It no longer takes an army to threaten an airport, a seaport, a stadium or an energy installation. One person, a commercially available drone and an improvised payload may be enough.
By the time a small airborne object appears on radar, is picked up by a camera, assessed by police and the information reaches whoever has the authority to act, it may already have struck its target.
That is the new paradox — or, more accurately, the new security nightmare. The attacker operates a device costing a few hundred euros. The defender mobilises technology worth millions and may still be too late.
Off-the-shelf terror
Small, inexpensive drones have caught the global defense industry off guard. For decades, that industry was designed to detect large, fast-moving, high-value targets. The new intruder is small, slow and flies extremely low. It can disappear amid buildings, antennas and the electromagnetic clutter of a city.
It is not invisible. That is precisely what makes the problem so frustrating.
A radar may detect a track. A radio-frequency sensor may intercept its signal. A camera may record its movement. Yet those three pieces of information often arrive on three different screens, monitored by different people in different agencies.
Someone must establish that they are all looking at the same drone, determine whether it is authorised or hostile, identify who has jurisdiction and decide whether to jam it, force it to land or shoot it down.
And all of that has to happen not within hours, but within minutes.
“In the best-case scenario, you have five minutes — and everything has to happen within those five minutes,” retired Israeli Air Force Brigadier General Yaron Rosen tells Phileleftheros. A former pilot, former head of the Air Force’s Joint Operations Directorate and later head of the IDF’s cyber staff, Rosen is now executive chairman of the Israeli start-up Airwayz.
“Flying grenades”
The key phrase in Rosen’s description is stark: “We have lost control of low-altitude airspace.” He calls small drones “flying grenades”.
A person, he explains, who once had to approach a road, building or installation to plant an explosive device can now deliver that payload from tens of kilometers away. Fiber-optic guidance, increasing autonomy and cheap computing power are also reducing the effectiveness of electronic jamming. Rosen compares what is happening in the low-altitude sky today with the early days of cyberspace.
Attackers entered digital networks without regard for borders, passports or traditional defenses. Governments eventually realised that they had lost control over part of their sovereign space and had to build an entirely new defensive infrastructure.
The same thing, he argues, is now happening a few hundred meters above the ground. The weakness lies not only in the sensors or the weapons. It lies between them.
At many command centers, Rosen says, an operator may sit in front of five, seven or even ten separate systems. Each sees a different fragment of the threat and proposes a different response. The human operator must mentally fuse those data streams and reach a decision in time. “It is a mission impossible,” he says.
NATO’s $40 billion bet
That is precisely the gap NATO is now trying to close. Allies have committed to investing more than $40 billion in counter-drone capabilities over the next five years and to training five times as many operators by the end of 2027. At the same time, a common procurement framework is being developed for systems that have been tested and are compatible with NATO standards.
The challenge, however, is not simply to buy more radars, jammers and interceptors.
At the large-scale TIE26 exercise in the Netherlands, roughly 300 specialists, 40 companies, more than 60 systems and 40 applications were brought together. The central question was not merely whether each individual component worked, but whether it could communicate with everything else.
The market for this unified command layer remains remarkably small.
Only a handful of companies worldwide are developing platforms designed to connect the entire chain — from authorising a legitimate flight and detecting an unidentified drone to selecting the safest possible response.
Airwayz is one of them.
Among companies that have publicly demonstrated operational deployments, the Israeli start-up has established one of the more mature operational footprints, with its system already sold internationally.
But the company itself is not the real story. The real story is the problem it is trying to solve.
At TIE26, the company’s OVERWATCH platform operated as a higher-level command layer, linking systems from 13 countries and receiving an interoperability certification from the relevant NATO body. That does not mean NATO selected Airwayz as its sole solution, nor does it amount to a commercial award. It does, however, demonstrate that technologies never designed to work together can be connected. And that is the point.
The basic logic of the platform is simple, even if the underlying technology is not. Radar feeds, cameras, acoustic sensors, the electronic identities of authorised drones, restricted zones, and available response systems are brought together into a single operational picture. The system assesses risk, identifies suspicious changes in flight behaviour, and recommends possible courses of action. It does not pull the trigger. The human operator remains responsible for the final decision. But he or she no longer has to call five separate control rooms simply to understand what is happening.
Rotterdam to Miami FIFA 2026
The usefulness of this approach becomes even clearer away from the battlefield. At the Port of Rotterdam, authorised drone operators have been able since January 2024 to request flight space through Airwayz’s UTM system, in some cases as little as two minutes before take-off. According to Rosen, when the partnership began, four drone companies were operating at the port. Today there are more than 80.
They carry out inspections, maintenance and security missions, transport samples from ships and connect maritime operations with facilities ashore.
Perhaps the most striking point is not the number of drones, but the fact that all of this traffic is managed without a traditional control tower. When a helicopter needs to land, it receives priority and drone routes are automatically altered. If a drone leaves its authorised operating area, the system flags it. Rotterdam is no ordinary port. It is the largest port in Europe.
Rosen also calls it “the world’s largest port airport”.
The same logic was tested in an even more sensitive environment at the official FIFA World Cup Fan Festival at Bayfront Park in Miami. The area was subject to drone restrictions, and authorities had the power to detect, intercept and seize unauthorised devices.
There, the platform brought civil-aviation data, security sensors, police first-response drones and interception teams together on a single screen.
A police officer on the ground could see on a tablet where an unidentified drone had come from and which team was best positioned to respond.
At that point, the low-altitude sky stops being an exclusively military issue.
It becomes a question of how the state functions on a daily basis — and, inevitably, a question of democratic accountability.
Who decides that a drone is hostile?
Who has the authority to cut its signal or shoot it down over an urban area?
Who can access the data generated by legitimate flights?
And who is accountable if the system gets it wrong?
Yaron Rosen raises precisely that question and points to what he calls “supervised autonomy”. The machine performs the rapid synthesis. The human operator approves the critical action. Every step is digitally recorded.
That record is not a technical footnote. It is what later establishes who saw what, who made the decision, and why a particular countermeasure was used.
The real product, therefore, is not another radar and not another weapon.
It is something closer to an operating system for the low-altitude sky — a shared environment in which legitimate flights continue, suspicious ones are distinguished from them, and authorities can respond before those five minutes run out. And sometimes, there are not even five.
Forty billion dollars can buy a great deal of hardware. But control of this new airspace will ultimately depend on the architecture capable of turning that hardware into a coherent defense.
Until then, the drone anyone can buy in a shop or order online will remain one of the defining asymmetric threats of the new security environment.
And any technology capable of narrowing that gap may prove disproportionately valuable.
Cyprus: Added layers of risk
For countries such as Cyprus, where ports, airports, cities, military installations and energy infrastructure sit within very short distances of one another, the questions raised by this uncomfortable gap in billion-dollar security investments are anything but theoretical.
In the same compressed airspace, one may find a helicopter, a police drone, a lawful commercial flight, an unauthorised aircraft and a “flying grenade”.
But Cyprus also faces another dimension: the island’s continuing division.
This is not merely an additional operational complication. The balance is deliberately disrupted.
The Nicosia Flight Information Region covers the entire island and a large part of the Eastern Mediterranean, with internationally recognized air-traffic-control responsibility resting with the Republic of Cyprus.
At the same time, the unrecognised airport at Tymbou and the self-styled “Ercan” control centre operate outside the framework recognised by the International Civil Aviation Organisation and issue instructions that are not routinely coordinated with the Nicosia Area Control Center.
For years, this has created confusion and flight safety risks.
Last August, the Flight Safety Foundation Southeast Europe–Cyprus warned of repeated, uncoordinated incursions by Turkish military aircraft and drones into the Nicosia FIR, including activity near the approach routes to Larnaca and Paphos airports.
The problem is neither new nor merely a political dispute over jurisdiction.
IATA itself has identified risks in the northern section of the Nicosia FIR arising from conflicting air-traffic-control instructions, uncoordinated handovers between control sectors, and unknown military activity occurring near civilian traffic.
The Republic of Cyprus has also recorded repeated instances of aircraft entering from the Ankara FIR without the required prior coordination with Nicosia.
Amid this already complicated environment, the rapid expansion of smaller UAVs, both civilian and military, adds further complexity.
As a result, managing Cyprus’s low-altitude airspace is not simply a technological traffic-management question.
It is directly connected to aviation safety, sovereignty, and, in a crisis, the ability to distinguish within seconds among a legitimate flight, an unidentified track, and an actual threat.
Since 2019, Turkey has also used the airport at Lefkoniko or Geçitkale in the Turkish-occupied north as a base for military Bayraktar TB2 drones conducting surveillance missions over the Eastern Mediterranean. Cyprus therefore confronts a low-altitude airspace problem that extends well beyond private or hostile drones. It includes uncoordinated state and quasi-state military activity inside an already congested, politically divided and operationally complex air environment.
