Defender Purple 2026.
Drone Cyber Operations & Counter-UAS Cyber Readiness
Most security teams have never faced a drone-related cyber threat. This 52-hour operational readiness programme changes that: live cyber range exercises, adversary simulation, firmware analysis, forensics and purple team operations, all in one edition.
52
Hands-on hours
6
Domains covered
100%
Remote delivery
7
Core takeaways
Six domains of drone cyber operations
Every domain is taught hands-on against live environments, from RF detection to SOC response.
01
Detection
RF passive detection, radar analysis, signal classification and automated detection pipelines.
02
Firmware analysis
DJI firmware extraction, modification detection, ArduPilot auditing and reverse engineering.
03
Forensics
Flight log reconstruction, evidence preservation and chain of custody done properly.
04
GCS & network security
MAVLink protection, 5G vulnerabilities and ground control station hardening.
05
Counter-UAS
Failsafe behaviours, the real effects of jamming and spoofing, and predicting drone responses.
06
SOC & incident response
Detection engineering, SIEM threat hunting and playbook development for drone-related incidents.
From fundamentals to full-scenario exercise
Phase 1 · Fundamentals & analysis
- Day 1
Programme onboarding, drone ecosystem overview and platform fundamentals.
- Day 2
Multi-modal detection techniques, including RF and signal analysis.
- Day 3
Firmware analysis, reverse engineering and flight log analysis.
Phase 2 · Purple team operations
- Day 4
APT campaign simulation on drone infrastructure and IT–OT attack chains.
- Day 5
Detection engineering, threat hunting and incident response practice.
- Day 6
Full scenario exercise with cyber-tactical gaming.
Skills your team takes back to the SOC
- Detect drone threats across RF, network and firmware attack surfaces
- Execute real-world threat hunting and forensic methodologies
- Respond faster with structured incident frameworks
- Deploy practical detection rules and monitoring capabilities
A Certificate of Completion is issued at the end of the programme. Built for professionals in SOC operations, incident response and wider security roles.
Prerequisites
- Basic networking knowledge (TCP/IP, DNS, routing)
- Familiarity with security tooling (SIEM, IDS/IPS, packet capture)
- Windows or Linux command-line experience is helpful
- No prior drone experience required
Key details
- Dates
- 22–29 June 2026
- Format
- Remote, 6 training days
- Confirmation
- Email with invoice within 24h
Meet your instructors
Four specialised instructors with more than a decade of combined red, blue and purple experience.
Purple instructor
Christos Grigoriadis
Has taught 600+ students, published 12 papers, and holds PhD research on machine learning for vulnerability assessment.
Blue instructor
Christos Lazaridis
GCFA-certified incident response specialist with Deloitte and banking-sector experience; NATO lecturer.
Blue instructor
Giuseppe I.
GIAC certified, OWASP co-author, credited with vulnerability discoveries at major vendors; eight years leading penetration testing.
Red instructor
John R.
Over a decade of adversary emulation in energy and critical infrastructure; holds a Master's in Computer Science.
Three ways to join the next edition
Standard rate
€6,000
Per participant
Early commitment
€5,400
First 20 registrations
Team rate
€5,400
5+ from the same organisation
Registration for this edition is closed. Get notified about the next one via LinkedIn.