The most concrete airspace-security dataset ever published for a civilian event came out of the World Cup. Writing in Forbes on August 21, retired Army colonel Bill Edwards reported FBI figures: nearly 1,600 drones detected around tournament venues, more than 700 aircraft seized, and — for defenders — a decision cycle of at most 90 seconds per incursion. His conclusion: the federal surge model that protected a 39-day tournament cannot scale to the thousands of corporate facilities that now face the same exposure every day.
The threat side of the ledger kept moving all summer. In early August, an explosive-carrying drone was found and defused at Germany's Leipzig/Halle airport — a cargo hub for Ukraine support — with U.S. intelligence officials telling the Wall Street Journal they believe Russia was behind it; two more drones were sighted over a German army base days later. Washington moved too: the Departments of Justice and Homeland Security issued interim rules on July 1 implementing the SAFER SKIES Act's counter-drone provisions, and a joint task force awarded CACI a three-year, $500 million contract for non-kinetic counter-UAS systems, per Breaking Defense.
A 90-second window from detection to decision eliminates the model where a guard notices something and starts making phone calls. It requires detection feeding directly into an operations picture that already knows the context — what is overhead, what it is near, whether this is the third pass this month — with a human authorized to act on a recommendation immediately.
- Airspace incidents are data, not anecdotes. Logged and correlated over time, drone activity around a facility reveals reconnaissance patterns that single sightings never show.
- The aerial layer belongs in the same picture as ground and cyber: a drone over the fence line, a probing scan, and an unusual visit request may be one adversary's one operation.
- Legal authority is arriving faster than corporate governance. The new rules expand who may act against drones and how — security leaders should be building policy now, not after their first incursion.
Edwards calls the destination three-dimensional security — physical, cyber, aerial — as routine governance. We would add the connective requirement: the three dimensions only produce early warning when their signals resolve to one entity picture, watched continuously, with people making the calls machines only tee up. The World Cup proved the threat volume is real. The 90-second clock says the fusion cannot be manual.