October 2026 in Review: Demand Moved Downstream, Value Moved Into Evidence | LZ TECH

October 2026 will not be remembered for a product launch. It will be remembered as the month in which three structural shifts stopped being predictions and started appearing in tender documents, court dockets, aviation notices and airport closure reports.

The first is that the buyer moved downstream. The second is that the value moved out of the box and into the evidence. The third is that compliance moved from the end of the project to the front of it. Each of those has a cost attached, and each of them favours a particular kind of supplier.

The Month in One Paragraph

Four weeks, read as a single document: a state government opened a procurement for drone detection across its prison estate and named radio frequency detection and radar as priorities; Thailand’s civil aviation authority suspended general drone permits over a Bangkok zone to support a police counter-drone centre during the International Monetary Fund and World Bank meetings; an airport outside Medellin stopped operations for about seventeen minutes because of a suspected drone; an airport in Lithuania closed for a period after an aircraft crossed the border from Poland and came down near a northern town; a drone struck Dammam airport in Saudi Arabia, killing two people and injuring eight, while a nearby energy facility was also affected; France set out a legal route for approved infrastructure operators and their contractors to act against drones near designated sites; and reporting based on ACLED data put about 670 recorded political violence incidents involving consumer drones in Latin America since 2018, with more than 72 per cent of them between January 2025 and August 2026.

That is not a list of unrelated events. It is a description of who now owns the problem.

Line One: The Buyer Moved Downstream

For fifteen years the counter-drone market was organised around a single customer type: a programme office with a specification, a multi-year budget and a site that had already been surveyed. The 2026 buyer is more likely to be a prison service, an airport operator, a port authority, an energy company or a municipal police force, and that buyer arrives with three things the programme office never had to think about: a fixed date, a legal review and a staff roster.

The consequences are practical. A prison service cannot staff a dedicated console on a night shift, so unattended operation stops being a feature and becomes a condition of purchase. An airport operator cannot accept a system that adds a second screen to a tower that already has four, so integration into an existing picture outranks raw detection range. A city police force cannot absorb a solution that needs a construction project, so the case, the tripod and the vehicle overtake the mast.

It also changes what “coverage” means. These buyers do not protect a border or a coastline. They protect a volume: the sky above a yard, a runway approach, a tank farm, a stadium roof. Coverage of a volume is a harder specification than coverage of a distance, and it will be the one that separates suppliers in 2027.

It explains why the energy and port sectors moved earlier than most forecasts expected. A terminal, a tank farm or a refinery is not one site. It is a dozen assets spread over kilometres, each with a fence, a shift pattern and a local manager. The people buying in those organisations are not asking for a better sensor at the main gate. They are asking how one picture can cover assets that no single mast can see, which is a networking question before it is a detection question.

Line Two: The Value Moved Into Evidence

The second shift was visible in the software releases rather than the hardware catalogues. In mid-October, DroneShield shipped a quarterly software update that reported improved classification of fixed wing aircraft, better thermal classification, unknown signal flagging and multi-node coordination, with a command product to follow. In early October, a Danish supplier introduced a wearable radio frequency detector under a kilogram that runs classification on the device and shares what it hears with other nodes.

Neither of those is a new sensor. Both are attempts to sell a better answer, and both point at the same commercial fact: the hardware is increasingly a platform for software, and the recurring revenue sits in the layer above the antenna.

For a buyer, this is good news with a trap inside it. Good, because a detection network that improves after installation is worth more in year three than in year one. A trap, because a software subscription is only worth renewing if the supplier can name what the site can do this year that it could not do last year. If the answer is a version number, the renewal is a tax.

The evidence question runs through this as well. A track that is recorded, timestamped, classified and exportable is what converts an alert into a patrol dispatch, a prosecution file, an insurance claim or an incident report. Sites are starting to buy that outcome rather than the alert, and they are writing the requirement into tenders in language that a marketing department cannot answer: how long is the record kept, who can access it, and in what format does it leave the system.

There is a second cost behind that one which almost never appears in a budget, and it is the labour to review what was recorded. A record nobody reads is storage. A record that can be filtered by zone, by hour and by classification is an operational tool, and the difference between the two is decided when the requirement is written, not when the subscription comes up for renewal.

Line Three: Compliance Moved Into the Critical Path

The third shift is the least glamorous and the most consequential. In the same month, France set out a legal route that turns operating a counter-drone capability near critical infrastructure into a licensed activity rather than an internal policy, and an airport closure in the Baltics reminded every aviation authority in Europe that unidentified aircraft near approach paths are a live problem rather than a theoretical one.

Put those together with the ordinary machinery of a large organisation, a procurement rule, an insurance review and a data protection assessment, and the shape of a 2027 project becomes visible. A site needs an operator authorisation, a safety review if it transmits, a retention policy for what it records, and a record to justify what it did. Four documents, four reviewers, and a schedule that has to absorb all of them.

Suppliers who treat this as an administrative tail will keep losing weeks they cannot invoice. Suppliers who treat it as a design input, with an operator guide, a training record and an exportable event log prepared before the first quotation, will be the ones whose equipment is still in service three years later.

What Did Not Change

Three things stayed exactly where they were, and it is worth stating them because a month of news can create the impression that physics has moved.

A bearing is still a line rather than a point. One sensor gives a direction; a position needs more than one, or a different sensing mode, or both. Any supplier who answers a positioning question with a direction finding specification is answering a different question.

A false alarm still costs labour. The price of a false alarm is not the alarm, it is the twenty minutes of a person who was doing something else. At a site with a real operational job, that cost compounds until the operator stops responding, which is the worst possible failure because it is silent.

Night still reduces optical range. Thermal confirmation of a small aircraft at several kilometres is a different instrument from thermal confirmation at several hundred metres, and a tender that asks for the former while budgeting for the latter will be delivered a camera that disappoints everyone in February.

What Q4 Will Be Decided By

Four questions will sort the market before the year ends.

The first is whether pilots become estates. Almost every organisation that bought in 2026 bought for one site. The cost of the second, third and tenth site is decided by whether the first installation produced a template: a standard sensor package, a standard zone layout, a standard record format. A supplier whose second site is a new project has a services business disguised as a product business.

The second is whether the service line survives its first renewal. That happens in Q4 for a number of 2025 contracts, and the conversation will be short. Either the supplier can point at specific capability added during the year, or the customer keeps the hardware and drops the fee.

The third is whether aviation and telecommunications authorities settle their positions on transmitting devices near airports and populated areas. Until they do, a large share of the addressable market stays conditional, and buyers will keep choosing the receiving-only option because it is the one that can be approved this quarter.

The fourth is whether documentation keeps pace with deployment. An operator authorisation, a safety review and a retention policy each take weeks, and a site that starts them after the purchase order loses the season it bought for.

A Short Checklist for the Last Quarter

For an operator heading into Q4 with a budget to spend or a renewal to decide, five questions are worth asking before the money moves.

Does the system produce a position or a bearing, and which of the two does the site’s procedure actually need?

What is the measured false alarm rate at a comparable site, over a stated period, and who is accountable for it after commissioning?

What does the record contain, how long is it kept, who can export it, and in what format?

If the software subscription lapses, what stops working, and what keeps working?

What would the second site cost, in money and in weeks, given what was learned at the first?

The Bottom Line

October was the month the counter-drone market started looking like the rest of critical infrastructure security: regulated, documented, staffed by people with other jobs, and judged on what can be proved after an incident rather than what was promised before one.

At LZ TECH we read the month as confirmation of a design choice we made years ago. Detection that transmits nothing can be deployed while a legal review is still open. A platform that records everything can answer questions that a camera cannot. And a supplier that documents its systems properly is a supplier whose installation survives a change in the rules.

The sites that will be protected best in 2027 are not the ones that bought the longest range in 2026. They are the ones that bought a picture they could defend, and kept the file that proves it.