UAVs Over Facilities: Protecting People and Assets

Drone attacks are becoming part of our daily reality. Just a few years ago, a UAV striking an industrial site was an extraordinary occurrence. Today, it is a line item in the emergency source list alongside fire, depressurization, and product spill. News reports frequently feature attacks on various facilities across different regions: oil depots, port terminals, compressor stations, and more.

And we bear the responsibility for what happens on site during the first half hour. Not emergency services, not national guards, not corporate security. We are accountable for company assets: tank farms, loading racks, and equipment that takes months to restore. First and foremost, we are accountable for personnel: people who, at the moment of impact, are on open grounds, in control rooms, or at loading racks. No one will lift this responsibility from us, and no one will fulfill it for us.

In this article, I will not cover how to detect and shoot down drones. That is outside our scope. I will focus on what lies within our control: how to organize response so that personnel reach shelter, equipment is rendered safe, and damage remains localized. Everything written here has been tested during drills at an actual facility, and some of the conclusions were hard-won.

UAVs as a Source of Industrial Emergencies

The first key takeaway for ourselves and executive management: after a drone hits a facility, the accident unfolds according to the exact same physical laws as any other incident. Mechanical damage to a tank or pipeline, ignition, thermal impact on adjacent tanks, cascade risk. This is the chain we calculate in HAZOP and Bow-Tie analyses and for which the Emergency Response Plan (ERP) is written. The initiating event is different, but the physics remains the same.

A practical conclusion follows. We do not need to invent a new discipline. We simply need to integrate specific scenarios and procedures into our existing engineering setup: threat identification, risk assessment, preventive measures, response measures, training, and drills. Familiar work.

There is a second, even more critical conclusion. When emergency responders arrive, they will operate according to standard protocols. Which valve to isolate first, the wind direction relative to the hot zone, where forty contractor workers not registered in our Access Control System (ACS) are located—only our shift knows this. The vast majority of damage in major industrial accidents is preventable through actions taken in the first 10 to 30 minutes. This window belongs entirely to us.

Incident Timeline as a Planning Tool

When we began developing the protocol, the first thing we did was break a typical incident into phases: from the initial signal of monitoring systems to the localization of the incident site. For each phase, we defined the operating mode of the facility and the single vital action without which the subsequent phase becomes unmanageable. Specific checkpoints and response time benchmarks vary by facility: they depend on geography, drone specifications, and available monitoring systems. Therefore, rather than exact timing, I outline the mode logic here. It is universal and served as the foundation for all drill scenarios.

Here is what we discovered when testing this framework during drills.

Between the approach signal and visual contact lies an early warning window. It is measured in minutes, but those few minutes are sufficient to suspend hot work, evacuate personnel from open areas, and transition the facility into a state of heightened readiness—without halting production. In practice, monitoring system signals either fail to reach the dispatcher or arrive without actionable procedures, causing this window to be lost entirely.

The critical interval occurs in the first minutes following visual contact. Personnel are either sheltered or exposed. Access control turnstiles are either unlocked or crowds rush directly toward the blast radius. This is precisely where paper protocols collapse during initial drills. Until sheltering is executed routinely within the designated timeframe, everything else in the protocol is secondary.

Almost everyone underestimates the waiting period after the initial strike. A secondary strike is always possible. The rule of "remaining in shelters until situation assessment is confirmed" and deploying response teams strictly via secure corridors save responders' lives. Psychologically, personnel tend to exit to look around. Mastering this requires dedicated training and multiple iterations. Shelter hold duration is a parameter each facility sets independently and verifies with a stopwatch during drills.

Key Findings from Field Drills

We conducted several rounds of tabletop and field exercises across four scenarios: "Approach," "On-Site Impact," "Secondary Effects," and "Communications Failure"—plus nighttime minimum-shift variants for each. The initial walkthrough of a new protocol typically reveals 10 to 15 significant deficiencies. Several recur consistently across sites and warrant direct discussion:

No authority designated to mandate shelter. Standard protocols state that the decision rests with the plant director. At night, the director is off-site. The shift supervisor hesitates to suspend operations: what if it is a false alarm, causing water hammer or batch loss? While calls are placed, five minutes slip away. We established by formal order that the senior shift supervisor has absolute authority to order immediate sheltering and emergency shutdown without approval. The priority of human life over equipment must be documented prior to an incident. It cannot be debated during a crisis.

Responsibility matrix exists on paper, but remains unseen. Who isolates the boiler house if it belongs to a contractor but operates inside our perimeter? During the initial drill, no one had an answer. We developed RACI matrices with contractors during tabletop exercises for every routine action—sounding alarms, dispatching buses to assembly points, tallying headcount in shelters—enforced them by formal order, and posted laminated reference cards in every shelter. The matrix underwent four revisions before becoming fully operational.

Cellular mobile networks as a single point of failure. During mass notifications, cellular networks saturate instantly. Corporate messaging apps rely on active internet connectivity. We established a PACE plan for every critical communication line: IP telephony primary, mobile SMS secondary, private radio networks tertiary, landlines and couriers emergency fallback. We introduced unannounced "cold" testing by disabling the top two levels during drills.

Incident commanders overwhelmed by data streams. Sensor alerts, video feeds, post reports, phone calls—hundreds of events flood in during the first five minutes. An individual attempting to review logs while simultaneously making decisions fails at both. Stress tests clearly demonstrated this: message queues build up, crucial data gets lost, and situational awareness is only restored after events have progressed. This is discussed separately below.

Unaccounted personnel. Access control logs indicate 312 people on site, but shelter headcounts reveal only 280. Where are the remaining 32? Temporary contractor passes, delivery drivers, visitors. Without real-time cross-referencing between access control data and shelter check-ins, responders will search for individuals long departed while missing those actually trapped.

Where to Begin: Month One on a Minimal Budget

The encouraging news is that most protective efficacy stems from protocols and drills rather than hardware investments. We estimate that an initial baseline implementation mitigates 60% to 70% of critical vulnerabilities. Here is what that looks like in practice.

Week 1: Inventory. Map shelters with capacity ratings, entry layouts, and key management. Detail organizational structures of all onsite legal entities. Compile contractor dispatch contacts and vehicle/driver registries. Finalize the PACE plan. Tedious work, but it determines outcome during a crisis.

Week 2: Protocol formulation. Not a binder gathering dust, but a concise 10–15 page operational manual: roles, threat levels (Yellow, Red, Blue, Green), response workflows, and RACI matrices. AI tools can assist in drafting frameworks (as outlined in my article on simulator design), but site-specific tailoring must be done by personnel familiar with the facility.

Week 3: Tabletop exercise. Execute the "On-Site Impact" scenario on paper using timed tracking. Document defect logs.

Week 4: Field drill under minimum shift conditions. Run the same scenario at night, without management presence, with mobile communications disabled. Compile the second defect log. Refine procedures. Begin the next cycle.

Achieving a protocol that withstands four distinct scenarios without critical failures typically takes 3 to 6 iteration cycles. Each subsequent cycle becomes progressively shorter.

Note the hierarchy of maturity levels: the technology stack ranks third. We adopted a 40/40/20 rule: 40% effort allocated to protocols and drills, 40% to technical safeguards, and 20% to command center infrastructure. A trained shift team equipped with pocket reference cards will perform better than an untrained crew with an expensive dashboard.

When Technology Becomes Essential

Organizational measures hit an operational ceiling when incoming signal volumes exceed shift processing capacity. At a major transport and logistics hub employing hundreds of personnel per shift alongside dozens of contractors, this threshold is reached within minutes.

The baseline functional architecture we identified comprises six key modules:

• Personnel tracking: ACS integration, mobile app with a "sheltered" check-in button, and automated unaccounted tallying;
• Situational map: facility layout, status overlays, resource layers, and dynamic hazard zones (300m blast radius, wind-driven smoke plumes);
• Mass notification: unified multi-channel dispatch, pre-formatted templates, delivery tracking;
• Fleet dispatch: real-time bus location tracking and route monitoring;
• Event logging: automated chronological logging for post-incident review;
• Local Large Language Model (LLM): acting as an intelligent interface layer across all modules.

Regarding the final point, significant misconceptions surround AI deployment.

The Role of AI: Offloading, Not Replacing

I remain skeptical of digital oracles and have written on this topic before. Within an emergency response loop, AI serves a distinct purpose: not to assess threats or execute decisions, but to distill a thousand raw log entries per minute into three verified events requiring executive decision-making.

The right column deliberately omits "prioritizing human life over industrial operations." This is not a decision debated during an emergency by either AI or incident commanders. It is an established principle embedded in policy beforehand. Commanders determine when and how to shelter personnel and halt processes, not whether to do so.

We adhere strictly to three core principles:

Local deployment, never cloud-based. External network connectivity may fail during an incident. Furthermore, data streams contain sensitive operational details regarding personnel and assets that must never breach perimeter security.

Establish non-AI workflows first. Protocols must be perfected through drills before integrating AI assistance. If a system is built around AI from inception, model failure paralyzes response. If AI operates as an enhancement layer, model failure merely slows down throughput.

No autonomous facility control. The model cannot issue commands to emergency forces or automatically trigger evacuation orders. This restriction is enforced at the API level, not merely in administrative policy.

Stress test results following filtration integration: the same personnel operating under identical scenarios handled peak operational loads with confidence. Prior to integration, they failed.

Cost Analysis

The predictable first question. I frame costs around avoided loss, utilizing the same framework presented in our budgeting article.

For comparison: direct damage from a major fire at a mid-sized oil depot, including downtime, ranges from 800M to 2.5B RUB. Assuming a conservative incident probability of 8% per year, expected loss avoidance for an intermediate setup is roughly 50M RUB annually, yielding a ROI payback period of approximately six months. Under lower probability estimates, ROI extends to 2–3 years while remaining distinctly positive.

I advise securing budget approval starting with the baseline tier rather than the full program. It delivers the majority of protective gains, costs roughly as much as a single standard contractor agreement, and will demonstrate within two months of drills where advanced tech is required versus where pocket reference cards suffice.

Self-Assessment Checklist

• Who on the night shift possesses written authorization to order immediate shelter and emergency shutdown without prior approval?
• Does the dispatcher know the precise protocol when receiving a drone approach signal, or will they simply escalate upward?
• How many communication redundancy levels have actually been tested by disabling the primary two?
• How many people are logged on site by ACS right now, and how many can you confirm inside shelters within 10 minutes?
• Are contractors operating equipment within your perimeter included in your RACI matrix?
• When was the last unannounced drill held with a minimum night shift and no management present?
• How many metrics clutter the incident commander's main dashboard in crisis mode? Exceeding seven adds cognitive load rather than clarity.
• When was the protocol last updated? If over a quarter ago, contractors, equipment, and personnel have already changed.

Conclusion

UAV emergency preparedness is neither a passing trend nor redundant overreach. It is the direct fulfillment of statutory requirements for hazardous industrial facilities: being prepared to localize accidents, safeguard personnel, and minimize damages. Only the initiating threat source has evolved.

When an emergency unfolds on site, decisions rest on a specific individual armed with a facility map, trained personnel, functional communications, and clear judgment. Everything discussed above serves a single objective: empowering that individual to succeed. Because accountability ultimately lies with us.