Substation Security: How Autonomous Drones Close the Gap
On the night of December 3, 2022, someone opened fire on two Duke Energy substations in Moore County, North Carolina. Within minutes, about 45,000 customers lost power. It took roughly five days to restore it. One resident who relied on an oxygen machine died during the outage. More than three years later, the case is still unsolved.
Whoever did it didn't need sophisticated tools. They needed a rural substation, a rifle, and enough time to do damage before anyone noticed. That's the pattern utilities are now up against, and it's why substation security has moved from a compliance checkbox to a board-level concern. This article breaks down what that pattern looks like, where traditional defenses fall short, and how autonomous drone patrols give utilities a way to watch thousands of unstaffed sites without hiring thousands of guards.
The Attack Pattern Behind Today's Substation Security Threat
Moore County wasn't a one-off. Federal and press reporting since 2022 describes a steady string of physical attacks on power infrastructure:
Metcalf, California (2013): Gunmen fired on a transmission substation, damaging 17 transformers after cutting communications lines.
Pacific Northwest (November 2022): Multiple substations were physically attacked, causing outages and equipment damage.
Moore County, North Carolina (December 2022): Gunfire at two substations left roughly 45,000 customers in the dark.
Tacoma, Washington (December 25, 2022): Four distribution substations were attacked, cutting power to about 30,000 customers.
Baltimore (February 2023): Two people were arrested for allegedly plotting to attack five power substations.
The numbers back up what the headlines suggest. Axios, citing Department of Energy incident reports, reported 163 incidents of vandalism, physical attack or suspicious activity in 2022. That was nearly double the previous peak of 94 in 2020. NBC News reported nearly 600 such incidents from 2014 through 2022. These figures come from 2022 and 2023 reporting, so check current DOE data before quoting them as today's totals.
What ties these cases together? Three things show up again and again.
Remote, unstaffed sites. The U.S. has more than 55,000 substations, and most have no one on site. Rural locations mean few witnesses and long response times.
Predictable, light protection. Many targeted sites had chain-link fencing, limited camera coverage, or no cameras at all. The Moore County substations were classified as "low impact," which meant fewer security requirements.
High payoff for attackers. Large power transformers are expensive and slow to replace. A few well-placed shots can create outages that last days.
Why Traditional Substation Security Falls Short
Utilities haven't ignored the problem. Fences, lighting, cameras and alarms are standard. But each has limits when the threat is a determined person with a rifle.
Fixed cameras see what they point at. A camera covers a view, not a site. Attackers who know where cameras sit can pick a firing position outside the frame. Weather, tree growth and low light can make things worse.
Alarms tell you something happened, not what. A tripped sensor at 2 a.m. triggers a question: is that an animal, a technician, or a threat? Without eyes on the scene, someone has to drive out and find out.
Guard patrols don't scale. Posting a person at every substation isn't realistic, and a periodic drive-by leaves long gaps. Attackers can watch for those gaps.
Rules cover only part of the grid. NERC CIP-014 sets physical security requirements for the most critical transmission substations. In September 2026, FERC approved an updated version, CIP-014-4, which expands applicability, moves to a single 36-month assessment cycle, and requires identifying facilities within 1,500 feet of covered sites. It takes effect October 1, 2028. But distribution substations, like those hit in Moore County and Tacoma, fall under state regulators, and standards vary. As the Congressional Research Service noted, the distribution sites in those attacks lacked significant physical security.
The gap isn't effort. It's coverage. Most substations spend most of their lives unwatched.
How Autonomous Drone Patrols Strengthen Substation Security
An autonomous drone patrol changes the math. Instead of fixed views and periodic visits, you get a mobile set of eyes that flies the perimeter on a schedule and responds to alerts.
In a fully managed program like ours, the drone launches, flies and lands on an automated route. AI-assisted detection flags people, vehicles and unusual activity, and trained pilots supervise the operation. Here's what that means in practice.
Scheduled and varied patrols. Regular flights around the fence line and yard mean there's no predictable quiet window. CISA's own guidance on substation physical security recommends that personnel checks happen on a varied timetable. Automated patrols make that practical.
Visual verification of alarms. When a sensor trips, a drone can launch and show you what's there, without waiting for a truck to make the drive. That turns "something happened" into "here's what's happening," which changes how quickly and how confidently you respond.
A view from above. From the air, you see the whole site at once. Cut fencing, open gates, vehicles parked on access roads, and people near the perimeter are easy to spot. So are the hidden spots a fixed camera misses.
Pre-attack signals. Attackers sometimes scout first. Repeated vehicles near a site, tire tracks in unusual places, or disturbed fence lines can be early warnings. A patrol program builds a baseline of what normal looks like, so the unusual stands out.
Evidence and documentation. Recorded patrol footage gives utilities and law enforcement time-stamped records. In a case like Moore County, where investigators are still asking the public for tips, good footage can be the difference between a lead and a dead end.
Airspace awareness. CISA also lists unmanned aircraft as a threat to substations, because they can bypass traditional security to conduct surveillance or damage lines. Counter-drone detection, like our AirGuard service, adds monitoring for unauthorized aircraft over a site.
What the Operational Case Looks Like
Consider a utility with 200 distribution substations spread across several rural counties. Posting a guard at each one isn't an option. Fixed cameras help but have blind spots. A security operations center watching alarms can't tell a deer from a threat.
With a managed drone program, one operations team can cover many sites. Routine patrols document site conditions, alarm-triggered flights verify events, and pilots hand clean information to the utility or local law enforcement. The utility gets coverage that was previously out of reach, and it pays for a managed service rather than staffing and running an aviation program.
Scale matters here. LandSkyAI has completed more than 100,000 drone patrols and holds BVLOS (beyond visual line of sight) authorizations in the United States. That approval is what lets one pilot supervise multiple drones across sites without keeping each aircraft in direct sight. Without it, drone patrols at this scale simply aren't practical.
What Drones Can't Do
We'd rather be upfront about this. Autonomous drones aren't a cure-all for substation security.
They don't stop bullets. If you need to harden a site against ballistic attack, barriers, walls and ballistic shielding still matter. Drones detect and verify. They don't replace physical hardening.
They don't replace response. A drone can tell you someone is at the fence. Someone still has to respond. The value comes from faster, better-informed decisions, not from skipping the response step.
They don't solve compliance on their own. CIP-014 and state requirements have their own assessment and documentation rules. Drone data can support them, but it isn't a substitute.
Weather and airspace matter. Severe weather can pause flights, and some locations have airspace restrictions. Good programs plan for both and layer in other controls.
The strongest approach is layered: deter, detect, delay, assess, communicate and respond, as CISA's framework puts it. Drones are strongest at the detect, assess and communicate steps, which are exactly where remote sites are weakest.
Why LandSkyAI for Substation Security
Utilities don't need another piece of hardware to babysit. They need coverage that works. LandSkyAI runs fully managed autonomous drone and robotic security, so the aircraft, the automation, the pilots and the reporting are handled for you. We're hardware agnostic, which means we match the platform to your sites, not the other way around.
We focus on continuous, managed protection of private and critical property, with automated patrols and pilot oversight built in, rather than public safety response. For utilities, that means a way to extend eyes across a large, scattered footprint without building a new department.
Ready to Close the Gaps at Your Substations?
If you manage substations, whether transmission or distribution, we'd like to walk through your sites with you. We'll look at where your coverage is thin, where patrols and alarm verification would add the most value, and where they wouldn't. If drones aren't the right fit for part of your footprint, we'll tell you.
Did you find this article useful? Are you interested in seeing us in action?
MissionControl is LandSkyAI’s ongoing town hall style webinar where you can get to know who we are, what we do, and how we’ve built our autonomous security programs. We also conduct a fully live remote drone demo, every time!
Our next event is on Wednesday, October 28th, 2026
Thank you for reading SkyBlog! Found it interesting? Hit that link 🔗 button and send to a friend! If you have questions or want to explore how these solutions apply to your environment, contact the LandSkyAI team below to start a conversation. ✌️
