Defender Purple 2026.
Drone Cyber Operations & Counter-UAS Cyber Readiness
Most security teams have never faced a drone-related cyber threat. This 52-hour operational readiness programme changes that: live cyber range exercises, adversary simulation, firmware analysis, forensics and purple team operations, all in one edition.
52
Hands-on hours
6
Domains covered
100%
Remote delivery
7
Core takeaways
Six domains of drone cyber operations
Every domain is taught hands-on against live environments, from RF detection to SOC response.
01
Detection
RF passive detection, radar analysis, signal classification and automated detection pipelines.
02
Firmware analysis
DJI firmware extraction, modification detection, ArduPilot auditing and reverse engineering.
03
Forensics
Flight log reconstruction, evidence preservation and chain of custody done properly.
04
GCS & network security
MAVLink protection, 5G vulnerabilities and ground control station hardening.
05
Counter-UAS
Failsafe behaviours, the real effects of jamming and spoofing, and predicting drone responses.
06
SOC & incident response
Detection engineering, SIEM threat hunting and playbook development for drone-related incidents.
From fundamentals to full-scenario exercise
Phase 1 · Fundamentals & analysis
- Day 1
Programme onboarding, drone ecosystem overview and platform fundamentals.
- Day 2
Multi-modal detection techniques, including RF and signal analysis.
- Day 3
Firmware analysis, reverse engineering and flight log analysis.
Phase 2 · Purple team operations
- Day 4
APT campaign simulation on drone infrastructure and IT–OT attack chains.
- Day 5
Detection engineering, threat hunting and incident response practice.
- Day 6
Full scenario exercise with cyber-tactical gaming.
Skills your team takes back to the SOC
- Detect drone threats across RF, network and firmware attack surfaces
- Execute real-world threat hunting and forensic methodologies
- Respond faster with structured incident frameworks
- Deploy practical detection rules and monitoring capabilities
Prerequisites
- Basic networking knowledge (TCP/IP, DNS, routing)
- Familiarity with security tooling (SIEM, IDS/IPS, packet capture)
- Windows or Linux command-line experience is helpful
- No prior drone experience required
Key details
- Dates
- 22–29 June 2026
- Format
- Remote, 6 days
- Audience
- SOC and incident response professionals
- Certificate
- Certificate of Participation
More special editions are on the way.
Defender Purple 2026 ran from 22 to 29 June. We're preparing new special editions on emerging threats, built the same way: live cyber range exercises, adversary simulation and purple team operations. Follow us on LinkedIn to hear about the next one first.