When an unknown drone appears above a port, a power station, or a public event, the instinctive response is often to treat it as a threat. That instinct is understandable, but it is also operationally problematic.

The reality is that most drones appearing in sensitive airspace are not there for malicious reasons. A recreational flyer unaware of the restricted zone, a commercial operator who misread the boundaries of his authorisation, or a hobbyist who simply did not check the rules before launching: these situations are far more common than deliberate intrusion. Treating all of them as criminal acts leads to disproportionate responses, strained relationships with aviation authorities, and a system that generates so many false alarms it loses operational credibility.

The European Commission's Joint Research Centre addresses this directly in its Handbook on UAS Protection of Critical Infrastructure and Public Space. It proposes a classification of four drone pilot types, each requiring a fundamentally different response. Understanding these types shapes every layer of an airspace security solution, from the sensors you deploy to the escalation procedures you define and the legal framework you operate within.

The four pilot types

Compliant. This pilot knows the rules and follows them. They have checked the airspace, registered their drone, and are operating within their authorisation. If they appear near your site, it is likely because they have permission to be there, or because the boundary of a geographical zone is unclear. The appropriate response is verification, not escalation.

Clueless. This pilot is unaware that they are doing anything wrong. They bought a drone, launched it, and had no idea there were restrictions in the area. They present a safety risk through ignorance rather than intent. The appropriate response involves detection and, where possible, communication or education. In some cases, coordination with aviation authorities to improve zone awareness in the area is more effective than any technical countermeasure.

Careless. This pilot knows the rules but chooses to ignore them. They may have seen the restriction warning in their app and dismissed it, or they may have decided that the risk of enforcement is low. They present a higher risk than the clueless pilot because the behaviour is deliberate, even if the intent is not malicious. The appropriate response involves detection, classification, and reporting to the competent authority.

Criminal or terrorist. This pilot has a specific hostile intent. They may be using a drone for surveillance, smuggling, disruption, or as a direct weapon. They are likely to use non-cooperative platforms, modified firmware, or encrypted control links specifically to avoid detection. The appropriate response requires pre-defined escalation procedures involving law enforcement and, in some jurisdictions, specific state authorities with legal authority to act.

Why the pilot type determines the response

The reason this classification matters is that each pilot type requires a different response chain. A one-size-fits-all approach either over-escalates routine incidents or under-responds to genuine threats. Both outcomes carry costs.

Over-escalation creates operational fatigue. If every recreational flyer triggers a full security response, teams become desensitised, procedures become harder to maintain, and the credibility of the system erodes. It also creates legal and reputational risk if responses are disproportionate.

Under-escalation leaves genuine threats unaddressed. If a criminal actor with hostile intent is treated as a clueless recreational flyer, the window for an effective response closes before it can be acted upon.

The classification also has direct implications for what your detection and classification systems need to do. Identifying that something is flying is only the first step. Understanding what type of operator is likely behind it, based on platform type, flight behaviour, signal characteristics, and context, is what enables a proportionate and timely response.

How pilot type shapes your solution architecture

Detection layer. For compliant and clueless pilots, correlation with drone traffic management data and Remote ID is often sufficient to classify the situation quickly. For careless and criminal actors, you need sensors capable of detecting non-cooperative platforms, including those without active control links or Remote ID signals.

Classification layer. Behaviour analysis matters here. A compliant pilot flies predictable, authorised routes. A careless pilot may approach a restricted boundary and then hover, testing the response. A criminal actor may fly low, fast, and without the patterns associated with recreational or commercial use. Combining radio frequency (RF) analysis, radar tracking, and optical confirmation gives operators the inputs needed to make a reasonable classification under time pressure.

Escalation procedures. Each pilot type should map to a defined escalation pathway. Compliant pilots require verification only. Clueless pilots may require notification to aviation authorities. Careless pilots require documentation and formal reporting. Criminal actors require immediate escalation to law enforcement, with pre-agreed communication protocols and, where applicable, activation of state counter-drone authorities.

Without these pathways defined in advance, operators are forced to make judgement calls under pressure, often with incomplete information and without clarity on what they are legally permitted to do.

How this plays out across sectors

Ports. Port environments attract all four pilot types simultaneously. Recreational flyers are drawn to the visual interest of large vessels and industrial infrastructure. Commercial operators conduct legitimate inspections of cranes, hulls, and loading equipment. And ports are high-value targets for smuggling operations using drones to move contraband across secure perimeters. A port security solution needs classification capability sophisticated enough to distinguish between these use cases in real time.

Energy infrastructure. Power stations, substations, and pipeline corridors frequently appear in restricted zone maps, but zone awareness among recreational flyers remains inconsistent. The clueless pilot is a common occurrence here. At the same time, intelligence-gathering overflights of critical energy assets represent a genuine security concern. The response to each is entirely different, and the system must be capable of telling them apart.

Public events. Large gatherings present a concentration of people, media attention, and symbolic value that can attract all four pilot types. Event organisers increasingly need to coordinate with aviation authorities, law enforcement, and drone operators to establish temporary restrictions, enforce them proportionately, and escalate credible threats without disrupting the event or panicking attendees.

Building a threat-informed solution

The practical implication of this framework is that threat analysis must come before technology selection. Before deciding which sensors to deploy, organisations need to understand which pilot types are most likely to appear in their specific context, what their motivations and capabilities are, and what response is both appropriate and legally permissible.

This is the approach set out in the JRC methodology, and it is one that directly informed how we built AirHub. Our platform integrates drone traffic management data, airspace information, and sensor inputs into a single operational picture, allowing operators to move from raw detection to informed classification quickly and trigger the right response for the right situation.

Knowing who is flying above your site is what makes a security response proportionate, defensible, and actually effective.

If you want to see how AirHub supports threat-informed airspace security, book a demo with one of our experts.