On a single day in January 2026, Russian forces launched 549 unmanned aerial vehicles against Ukraine's Zaporizhzhia region. Congress just passed the most significant counter-drone legislation in American history. These two facts are directly connected—and if you're responsible for protecting anything that matters, you need to understand why.
The Numbers That Change Everything
Start with the data.
In the Zaporizhzhia attack, Russian forces deployed 549 UAVs across a single regional operation. Ukrainian air defenses achieved an 85% intercept rate—impressive by any peacetime standard. But 85% of 549 means 82 drones reached their targets. Eighty-two. In one day. In one region.
Scale that across the theater:
- 879 drones destroyed daily across Ukrainian defensive operations
- 33,000+ casualties per month attributed to drone-enabled strikes
- 40+ Shahed-series drones launched in routine overnight attacks
This isn't an anomaly. It's the baseline. Russian forces have achieved industrial-scale drone warfare—the ability to produce and deploy unmanned systems faster than defenders can neutralize them.
Ukraine's Ministry of Defense reports destroying over 26,000 Russian UAVs since the conflict escalated. That number grows by nearly 900 every 24 hours. The attacks continue.
Meanwhile, back home, we spent December 2024 arguing about mystery drones over New Jersey that the FBI later attributed to a combination of authorized commercial operations and misidentified aircraft. The contrast tells you everything about where we stand.
Congress Finally Moved—Here's What Changed
The good news: Washington woke up. The SAFER Skies Act, embedded in the FY 2026 National Defense Authorization Act, represents the most significant expansion of counter-drone authority in U.S. history. President Trump signed it into law on December 18, 2025.
Here's what matters:
State and Local Authority Expands. For the first time, state, local, tribal, and territorial law enforcement can be authorized—after federal training and certification—to detect, track, and mitigate drones posing credible threats to covered facilities and events. This includes critical infrastructure, correctional facilities, and venues hosting large-scale public gatherings.
$500 Million in Federal Funding. FEMA's new Counter-UAS Grant Program allocated $250 million in FY 2026 to the 11 states hosting FIFA World Cup 2026 matches, with another $250 million available in FY 2027 for all states and territories. California leads with $34.6 million; Texas and Washington, D.C. each exceed $28 million.
DoD Gets Reorganized. Section 912 establishes Joint Interagency Task Force 401, unifying the Pentagon's counter-small-UAS procurement, maintaining a strategic plan, and approving systems for Department use. Section 3111 extends similar authority to DOE for nuclear security sites.
New Penalties. The legislation creates enhanced felony penalties—up to five years—for serious violations involving national defense airspace, critical facilities, or using drones to facilitate other crimes.
Airport Mandates. The FAA must now coordinate with DHS and DOJ to deploy counter-UAS detection systems at large hub, medium hub, and three cargo mega hub airports.
This is real progress. But legislation doesn't stop drones. Capability does.
Why Traditional C-UAS Math Still Breaks
Many counter-drone systems deployed at civilian facilities were designed for a different threat. Sporadic incursions. Hobbyist operators. One or two platforms at a time. The early procurement assumptions—particularly for commercial C-UAS protecting airports, stadiums, and critical infrastructure—didn't anticipate saturation attacks.
That gap is now exposed.
The Cost Asymmetry Problem
A surface-to-air missile capable of engaging small UAVs costs $50,000 to $400,000 depending on the system. An FPV drone with fragmentation payload costs $300 to $500. A Shahed-136 loitering munition runs approximately $20,000.
When your adversary fields 20 drones for every interceptor you launch, you lose the exchange rate. You run out of missiles before they run out of drones.
The Magazine Depth Problem
Even if cost weren't a factor, capacity is. A typical short-range air defense battery carries finite ready rounds. Reload cycles take time. Logistics chains have limits.
When 549 drones arrive in 24 hours, you face brutal triage: Which targets do you protect? Which do you abandon? Many civilian C-UAS concepts of operation don't address that question—the threat model didn't require it.
The Intercept Rate Illusion
Ukraine's 85% intercept rate against massed Shahed attacks sounds impressive. In isolation, it is. But percentage metrics obscure operational reality.
Launch 40 Shaheds, intercept 34, six get through. Launch 400, sixty get through. The math scales linearly for the attacker. For the defender, each penetrating threat means casualties, infrastructure damage, or mission degradation.
An 85% solution against 50 drones is tactically adequate. Against 500, it's strategic failure.
What Ukraine's Operators Have Learned
Ukrainian forces have become the world's most experienced practitioners of high-intensity counter-drone operations. Their lessons—learned in blood and burning infrastructure—preview what industrial-scale drone defense actually requires.
Layered Defense Is Non-Negotiable
No single system handles the full threat spectrum. Ukrainian air defense integrates:
- Long-range SAMs (Patriot, NASAMS) for high-value target protection
- Short-range point defense (Gepard, mobile AA) for area coverage
- Electronic warfare for soft-kill disruption
- Mobile fire teams with small arms for terminal defense
- Passive measures: decoys, camouflage, hardening
Each layer addresses different threat profiles. FPV kamikazes require different responses than Shahed swarms. The layered approach accepts that no single capability solves the problem.
Prioritization Triage Is Inevitable
When threats exceed defensive capacity, you choose what lives and what dies. Ukrainian commanders prioritize:
- Command and control nodes
- Air defense assets themselves
- Ammunition and fuel storage
- Personnel concentrations
- Everything else
That "everything else" includes civilian infrastructure, logistics vehicles, and secondary positions. In saturation attacks, some targets get hit. Doctrine must account for that reality.
Static Positions Are Death Traps
Fixed defensive positions become targeting priorities. Russian drone operators identify C-UAS emplacements and either avoid them or destroy them with follow-on strikes.
Ukrainian forces responded with mobile, distributed architectures. Air defense assets relocate after engagements. EW systems operate from concealed positions with rapid displacement capability. The posture assumes the enemy is watching—because persistent ISR drones ensure they are.
Recent operations near Kupyansk show Ukrainian units now actively hunting Russian drone launch positions, destroying operators and infrastructure rather than just intercepting the drones. Counter-targeting has become as important as interception.
Electronic Warfare Scales Better Than Kinetics
Soft-kill approaches—jamming, spoofing, signal disruption—engage multiple threats simultaneously without magazine limitations. Ukrainian EW units have become critical force multipliers.
EW isn't complete. Autonomous drones with inertial guidance resist jamming. Frequency-hopping complicates disruption. But at scale, electronic warfare offers engagement capacity that kinetic interceptors cannot match.
What This Means for American Critical Infrastructure
The Zaporizhzhia scenario isn't confined to Ukrainian battlefields. The same industrial-scale drone capability Russia developed is within reach of multiple state and non-state actors. The commercial supply chain is global. The tactics are documented. The barrier to entry drops every year.
The Progress We've Made
Credit where it's due: the SAFER Skies Act and FEMA's $500 million grant program represent genuine progress. State and local law enforcement will finally have legal authority to act. The FIFA World Cup 2026 and America's 250th anniversary celebrations will have dedicated counter-drone resources.
FEMA calls this the fastest non-disaster grant program in agency history—awards issued 25 days after the application deadline. That's government moving at an unfamiliar speed.
The Gaps That Remain
But $250 million across 11 states doesn't buy industrial-scale defense. It buys detection systems and initial capability. That's a starting point, not an end state.
The FAA reports over 100 drone sightings near airports monthly. Most critical infrastructure facilities—power plants, refineries, water treatment facilities, data centers—have no C-UAS capability whatsoever. The new authorities help. The funding helps more. Neither solves the 549-drone problem.
The Target Set
Consider what an adversary sees:
-
Power grid: Substations, transformer yards, and transmission towers are large, fixed, minimally defended. Coordinated drone campaigns could trigger cascading failures across regional interconnects.
-
Petroleum infrastructure: Tank farms and refineries concentrate flammable materials. Small payloads can initiate fires that destroy capacity.
-
Transportation nodes: Ports, rail yards, and airports enable logistics chains. Disruption ripples through supply networks.
-
Water systems: Treatment plant chemical storage presents both disruption and contamination vectors.
None of these facilities currently maintain C-UAS defenses capable of handling mass attacks. Most have none at all.
What Actually Works at Scale
Defending against industrial-scale drone operations requires different approaches than point-defense against isolated threats. Based on Ukrainian operational experience and emerging doctrine:
EW-First Architecture
Electronic warfare should be the primary engagement layer, with kinetic systems reserved for threats penetrating soft-kill defenses. This inverts traditional air defense priorities but reflects economic and capacity realities.
EW systems engage multiple targets simultaneously, don't require expensive munitions, and operate continuously. They're not perfect—but they scale.
Sensor Fusion and Automated Cueing
Human operators cannot process targeting data for hundreds of simultaneous threats. Effective mass-attack defense requires:
- Multi-phenomenology detection (radar, EO/IR, RF, acoustic)
- Automated track correlation and threat classification
- AI-assisted prioritization and engagement cueing
- Human-on-the-loop rather than human-in-the-loop decisions
The system must present operators with recommendations, not raw data.
Defense in Depth
Single-layer perimeter defense fails against saturation attacks. Effective architectures create multiple engagement zones:
- Long-range detection and disruption (10+ km): Early warning, initial EW engagement
- Mid-range intercept (2-10 km): Primary kinetic engagement for high-value threats
- Close-in defense (under 2 km): Terminal protection for critical assets
- Point hardening: Physical protection for assets that cannot be actively defended
Each layer degrades the attack. No layer achieves complete interdiction.
Assume Penetration—Harden Accordingly
Perfect defense isn't achievable. Some drones reach their targets. Consequence management—hardening critical systems, building redundancy, pre-positioning recovery capabilities—must accompany active defense.
This is uncomfortable doctrine for organizations accustomed to promising protection. But it's honest doctrine, and honesty enables effective resource allocation.
The Preview, Not the Outlier
The 549-drone day in Zaporizhzhia wasn't a peak. It was a preview.
Russian forces continue expanding drone production. Iranian Shahed deliveries continue. Chinese commercial components remain available despite sanctions pressure. The trendline points toward higher volumes.
Congress moved. FEMA moved. The authorities exist. The initial funding is allocated. That's progress—real progress—after years of regulatory paralysis that left us debating mystery lights over New Jersey while Ukraine intercepted 900 drones daily.
But legislation doesn't stop drones. Capability does. Training does. Doctrine does.
For C-UAS planners, critical infrastructure operators, and security professionals, the question isn't whether mass drone attacks are possible. They're happening now, documented daily, with hard numbers attached.
The question is whether we'll build the capability before the threat arrives—or learn the lessons the hard way, like every other nation that assumed they had more time.
Ukraine's defenders didn't have that luxury. We still do.
Don't waste it.
Brian Rutherford is a USMC Reconnaissance veteran with combat deployments to Iraq, FAA-certified UAV pilot, and founder of Delalli Aviation LLC. His background includes 100+ protective missions as a State Department security professional and 830% revenue growth leading a government contracting firm. He writes about UAS/C-UAS threats from the operator perspective—where theory meets reality.
Sources
- DRONELIFE: NDAA FY 2026 Counter-UAS Provisions
- DRONELIFE: SAFER Skies Act Overview
- DHS: FEMA Awards $250 Million for FIFA World Cup Security
- FEMA: Counter-UAS Grant Program
- Crowell & Moring: FY 2026 NDAA Analysis
- FedScoop: FEMA Counter-Drone Funding Distribution
- House T&I Committee: Counter-UAS Reauthorization
- DroneXL: NDAA 2026 Local Police Authorities
- DroneShield: Airspace Risk 2026
- CNN: New Jersey Drone Sightings
- Reason: What the Feds Knew About the NJ Drone Scare
Stay Informed on Drone Threats
Weekly intelligence on C-UAS developments, regulatory changes, and security insights from a Part 107 pilot and defense veteran.
Join 500+ security professionals. Unsubscribe anytime.