action and concentrate effect on a selected band, with the companion command platform release set for November 3.

Read that list again and notice what is absent. There is no new enclosure, no new mast, no new antenna. What shipped in October is a file, and it makes hardware customers already own work better than it did in September. That is the counter-drone software business arriving in public, and it changes what the industry is selling.

The pattern is not unique to one vendor. In every mature sensor market the same moment arrives, when the installed base is large enough that improving it becomes more valuable than extending it. A site that already owns hardware is cheaper to serve than a site that owns nothing, and a supplier that can improve that hardware remotely has a revenue line which does not depend on winning the next tender. What the October release shows is that counter-drone has reached that point, at least for the vendors that have a software layer worth updating.

Why Hardware Revenue Has a Ceiling

A sensor is bought once. The revenue is recognised once, and from that moment the site has less reason to buy another unit of the same type than it had the year before. Every successful sale removes a future sale from the same address. Growth then depends on reaching new addresses, and the number of airports, prisons, substations and stadiums in the world is large but finite.

The usual answer is that the threat changes, so the customer must buy again. That answer is true and it is also inconvenient. If a 2023 detector still detects what it detected in 2023, the customer’s honest conclusion is that the 2023 box was adequate and the 2026 box is a want rather than a need. If instead the 2023 box now finds airframes it could not find three years ago, the customer’s conclusion is that the relationship is producing value, and renewing it is the cheap option.

That difference, not the price list, is what separates a hardware company from a software company inside the same building.

What an Update Actually Sells

Strip the marketing from any counter-drone software release and three things remain.

The first is recognition refresh. A signature library is a perishable asset. New airframes appear, link protocols get new firmware, flight controllers change their frequency hopping, and every one of those events quietly ages the library in the field. A release that adds models is not a feature, it is maintenance of the only thing the sensor is actually good at.

The second is coordination. A single node reporting to a single operator is a detector. Several nodes that divide the search area, hand a track to whichever sensor has the best view, and avoid reporting the same aircraft three times under three different identities are a system. The DroneShield note about coordinating several nodes is the interesting part of that release because coordination is where software earns money that hardware cannot.

The third is record. Every detection, every operator decision, every dismissal is a data point. Kept for a year, those points answer questions no single alert can: what normally flies here, at what hours, on which bands, and what does an actual anomaly look like against that baseline. Organisations that can answer those questions buy differently from organisations that cannot, because they can justify the next purchase with their own evidence.

A Percentage Needs a Baseline

The published figures in the October release are 44, 18 and 8. Those are company numbers, and the useful question is not whether they are large but what they are measured against.

A classification improvement of 44 percent could mean the model now handles a thermal category that previously failed outright. It could also mean the same model scored better on a test set drawn from the same distribution as its training data. Both statements are arithmetically true and they imply very different field outcomes. A buyer who does not ask which one applies is buying a press release.

The honest way to present model gains is to publish three things beside the number: the size and source of the evaluation set, the conditions under which the imagery was captured, and the categories where the model still fails. The third item is the one that builds trust. Every real system has a category it handles badly, whether that is a distant quadcopter against a bright horizon, a fixed-wing aircraft at low contrast, or a bird that flaps at exactly the wrong frequency. A vendor who names its weak category is more credible on the numbers than one who does not.

This matters commercially because model quality is now the differentiator that hardware cannot copy. Two radars with the same panels and the same band can be separated entirely by what their classifiers do with the returns.

Service Has Three Tiers, and Most Customers Need the First

The industry has started to package support as an annual contract. That is the right direction and it is easy to get wrong.

The first tier is baseline: software updates, warranty extension, a hotline that answers, and a documented release schedule. It is unglamorous and it is what the majority of sites actually need. A prison that runs six fixed sensors and one operator on shift does not require a managed service. It requires that the system still works in year four and that someone picks up the phone.

The second tier adds work on the customer’s own signals. That means importing local recordings, retraining or tuning against the aircraft that actually appear on that site, and reviewing the results quarterly. This tier is worth real money to an operator with an unusual local pattern, an industrial site with heavy radio traffic, or a border area where the airframes are not the ones in the catalogue.

The third tier is managed operation: remote monitoring, diagnostics, a spare parts pool, and a response commitment when something fails. It fits very large estates and events with no standing security staff. It is also the tier most often oversold, and overselling it has a predictable result. The customer pays for a level of service they cannot absorb, sees no measurable difference, and declines to renew anything at all.

The pricing basis of a tier deserves as much attention as its contents. A per device fee is easy to administer and punishes the customer for expanding coverage, which is the opposite of what the vendor wants them to do. A per site fee rewards density and makes a wide deployment cheaper per sensor, but it breaks down when one site has four sensors and another has forty. A flat platform fee plus a support band tied to the number of active devices is the arrangement that survives a growing estate without a renegotiation every year. None of this is exotic. It is the ordinary commercial plumbing of a software business, and it is new to a sector that has priced boxes for two decades.

What Belongs in the Contract

Public buyers have become sharper about this, and the contract language is where the difference shows.

Update cadence should be written as a commitment rather than a phrase. Software updates included is not a term; four releases a year, with a named process for urgent signature additions, is a term. Model version matters too, because a classifier that changes without a version number cannot be audited and cannot be rolled back after a bad release.

Data ownership deserves its own clause. Local recordings are the customer’s operational history. Whether the vendor may use them to improve a shared model, and whether the customer can refuse, is a commercial and legal question that should not be settled by a default setting. Organisations with strict internal rules will ask, and the answer they receive will decide the deal.

Exit terms are the clause nobody reads until it matters. If the platform stops receiving updates, does the customer keep a working system, or does a licence server quietly turn a functioning installation into furniture? A support contract that ends should degrade into a system that still detects, still records and still displays, even if it no longer learns.

Finally, a yearly benchmark on the customer’s own site is worth more than any brochure figure. It converts a service contract into measurable evidence, and it gives both sides a shared fact base when renewal comes around.

Where the Platform Layer Sits

Software is also the only part of a counter-drone installation that is touched every week. Sensors sit on masts and are visited when something breaks. The command layer is opened every shift, which makes it the natural carrier for a service relationship.

For LZ TECH, that layer is CCS, which handles device access and status, the map picture, alarms, allow and deny lists, protected zones, event records, statistics and unattended operation, with CRPCS adding web and mobile access and zone-based workflows. The point is not the feature list. The point is that a platform which receives updates, imports customer recordings and reports its own health is a platform that can carry a contract, while a box that leaves the factory finished cannot.

Integration effort belongs in the same calculation. A service contract assumes the vendor can reach the customer’s system, and the cost of that reach is decided at installation. A platform with a documented interface, an export format and a health endpoint can be supported remotely. A platform that requires a site visit to read a log makes every service tier expensive to deliver, and the price of that inefficiency lands on the customer at renewal. The cheapest support contract is written into the product architecture long before anyone signs it.

The Bottom Line

Hardware revenue is a series of transactions. Software revenue is a relationship, and relationships survive only if they keep producing something the customer can name.

That is the test to apply to any subscription offer in this market, including our own. Can the vendor list three things the system does in 2026 that it could not do in 2024, with the site, the aircraft type and the conditions attached? If the answer is specific, the annual fee is a maintenance cost that buys capability. If the answer is vague, the fee is a tax on a product that has not changed, and customers work that out within two renewal cycles.

The second curve is real. It is also narrower than it looks, because software only earns a recurring payment when it delivers a recurring improvement.

On October 6, 2026, MyDefence announced the Wingman Edge, a wearable drone detector that weighs under one kilogram and is 17 percent lighter than the generation it replaces. Two details in the announcement matter more than the weight. The first is that the device runs signature library matching and an on-device AI spectrum analysis at the same time. The second is that it shares what it detects, and what it sees in the spectrum, with other operators, vehicles, and command systems. Together, those two details describe where portable drone detection is heading.

For years, the portable detector has been understood as an alarm. You carry it, it buzzes, you look up. That model still has value, but it is no longer the interesting part of the product. The interesting part is what the device contributes to everyone else. A portable detector that only alerts its own holder is one data point. A set of them feeding one shared picture is a sensing network, and a network is worth more than the sum of its alarms.

Two Philosophies of Portable Detection

Portable detection has always come in two philosophical flavors, and the difference between them decides what the device can find. One approach matches what it receives against a library of known signals. If a drone’s control link matches an entry, the device names it. This is fast, inexpensive, and very accurate for the models in the library. It is also blind to anything the library has never seen.

The other approach analyzes the spectrum itself and asks not whether a signal matches a known entry, but whether it behaves like a drone link at all. This is harder; it needs more processing power, and it produces a classification rather than a name. Its advantage is that it can flag an aircraft no library contains, which is exactly the category that has grown fastest: small FPV builds, custom airframes, and low-cost machines assembled from parts that were never registered anywhere.

The two approaches are not rivals so much as different shifts on the same watch. A library answers quickly and precisely when it has seen the signal before. Spectrum analysis answers more slowly but keeps working when the signal is new. A device that does both covers the common case at speed and the unusual case with judgment, which is the combination that a field operator actually needs.

What Edge AI Actually Adds

Running the analysis on the device rather than on a server is what turns that second approach into something a person can carry. A detector that ships its spectrum to a remote processor needs a network, waits for a reply, and stops working when the connection does. A detector that classifies locally keeps working in a basement, in a tunnel, on a shoreline with no coverage, and inside a building where the local network has been switched off for security reasons.

Local classification also changes what the device can be trusted with. When the analysis happens on board, the answer arrives in the time it takes the operator to look up, and it does not depend on a link that may be congested precisely when the airspace is busiest. For a portable tool, the latency of the answer is part of the answer, and the edge approach puts the latency where it belongs.

There is a third effect that gets less attention. On-device analysis produces a local record. Every reading is captured on the device whether or not a network is present, which means the operator can reconstruct what happened after the fact, and the organization can build its own picture of what normally flies over a given location. Over a year, that local history is more useful than any single alert, because it establishes the baseline against which an anomaly becomes visible.

The Case for Staying Passive

Both of these developments sit on top of an older design choice that has become more valuable, not less: the portable detector listens and does not speak. A passive device adds nothing to the radio environment it is monitoring, which keeps it usable in dense urban settings, near airports, and inside buildings where an active emitter would raise questions nobody has time to answer.

Passive operation is also the property that makes a network of portable detectors practical. Ten receivers can be deployed in a crowded area without any of them competing with the traffic they are trying to read, and without any of them needing a transmission license to be there. That is not a minor convenience. Most of the sites that need portable coverage, from a temporary event to a moving convoy, are exactly the places where the administrative path is shortest, and the tolerance for signal interference is lowest.

The practical consequence is that passive portable detection can go where an active system would need a permission that no one can obtain in time. A detector that can be switched on at a festival, a construction site, or a port without a regulatory process is a detector that actually gets used, and a capability that is not deployed protects nothing.

From an Alert to a Contribution

The change the October announcement makes visible is the move from an alert to a contribution. A standalone detector tells one person that something is overhead. A cooperative one tells the network where the signal is, what it looks like, and which other devices can see it, which is what allows a shared picture to exist without a fixed installation. Several portable sensors in different hands, reporting into one layer, cover ground that no single fixed site could cover.

That is also how a portable device earns a place inside an estate that already has fixed sensors. A fixed installation knows its own coverage well and its gaps equally well. A set of portable detectors carried by the people who move through those gaps turns the gaps into covered ground, and it does so without a construction project, a planning application or a mast. The contribution is not a better alarm. It is additional coverage that the network did not have before.

The value of that contribution rises with the number of devices. Two detectors in the same area already give a rough sense of direction, because each reports a different bearing to the same signal. A handful of them, reporting time-stamped readings into one layer, produce something closer to a position. The network effect here is not a marketing phrase. It is the arithmetic of how many bearings it takes to resolve a location.

Where Handheld and Portable Fit

Two form factors answer two different jobs. The handheld detector is built for the person who has to decide now. It is light enough to carry all day, it identifies a drone at the protocol level rather than only sensing energy, and it produces a position accurate to a few meters. The H3 Pro detects at up to three kilometers, follows more than eleven aircraft at once, and responds in under five seconds. It weighs under 600 grams without the antenna and runs for more than four hours on its built-in battery, across a temperature range of -25 to 65 degrees Celsius. It also works from a moving vehicle at speeds up to 80 kilometers per hour, which is what makes it useful for patrol and convoy duty rather than only for a static post.

The portable case answers a different question: what to bring when there is no infrastructure at all. The HD5 covers a continuous 100 MHz to 6 GHz span, runs for six to seven hours on a replaceable battery, presents its picture on a 13.3-inch screen, and travels as a single closed case under 14 kilograms. It is the unit that gets switched on at a site with no power, no mast, and no control room, which is the normal condition for a temporary event or an emergency deployment. Its range depends on the protocol it is reading and on how clean the local spectrum is, so the honest figure is a conditional one rather than a single headline number.

Offline Operation Is Not Optional

The edge approach also settles an argument that has run through portable detection for years. A device that depends on a cloud service is a device that fails on the day the service is unavailable, and the day a drone appears over a site is not the day to discover that the local link is down. Offline classification is not a feature to be traded against accuracy. It is the condition that makes the device usable in the places it was bought for.

The same logic applies to the network. A cooperative layer that assumes permanent connectivity will not survive contact with a remote site, a moving patrol or a building with its own security policy. A network of portable detectors should degrade into a set of working detectors when the link is lost, and recover into a network when the link returns. Anything else is a design that performs in the demonstration and not in the field.

Backward compatibility belongs in the same conversation. An organization that already runs fixed sensors and a command layer does not want a portable device that speaks only to itself. It wants one that reports into the picture it already has, so that the new coverage arrives as an addition rather than as a second system to manage. Interoperability is what decides whether portable detection extends an estate or fragments it. For LZ TECH, our portable detectors report into the same layer as our fixed sensors, so additional coverage arrives as an extension of the estate rather than as a second system to run.

Portable drone detection is changing faster than its form factor suggests. The device still looks like a box that a person carries, but the work it does has moved. A fixed library of known protocols is no longer enough on its own, because the fastest-growing share of the threat is the part no library has seen. Classification has to happen on the device, in the moment, without a network. And the result has to be shared, because a portable detector feeding a networked picture is worth far more than one that only makes a noise.

The direction the October announcement points at is therefore not about weight. It is about where the intelligence sits, whether the device can work alone, and whether it makes the whole network smarter. A portable detector that answers yes to those three questions is a sensing node. One that answers no is an alarm, and the market has started to price the difference.

Between September 28 and October 5, 2026, maritime security monitors recorded at least twelve attacks, attempted attacks, or harassment incidents against tankers, LNG carriers, and LPG carriers in the waters around the Strait of Hormuz, the highest weekly total for that waterway in the current period of regional tension. The International Maritime Organization logged nine of them. One tanker was struck by an unidentified object, and twelve crew members were injured.

What makes that week significant is not only the count. It is what happened on the demand side in the days that followed. Maritime security providers reported a sharp rise in inquiries from shipowners, with oil and gas transport and offshore energy operators showing the strongest interest. For a market that spent years serving a narrow, high-end customer, that is a change of address. Maritime counter-drone is moving from the superyacht to the commercial fleet.

Why the Superyacht Model Does Not Carry Over

The first maritime counter-drone buyers were private owners, and the requirements that shaped the first generation of products came from that world. A superyacht has a small crew, a generous budget, and a strong preference for discretion. It can also be highly selective about where it sails. A system tuned for that customer optimizes for a compact footprint, a discreet installation, and a willingness to avoid difficult water when the risk rises.

A commercial fleet has almost none of those conditions. The vessel is large, the crew is busy with its own work, the budget is scrutinized, and the route is set by a charter contract rather than by a security preference. A tanker that has to keep a schedule through a contested waterway cannot decide to go around it. The product that fits a superyacht is not the product that fits a very large crude carrier, and the gap between the two is where the current market is forming.

The commercial buyer also asks different questions. A private owner asks whether the system works. A shipping company asks who operates it, what it costs to run for five years, whether it can be transferred between vessels, and who is liable when it is used. Those questions move the design away from a single impressive capability and toward something a small crew can run in addition to its normal duties.

The Constraints a Moving Vessel Creates

A ship is a difficult sensor platform, and the reasons are physical before they are technical. Salt spray and constant humidity attack outdoor equipment. The deck is never still, so a sensor has to hold a track while its own reference frame keeps moving. The radio environment is dense with legitimate traffic, from port systems to navigation aids. And the airspace around a busy waterway is crowded with aircraft and small craft that must never be mistaken for a threat.

The regulatory picture adds a second layer of difficulty. A vessel crossing several jurisdictions passes through different rules on what may be transmitted and when. An action that is permitted in one stretch of water may be prohibited in the next, and a bridge crew has neither the time nor the legal standing to resolve that in the moment. This is the reason the design conversation in maritime counter-drone has shifted toward detection and documentation first, with any further option reserved for the waters and the cases where it is permitted.

There is also the question of who is watching. On land, a control room can dedicate an operator to the airspace picture. At sea, the same officer who handles navigation and communications has to handle a drone alert. A system that demands attention will be switched off within a month. A system that stays quiet until it has something worth saying is the one that survives a real voyage.

Detection on a Rolling Deck

The sensor mix that answers these constraints is passive by preference. Our DF Series of direction-finding sensors reads a drone’s radio link without transmitting, which keeps the vessel silent in the electromagnetic sense and leaves the regulatory question for later. The fixed member of that family covers 70 MHz to 8 GHz and detects a drone at up to eight kilometers under open conditions, with direction-finding accuracy of about three degrees against a hovering target. That last detail is the one that matters at sea, because a drone that is holding position to observe a ship is exactly the case a bearing accuracy figure is meant to describe.

A bearing from a single sensor is useful but incomplete, because a bearing does not say how far away the contact is. The D5-B adds the missing dimension: a compact passive node that uses time difference of arrival across a small network to produce a position rather than a bearing. It covers 30 MHz to 6 GHz out to three kilometers, places a contact to better than ten meters, and can follow more than thirty aircraft at once with a response under two seconds. Mounted at several points on a hull, a set of nodes turns two bearings into a coordinate, which is what a bridge needs in order to say where the contact is rather than roughly which way it lies.

The third layer is visual. The VAR300 combines a visible light channel with a thermal imager and locks onto the contact the radio layer has already found, which confirms that the track is a real aircraft rather than an artifact of a crowded spectrum. Against a Mavic class target it detects at about one kilometer and tracks at about one and a half kilometers in daylight, with shorter but usable figures at night. On the water that matters more than it does on land, because a mast-level camera has a long uninterrupted view toward the horizon, and the visual record is what a master needs when the event is reported to a flag state, a port authority or an insurer.

Read together, the three layers produce what a vessel actually requires: a bearing from the passive layer, a position from the network, and a picture from the optical channel. None of them requires the ship to transmit, which is the property that makes the whole stack deployable without a licensing exercise in every port.

The Jurisdiction Problem

Maritime counter-drone is unusual in that the legal question changes with the position of the vessel. Territorial waters, contiguous zones, international straits, and the high seas each carry different rules, and those rules apply to the ship as well as to the aircraft. A master who takes a unilateral action in the wrong jurisdiction has created an exposure that outlasts the drone event by years, and may have done so on behalf of a company that would not have authorized it.

That reality pushes the architecture in a specific direction. Detection, classification, and recording are available everywhere and involve no transmission, so they form the baseline that can be switched on in any water. Response options are treated as a separate, conditional layer, enabled only where the local framework allows it and only under a defined authority on board. The practical result is a system whose first product is knowledge: what is out there, where it is, what it is doing, and a record of all three.

This is also why the recording function deserves more weight than it usually gets. A drone event at sea ends in a report to a flag state, a case file for an insurer, and sometimes a claim. The passive track with timestamps, the position history, and the optical confirmation are what turn a verbal account from a watch officer into a documented sequence that a third party can assess.

What Offshore Platforms Need Differently

Fixed offshore installations share the water but not the problems. A platform does not roll, so the sensor stability question largely disappears. It does not change jurisdiction, so the regulatory environment is known in advance and can be written into the operating plan. What it does have is a permanent watch requirement, a remote location, and a steady stream of legitimate air traffic from crew changes, supply runs, and inspection flights that must be separated from everything else.

That combination favors the same passive layers used at sea, arranged as a permanent installation rather than a portable one, with the classification layer doing the work of separating scheduled traffic from everything else. The value of a low false alarm rate is higher here than almost anywhere, because a platform that escalates every supply flight will stop trusting its own alerts within a month, and an alert that is not trusted is worse than no alert at all.

The economics point the same way. An offshore installation cannot send for help quickly, so its defense is measured in the time it buys and the confidence it creates. A detection layer that identifies a contact at range and confirms it visually gives the installation’s operator the minutes needed to move people, pause a transfer operation, or call the mainland. Those minutes are the product.

Questions a Shipowner Should Ask

For most of the past decade, counter-drone procurement worked like a hardware purchase. A site found a gap in its coverage, bought a detector to fill it, added a countermeasure where the rules allowed one, and considered the perimeter handled. That model still exists at the low end of the market. At the top of the market, it is being retired, and the first nine days of October 2026 made the retirement visible in public documents.

Three announcements landed inside a single week. EOS, the Australian systems house, signed a contract worth about 370 million pounds with an undisclosed Gulf Cooperation Council government to build a nationwide counter-drone system, with MARSS NiDAR as the AI command layer and EOS acting as prime contractor and integrator. NATO DIANA used its Rapid Adoption Service for the first time, awarding capability development contracts to seven companies from six nations, with validation planned at a live trial event in the Czech Republic. And Intelic, a Dutch company, won a 30 million euro award from the Netherlands for an airspace security upgrade built on its Nexus software, which sits above radars, sensors and cameras from several different vendors.

Read separately, these are three unrelated news items about three different customers. Read together, they describe one change. None of the three purchases is mainly a device. Each one buys a layer that sits above the devices, a command and control function that turns many inputs into one operational picture. And each one assumes that the picture will keep being supported for years after the hardware is delivered. That is a different kind of purchase, and it changes what a supplier has to be good at.

Three Deals, One Direction

The three programs differ in almost every respect except their shape. One is national and dispersed, designed to cover a whole country rather than a short list of fixed sites. One is a fast evaluation route, in which short contracts and field trials replace a multi-year specification cycle. One is an airspace security upgrade that deliberately does not replace the sensors the customer already owns. Different geographies, different budgets, different procurement cultures, and the same underlying question: how do you connect a mixed set of sensors, from more than one vendor, into something a single operator can act on?

That question is the reason the three deals exist. A country that has already bought radar from one supplier, cameras from a second, and radio frequency detection from a third does not need a fourth sensor. It needs something that makes the first three work as one. The award structures in all three cases point at the layer above the hardware, because that is the layer that decides whether a mixed estate behaves like a system or like a shelf of unrelated products.

The budget context makes the direction harder to dismiss as a coincidence. NATO has stated that member nations plan to spend more than 40 billion dollars on counter-UAS capability over the next five years. Money at that scale does not get spent on individual detectors site by site. It gets spent on structures that can be procured once and extended repeatedly, which is precisely what a national command layer is.

The Buyer Is Buying a System, Not a Sensor

When the object of the purchase is the integration layer, the comparison at bid stage changes. A buyer is no longer asking which sensor sees furthest. The buyer is asking which supplier can absorb hardware it did not manufacture, carry it into one picture, and keep that picture accurate as the estate grows. A specialist with one excellent sensor can lose to a generalist with an adequate sensor and a strong interface, because the interface is now the part the customer cannot build alone.

This is also why the integration layer has to be read as two separate jobs. One job is aggregation: taking feeds from many device families, normalizing them, and presenting a single view. The other job is interpretation: working out what a given contact actually is. A platform that aggregates without interpreting floods the operator with undifferentiated tracks. A platform that interprets without aggregating gives a good answer about one sensor and nothing about the rest of the estate.

The seam between vendors is where most real programs fail. Two sensors that each perform well in isolation can behave badly together if their clocks are not aligned, if their coordinate frames are not reconciled, or if their alert logic is not harmonized. That seam is invisible on a datasheet and obvious in operation, and it is the reason buyers now weight integration experience above raw specifications. The supplier who has already solved the seam problem is worth more than the supplier who has the best single number.

Why Long-Term Service Moved Into the Contract

The financial structure of the EOS award is the clearest evidence of how the market has changed. Roughly 80 percent of the revenue is expected to be recognized 12 to 24 months after the contract becomes unconditional, and around 20 percent is tied to four years of support services. A fifth of the contract is a commitment to keep the system working, not to build it. Buyers are now writing sustainment into the original award instead of treating it as a later problem.

That has consequences on both sides of the table. For the buyer, it converts a capital purchase into a capability that has to be maintained, trained on, and updated as the threat changes. For the supplier, it moves the revenue from a single delivery event to a multi-year obligation, and it makes the quality of local support a bid criterion rather than a courtesy. A supplier who cannot staff a support function in the customer’s region is now exposed before the award, not after it.

The same logic runs through the arrangement at EOS in the other direction. A contract that is conditional on bank guarantees, advance payments and export licenses is a contract in which the commercial and regulatory work is as heavy as the engineering work. Winning the technical evaluation is a milestone, not the finish. Programs at this scale are won by suppliers who treat licensing, financing and support as part of the product.

Where Open C2 Decides the Bid

If the purchase is a layer above the sensors, then the openness of that layer decides who is allowed to compete. The Intelic approach is the clearest illustration: the Nexus software does not ask the customer to replace existing radars and cameras; it connects them, and the value it claims lies in shortening the path from detection to a decision. A closed platform can also do this, but only for its own hardware, which is a shrinking share of most national estates.

This is the design logic behind our CCS command platform and the CRPCS protocol layer. CCS is built to accept feeds from many device families and present one operational picture across sites and regions, so a customer can add or replace hardware without rebuilding the command layer. CRPCS sits closer to the signal itself and reads the drone’s own control and telemetry link, which allows the same platform that aggregates sensors to also classify what is flying, including machines that are not announcing an identity at all.

The two functions answer two different questions on the same screen. Aggregation answers where the contact is and which sensor saw it. Protocol-level reading answers what it is and how it is being flown. A program that buys only the first gets a map. A program that buys both gets a classification layer, and the classification layer is what lets an operator decide rather than merely react.

Evidence Is Becoming Part of the Product

The NATO DIANA structure points at the second half of the same shift. Instead of a long specification followed by a large order, the program runs short contracts, then live trials, then a documented result, and only then national procurement decisions. The trial is not a formality at the end of the process. The trial is the process. What gets purchased afterwards is the evidence as much as the hardware.

For a supplier, this raises the bar in a specific way. It is no longer enough to publish a detection range in a brochure. The claim has to be reproducible, in a named environment, against a named target, with the conditions written down. A vendor whose numbers only hold in a clean setting will be found out during the trial, and the trial result follows that company into every subsequent bid it enters.

The shift also rewards a particular kind of documentation. A trial that produces a raw log is worth less than a trial that produces a log an evaluator can read: what was detected, at what distance, in what conditions, from which sensor, at what time. Evidence in that form is reusable across programs, which is why suppliers who invest early in recording and reporting end up with an advantage that compounds. It is also the same evidence that a support contract needs in order to improve the system after delivery.

What This Means for Buyers and Builders

For a buyer, the practical checklist has changed shape. Start with the interface, because a command layer that cannot absorb third-party sensors will lock the estate into one supplier for a decade. Insist on a protocol-level identification capability alongside aggregation, because a map that cannot say what is flying is not a decision tool. And write sustainment into the award, because the system that is hardest to support is the one that quietly stops being updated.

For a builder, the lesson is about where to invest. A sensor that is excellent in isolation but invisible to a command layer is a component, and components are compared on price. A sensor that arrives with a documented interface, reproducible test data, and a support plan is a system element, and system elements are compared on the strength of the whole. The October awards went to suppliers who understood that the customer was buying the whole.

Counter-drone procurement at the top of the market has stopped being a device purchase. The EOS award, the NATO DIANA route and the Intelic contract all buy a layer above the sensors; they all assume a mixed estate assembled from several vendors, and they all stretch into years of support. That combination changes what a serious supplier has to offer: not the longest range on a datasheet, but an open command layer, protocol-level identification, evidence that survives a trial, and a support organization that outlasts the delivery. For LZ TECH, the three October awards describe the market our line was built for: an open command layer, protocol-level identification, and hardware that behaves as a system element rather than a standalone box.

None of this is a surprise to anyone who has followed public purchasing over the past two years. October simply made it explicit in three separate contracts at once. Buyers who act on it will build estates that can absorb new sensors as the threat changes. Builders who act on it will stop selling devices into a market that has already moved on.

For most of the decade, the conversation about drone threats at borders focused on hostile or state-sponsored use. Intelligence aircraft crossing contested lines, drones supporting irregular forces, state actors probing air defenses. That conversation is still necessary. But it is no longer sufficient, because a quieter and more persistent threat has been building along the borders that most of the world shares with its neighbors: criminal networks using cheap commercial drones for reconnaissance, smuggling, and coordination.

In September 2026, a joint operation between Mexico and the United States put some of the details on the record. Operation High Eagle ran from August through mid-September, covering fixed and mobile counter-drone deployment along the Tijuana-San Diego corridor. Public reporting and official statements described criminal groups using drones for border-area reconnaissance, to monitor patrol movements and find gaps in the enforcement posture, and for smuggling, to move contraband across the line in ways that ground patrols cannot easily intercept. The scale, the operational patience, and the repeatability of the method are what make it significant.

What the September Operations Found

Operation High Eagle ran in two phases. The first, in early September, was a joint reconnaissance operation, confirming the presence and patterns of drone activity along the corridor. The second phase deployed fixed and mobile counter-drone equipment and ran from mid-September, assessing the effectiveness of different detection approaches in the specific radio environment of the border zone.

What the operation confirmed was not a new type of drone but a new use of an old one. The criminal networks were not flying anything technically sophisticated. They were flying commercial and custom-built FPV aircraft, the same airframes available to hobbyists worldwide, for purposes that are specifically criminal: knowing where the patrols are and moving contraband across the line. The drone itself is mundane. The application is what makes it a border security problem.

A separate incident, also reported in September, illustrated the pattern elsewhere. In Lithuania, authorities intercepted a drone carrying cigarettes across the border, marking the fifty-fifth such incident of the year along that particular frontier. The repeatability of the method is the signal. A criminal network that has found a reliable way to move product is not going to stop. It is going to keep doing it until something makes it harder.

Why Borders Are a Different Problem

Border enforcement is different from site protection in ways that shape the detection approach. A border is not a facility. It is a line, hundreds or thousands of kilometers long, that crosses every kind of terrain and passes through every kind of radio environment. A sensor that works at a fixed perimeter does not automatically work at a border, where the threat approaches from any direction, at any altitude, and the enforcement window is narrow.

The first requirement is range. A border patrol needs to know a drone is coming before it is already across, because once contraband has crossed, the interception is a law enforcement problem rather than a prevention. The DF Series of passive direction-finding sensors covers 30 MHz to 6 GHz and detects a drone at up to eight kilometers with three degrees RMS accuracy. Eight kilometers of warning along a border is the difference between a patrol that can reposition and a patrol that arrives after the fact.

The second requirement is a low false-alarm rate in a noisy environment. A border zone has commercial radio traffic, vehicle emissions, and legitimate small aircraft. A detection layer that generates alerts for every radio contact is a detection layer that loses the trust of the operators who have to act on it. The passive approach matters here: by listening without transmitting, the sensors do not add to the electromagnetic environment they are trying to read, and they can be tuned for the specific signal profile of the threat rather than for a general alert.

Network Architecture for a Border

A single sensor on a border line is not a border solution. It is a sensor on a line, which means it knows something crossed but not where along the line or in which direction. The border problem requires a network, and the network requires two things the DF Series is built to provide: accurate bearings from multiple nodes, and a positioning solution from time-difference-of-arrival.

The D5-B is a passive TDOA node that turns timing differences across a small network into a coordinate, covering 30 MHz to 6 GHz, out to three kilometers, and placing a drone to better than ten meters. Placed along a border corridor at intervals that match its coverage, a set of D5-B nodes gives the operator not a bearing but a position, which is what a border patrol needs to deploy to the right place at the right time.

The shared picture is what turns a sensor network into a border system. The CCS command platform fuses the detection and positioning feeds from every node into a single display, so that a central operations center and the patrol units in the field all see the same contact, the same position, and the same track. In a border operation, where the response has to be coordinated across agencies and jurisdictions, that shared picture is the difference between a contact that becomes an interception and a contact that becomes a report.

The Criminal Use Pattern and What It Demands

The criminal use of drones at borders has specific characteristics that distinguish it from hostile state use. The aircraft are cheap, replaceable, and flown with no concern for recovery. The routes are repetitive, because criminal networks find what works and repeat it. The operators are not in the air; they are on the ground at the launch point, which means they are usually stationary and often identifiable by the same bearing convergence that locates the drone.

This pattern creates a specific opportunity. A drone used for border reconnaissance is flying a known route, at a known altitude, over known terrain. It is not evading detection; it is optimizing for its primary mission, which is watching the patrol. A detection system that understands this pattern can do more than flag a contact. It can recognize the profile of a reconnaissance drone and alert on it specifically, which is what allows the system to separate the criminal use from the general noise of the border environment.

A network of D5-B TDOA nodes provides a position that changes over time, which means it can track the drone not just where it is but where it is going. When the drone turns for home, the track points at the launch site. That turns a drone detection into a lead, and a lead into a potential interception of the operator. In border enforcement, where the objective is not just to stop a single flight but to disrupt the network behind it, that is a meaningful advantage.

There is a specific opportunity in the criminal use pattern that deserves emphasis. A reconnaissance drone is not a threat that disappears when it is detected. It is an aircraft that has to return to a launch point, and the launch point is where the operator is. That means the detection of the drone is also, in effect, the detection of the operator, if the system can follow the drone back to where it took off.

Positioning for the Criminal, Not Just the Drone

That is the environment the detection layer has to work in, and it is the reason the approach matters as much as the hardware. A passive sensor that listens without transmitting can be tuned for the specific signal profile of the drone without adding to the noise it is trying to read. A network of such sensors, feeding a shared picture, gives the operator a position rather than a bearing, which is what allows a patrol to deploy to the right place before the drone has completed its mission.

The September operations along the corridor confirmed that the drone threat is not a hypothetical future. It is a present, repeating pattern. Criminal networks fly reconnaissance drones to watch patrol movements, and they fly smuggling drones to move contraband across the line. The two uses are distinct in purpose but identical in the detection problem they present: a small, cheap, commercial airframe flying a known route, in an environment full of noise, where the enforcement window is measured in minutes.

The Tijuana-San Diego corridor is one of the most heavily trafficked border sectors in the world, and it is precisely the kind of environment where the drone threat is most persistent. The terrain mixes urban sprawl, industrial zones, and open desert, all within a short distance. The radio environment is dense with commercial traffic. And the cross-border activity is continuous, which means a detection system has to separate a genuine drone contact from a constant background of legitimate signals.

The Tijuana-San Diego Corridor in Detail

The Bottom Line

The September operations along the US-Mexico border and the repeat incidents in Lithuania are part of the same story. Criminal networks have adopted commercial drone technology for the same reason everyone else has: it works, it is cheap, and it is available. The difference is that their use is criminal rather than state-driven, which means the response is law enforcement rather than defense.

For a border security force, the detection problem is the same as it is for a site defender, with the added constraint that the line is long, the terrain is varied, and the response has to be coordinated across multiple agencies. The solution is a passive, low-power sensor network that can be deployed along the corridor, that feeds a shared picture to every operator who needs it, and that gives a position rather than a bearing. That is what the DF Series and D5-B are built to provide, and it is the architecture that the September operations were testing along the Tijuana corridor.

September 2026 was a month in which the counter-drone market showed its hand. A pipeline in Saudi Arabia was hit at three pump stations. An air-traffic radar in Colombia was struck. Brussels Airport paused its runways for thirty minutes over a drone sighting. And a cluster of product announcements — passive radar, 4D imaging radar, containerized systems, sovereign command platforms — arrived within days of each other. Read together, the month is less a set of separate events than a single argument about where the field is going.

The pattern that emerges has three clear threads. The drone threat is moving down the value chain of targets, from headquarters to the scattered nodes that keep systems running. The detection layer is turning passive and multi-sensor, as the threat learns to go silent. And the market is reorganizing around open, fast, interoperable systems rather than closed single-vendor stacks. Each thread has practical consequences for anyone buying or building counter-drone capability.

Thread One: The Threat Moves to the Nodes

The most consequential events of the month were not the biggest targets but the most dispersed ones. The attack on three pump stations along Saudi Arabia’s east-west pipeline paused a line that normally carries four to five million barrels a day, a system whose value is in its length, not its headquarters. The strike on a civil aviation 3D radar site in Colombia hit a facility placed in a rural area specifically because it needed a clear signal. Both were nodes, and their loss rippled far beyond the site itself.

The implication is that infrastructure defense has to change shape. The old model protects the core facility, the refinery, the terminal, the control center, and accepts that the periphery is thin. September showed the periphery is the target. The defense of a pipeline, a radar network, or a grid now means covering the pump stations, the radar hills, and the substations, the places that are remote, off-grid, and lightly staffed. That is a different engineering problem, and it favors passive, low-power detection that can sit alone and report back.

Thread Two: Detection Goes Passive and Fused

The second thread is in the technology itself. Patria signed a deal to deliver its MUSCL passive radar system to a European customer. Arbe launched a low-power 4D imaging radar aimed at FPV and fiber-optic drones. Both are responses to the same pressure: the drone threat is learning to stop transmitting, and radio-frequency detection alone cannot follow it.

A fiber-optic drone carries its control signal down a cable instead of a radio link. An autonomous drone flies a pre-programmed route with no link at all. Neither emits the signal that pure RF detection depends on. The answer, now visibly mainstream, is to pair passive RF with passive radar that reads the environment and optical confirmation that sees the aircraft. Fusion is the word that ties it together, and September made clear it is no longer a differentiator. It is the baseline.

Thread Three: Open Systems and Fast Deployment

The third thread is about how the market buys. Leonardo showed a containerized Falcon Shield with an open architecture that accepts third-party sensors. Thales launched a sovereign, multi-domain command platform. DroneShield delivered a vehicle-mounted system from contract to initial capability in about 80 days. The common message is openness and speed: systems built to accept other vendors’ sensors, and vendors able to stand up a working capability in a single quarter.

This is a consequential shift for smaller and mid-sized vendors. A closed system that only works with its own sensors is positioning itself against the direction of the market. An open system, with defined interfaces and a command layer that accepts third-party feeds, is positioning itself with it. The LZ TECH line is built around this: the DF Series and D5-B passive sensors, the VM vehicle platform, and the CCS command platform are designed as products that fit together and plug into a larger stack, not as a walled garden.

The Recovery Metric

One event in September deserves attention for what it says about how the market is measured. Brussels Airport paused runway traffic for roughly thirty minutes after a drone sighting and then reopened, with no confirmed model or operator. The episode was, in a sense, a success: a sighting, a measured pause, a return to normal, all within an hour. But it also pointed to the metric that airports actually care about, which is not detection range but recovery time.

The cost of a drone event at an airport is not the drone. It is the minutes the runway stays closed. A defense that finds the drone early, confirms it is gone, and shares that confirmation across the tower, the police, and the security team is worth more than a more powerful countermeasure, because it is the one that shortens the pause. September put that metric in the open, and it is one buyers are increasingly willing to name.

These are not three separate goals. They are the same system seen from three angles. A passive sensor that plugs into an open command platform and can be delivered quickly is the exact thing the market spent September describing. The vendors who already build this way found the month validating. The ones who do not found it a warning. The quarter ahead will begin to separate the two.

Stepping back, the three threads of September collapse into a single recommendation. Build passive, because the threat is learning to go silent and a passive sensor adds nothing to the environment it watches. Build open, because the market is consolidating around interoperable systems and a closed stack is positioning itself against the current. Build fast, because the customer now expects capability in weeks, not years.

The Case for Passive, Open, and Fast

This is a thread that runs through the whole month. The threat has moved to dispersed infrastructure, where defense is hard because the sites are remote. It also moved into and around populated areas, where defense is hard because the consequences are immediate. Both directions point to the same need: detection that is early and precise enough to buy time, and a response that is controlled enough to protect people. The systems that answer the remote-site problem and the crowded-sky problem are, in the end, built on the same foundation.

One more September event belongs in the picture, because it exposed a challenge that has been understated. In Saudi Arabia, a drone was intercepted near a restricted area, and the falling debris harmed civilians. It was a reminder that the hardest place to defend is not the remote site or the empty border. It is the crowded sky, where stopping the drone is only the first half of the problem and controlling what happens next is the harder half.

The Crowded-Sky Problem Arrives

What to Watch in Q4

The last quarter of 2026 will test whether the threads visible in September tighten into a clear direction. Three things are worth watching. First, whether the shift to passive, fused detection continues to show up in procurement, rather than only in product announcements. Second, whether open command platforms start to win deals on interoperability rather than raw sensor specs. And third, whether the fast-deployment timeline, measured in weeks rather than years, becomes the standard customers expect across the board.

For LZ TECH, the month reinforced the direction of the product line. Passive detection, precise positioning, optical confirmation, mobile deployment, and an open command layer are not separate offerings. They are the components of the same answer, and September suggested the market is arriving at that answer from its own direction. The work of Q4 is to keep building the components so they fit the market that is now clearly taking shape.

That signal is useful precisely because it can be acted on. A buyer who reads it will prioritize passive detection, multi-sensor fusion, open interfaces, and short delivery timelines. A builder who reads it will make sure those are the properties of what they ship. The month did not introduce anything fundamentally new. It made the direction of the market explicit, and in a field that moves as fast as this one, an explicit direction is worth acting on before the next month makes it obvious to everyone else.

A month of news is easy to read as a list and harder to read as a signal. The list for September is long: pipeline strikes, a radar-site strike, an airport closure, a civilian casualty from falling debris, and a string of product announcements from passive radar to sovereign command platforms. The signal is shorter and clearer. The threat is dispersing and going silent, and the defense is answering with passive, fused, open, and fast systems.

Reading the Month as a Signal

The Bottom Line

September 2026 will be remembered less for any single event than for the pattern its events formed. The threat reached the nodes that keep infrastructure running. The detection layer turned passive and fused in response. And the market began to organize around systems that are open, interoperable, and fast to deploy.

None of this is a surprise to anyone watching the field closely. But September was the month the pattern became too clear to ignore. For buyers, the takeaway is to build for the threat that is coming, silent, dispersed, and fast. For builders, it is to make systems that fit that threat. The quarter ahead will show who was paying attention.