How government agencies and the operators of energy, water, transport and logistics sites can turn repeat drone flights into reviewed, provable records of what changed: on their own hardware, in their own country, and still working when the network is cut.
Power stations, substations, water works, rail yards, ports, pipelines and logistics hubs have to know what has changed on and around their sites (a new vehicle park beside the fence, a container stack that was not there last month, a washed-out embankment) and be able to show how they know. EU law requires critical entities to protect their sites physically, naming "perimeter monitoring tools and routines" among the measures to consider, and to re-assess their risks at least every four years [5][6]; US rules set how often pipeline rights-of-way are patrolled, and allow it from the air [8][9]. Drones are a repeatable way to look. What these organisations often cannot do is send the imagery to a cloud in another country, or depend on a link an incident may take down.
Omniris turns drone flights into maps, 3D models and reviewed findings, keeps every file in a tamper-evident evidence vault, and runs on Microsoft Azure, Google Cloud, the Omniris data center edition, or your own servers. The on-premises edition can run disconnected. Six capabilities matter most here:
On premises, the files, the database, map and 3D processing, AI detection on your own NVIDIA or AMD graphics processors, the encryption keys and the custody record all stay on your servers.
A switch takes the whole site offline. Mapping, AI, comparison, reports, encryption and local sign-in keep working, and a full planet street map is held on the box. Anything that needs the internet says so plainly.
Pick two dated flights of a site and Omniris lists the objects that appeared or disappeared, on a map. Each one becomes a finding awaiting an analyst. Nothing is treated as confirmed until a person has reviewed it.
Each comparison is sealed into the custody record with both input fingerprints, the model, the prompt, the threshold and the counts, so a "nothing changed" result can be traced as fully as a finding.
A situation report PDF, in English or Polish, tells the story of a site between two dates: imagery side by side, what changed, findings, sources with verifiable certificates, and the method's limits.
Besides the default detector, you can choose one whose licence carries no restriction on how its results are used. That matters where another model's licence forbids military use.
In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) names 16 critical infrastructure sectors, among them Energy, Dams, Transportation Systems, Water and Wastewater, Chemical, Government Services and Facilities, and the Defense Industrial Base [1]. In the European Union, the NIS2 directive lists energy, transport, drinking water, waste water, public administration and space among its "sectors of high criticality" [2]. The CER directive (Directive (EU) 2022/2557) required each member state to identify its critical entities by 17 July 2026 [7]. The organisations in this paper are those operators, and the government bodies that oversee or protect them.
Their drone work is mostly about knowing the state of a site and proving it: what is inside and outside the fence, what has changed, what a storm did, whether a structure is still sound.
| Mission | What is flown | What drives it, and how often | What the buyer expects |
|---|---|---|---|
| Perimeter and site-change monitoring | Repeat straight-down mapping of fence lines, yards, laydown and parking areas, and the ground around the site | The CER directive requires critical entities to ensure adequate physical protection of their sites, "duly considering, for example, fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls" [5]. NERC CIP-014 requires security plans for the most critical US substations that deter, detect, delay, assess, communicate and respond [10]. Network Rail lists "security surveillance" among its aerial surveys [15]. Cadence follows each operator's plan | Dated maps of the site; what has appeared or gone since the last flight; items to check |
| Corridor and right-of-way patrol | Linear flights along pipelines, rail lines and other corridors | US hazardous-liquid pipelines: surface conditions on the right-of-way inspected "at intervals not exceeding 3 weeks, but at least 26 times each calendar year", by walking, driving, flying or other means [8]. Gas transmission lines: patrol intervals from 4½ to 15 months depending on class location, and flying is an accepted method [9]. Network Rail flies to find earthworks and drainage problems (including landslips) and to monitor vegetation [15] | A record that the patrol happened; encroachments, ground movement and third-party activity located on a map |
| Periodic condition surveys | Close imagery and 3D capture of structures: bridges, dams, overhead line equipment, buildings | US highway bridges get a routine inspection at intervals that, under the standard method, may not exceed 24 months [11]. The Bureau of Reclamation has studied drones for bridge inspections and rockfall hazards [28]. Network Rail monitors overhead line equipment condition and locates overheating equipment from the air [15] | Imagery and 3D models, measured defects, a defect list that feeds maintenance |
| Damage assessment after an event | Rapid mapping after storms, floods, fires and earthquakes | FEMA's 2025 Preliminary Damage Assessment Guide says aerial imagery "may be collected with helicopters, fixed-wing aircraft, or drones", asks for orthorectified straight-down airborne imagery at 10-inch pixels or better, and describes comparing damage with imagery from before the disaster [13]. Local, tribal and state agencies may share drone imagery with FEMA's assessment teams [13] | Before-and-after maps; damaged assets located and counted; a record that holds up when funding or liability is argued |
| Risk and resilience assessment | A current, dated picture of the whole site and its surroundings | CER: a risk assessment within nine months of being notified as a critical entity, then at least every four years [6]. US community water systems serving more than 3,300 people: a risk and resilience assessment, recertified at least every five years, covering physical barriers and monitoring practices [12]. CIP-014: transmission risk assessments every 30 or 60 calendar months [10] | Baseline imagery that the assessment can cite, and a way to show what changed between assessments |
| Baseline imagery | Not flown by the operator: national aerial programmes | Poland's national orthophoto (GUGiK) is produced at 2 in (5 cm) pixels for towns and 4 in (10 cm) elsewhere, updated every two and five years respectively, free to download and use for any purpose [25]. The US NAIP programme has flown 2 ft (0.6 m) imagery since 2018, on a repeat cycle of no more than three years [26] | A dated "before" picture to compare drone flights against |
Some large operators keep a flight team of their own and add approved contractors. Network Rail uses specially trained in-house pilots and a framework of approved suppliers, and only those certified operators may fly within 164 ft (50 m) of its infrastructure [15]. After a disaster, FEMA does not fly drones itself; its guide says assessment teams will accept drone imagery submitted by state, local, tribal and territorial governments [13].
Four kinds of rule shape a drone monitoring programme at a critical site. Omniris keeps the data where these rules want it and keeps a record that shows what was done; demonstrating compliance stays with the operator.
| Rule | What it asks for, in brief |
|---|---|
| NIS2 — Directive (EU) 2022/2555 | Cybersecurity risk-management measures on an "all-hazards" basis, including business continuity (backup management, disaster recovery), supply chain security, cryptography, access control and multi-factor authentication (Article 21(2)) [3]. Member states had to apply it from 18 October 2024 [4] |
| CER — Directive (EU) 2022/2557 | Critical entities identified by 17 July 2026 [7]; a risk assessment within nine months of notification and at least every four years [6]; resilience measures including adequate physical protection, considering for example fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls (Article 13(1)(b)) [5] |
| NERC CIP-014-3 | Physical security of the most critical US transmission stations and substations: periodic risk assessments, and security plans to deter, detect, delay, assess, communicate and respond [10]. FERC approved its successor, CIP-014-4, on 10 September 2026, to take effect on 1 October 2028 [10] |
| America's Water Infrastructure Act, section 2013 | Risk and resilience assessments and emergency response plans for community water systems serving more than 3,300 people, reviewed at least every five years [12] |
| NIST SP 800-82 Rev. 3 | Guidance on securing operational technology, the control systems that interact with the physical plant [27] |
Site imagery can contain personal data: people, vehicles, number plates. Under the GDPR, personal data may leave the EU only if the conditions of its Chapter V are met (Article 44) [21]; the EU–US Data Privacy Framework of 10 July 2023 covers transfers to certified US companies [22]. For US critical infrastructure, CISA and the FBI advise knowing where drone data is stored, keeping it off networks it could leak from, and encrypting it at rest and in transit [20].
Omniris processes the photo files you upload, from whichever aircraft you fly, so choosing the fleet stays with the operator. Where a funding rule reaches as far as processing data from covered drones [17], that too is a fleet decision.
In the EU, flights beyond the pilot's line of sight fall in the "specific" category of Regulation (EU) 2019/947, which needs an operational authorisation or a declaration under a standard scenario [23]. In the US, a Part 107 flight must stay within unaided line of sight [24], so long corridors need a waiver. Omniris's airspace check reads US FAA data (see Getting the flights flown).
| Use case | What Omniris delivers |
|---|---|
| Perimeter and site-change monitoring from repeat flights | Each flight is a dated map on the site's timeline. Compare dates by swipe, fade or blink; AI change lists objects that appeared or disappeared; measure elevation change; set a change alert. Changes become findings for review (Change review) |
| A national orthophoto or satellite scene as the "before" picture | Add any georeferenced GeoTIFF you hold, such as a national survey sheet or a satellite scene, to a site as a dated image with its source named, beside your flights on the timeline |
| Reference maps of the site: roads, buildings, parcels, pipelines | GeoJSON, KML/KMZ, zipped Shapefile or GML (national topographic datasets included) as reference layers over every date, checked to land in the right place |
| Corridor and right-of-way patrol | Each patrol flight is mapped and compared with the last, with encroachments and ground changes filed as findings on the map |
| Condition surveys of structures | Maps, 3D models (meshes and Gaussian splats) and thermal maps, with measuring tools and findings with evidence pictures that feed the defect list |
| Thermal checks of electrical equipment | Temperature maps from radiometric cameras, spot readings, temperature differences graded by severity, and hot-spot search (Thermal Imaging paper) |
| Damage assessment after an event | Map the site afterwards and compare it with the last flight or a national orthophoto; AI detection finds the objects you name; the situation report packages the before-and-after picture |
| Input to a risk or resilience assessment | Dated baseline imagery, reference layers, a situation report and custody certificates the assessment can cite |
| Evidence for an incident, a claim or a prosecution | Tamper-evident custody records, signed certificates anyone can verify offline, legal holds and retention policies (Evidence and records) |
| Working with the network down | The on-premises edition can be switched offline and keeps processing, comparing, reporting and protecting data (Working disconnected) |
The question behind most monitoring flights is "what is different since last time?" Omniris answers it three ways, none of them a final verdict.
| Method | Answers | Works on |
|---|---|---|
| Visual compare | "Show me both dates": swipe with a curtain, fade or blink | Any map layer, imported national orthophotos included |
| Computed difference | "How much ground was raised or removed?" Material added, removed and net, each with its uncertainty; or how much of an area's vegetation index rose or fell | Elevation and index layers on a projected map grid |
| AI change | "Which objects appeared, and which disappeared?" Object by object, with a confidence on each date | Two orthomosaics with AI results from the same model and prompt |
Colour maps are compared by eye, not by value: a change in the light between flights would swamp real change. That is why the computed difference takes elevation and index layers only.
In the Site Navigator's Compare section, pick the earlier and later dates and a colour map layer, choose the detection model, set the confidence and press Find changes. The run happens on the deployment's own servers (on premises, your machines) and finishes even if you close the page.
Both maps need results from the same model and the same list of objects (order and punctuation ignored). Otherwise the run is refused, so a class nobody looked for on one date is never reported as disappeared.
Each date uses its verified result where a person has checked it, the AI's otherwise. Detections below the confidence you set, which starts at the model's own default, are left out on both dates.
The margin is the larger of twice the map's pixel size, the map's measured alignment error where ground control was used, and 3.3 ft (1 m). Maps whose ground resolutions differ by more than two times are refused, because the detector finds far more on the sharper map, which would show as false "appeared" objects.
Two ordinary flights can sit several feet apart. Omniris estimates the shift from objects that never move (buildings, roofs, towers, tanks, silos, bridges), never from vehicles, containers or machinery, which could be the change. It accepts only an unambiguous answer: at least five structures, at least half of them agreeing, a tight spread and no rival shift such as a row of identical warehouses can produce. Otherwise the result says "offset not estimated", and why. So include fixed structures such as buildings in the prompt.
The same class on both dates, within both margins plus the line-up spread, is unchanged; matching is one to one, so two parked cars never both match one. Only on the later date: appeared. Only on the earlier: disappeared.
Each appeared or disappeared object is filed as an untriaged finding, such as "Truck appeared", with an evidence picture of both dates side by side. Unchanged objects are counted, not filed.
On the map, appeared objects are green, disappeared red, and unchanged grey if you ask for them. Click one for its confidence on each date, how far it moved and its margin of error, in feet with metres in brackets. A comparison reuses stored detection results, so it is not charged for.
Every AI change run is sealed as its own event in the later map's custody record: both input maps by custody chain and content fingerprint, the model, a fingerprint of the prompt (the text itself goes in the record's private part), the confidence threshold, the line-up (shift east and north, spread and number of agreeing structures, when estimated) and the appeared, disappeared and unchanged counts. A run that finds nothing is recorded as fully as one that finds a great deal, so "we looked on these dates with this model and nothing had changed" is provable. Each finding it files points back to that event.
AI change compares what the detector found on two dates. It points analysts at what probably changed; it has not confirmed it. Anything the detector missed on either date is missed here too, and a false detection can show as a change. So every change lands as an untriaged finding, people's corrections are used where they exist, and the situation report lists unreviewed items first and says they have not been checked.
All three run on the deployment's own graphics processors; on premises, your own NVIDIA or AMD machines.
Alert me turns a computed difference into a standing watch. Each time a new flight of the site arrives, Omniris compares it with the one before and emails you, and up to ten other people with Omniris accounts, if the material added, removed or net, or the index change (its average, or the share of the area that changed), passes the line you set. Alerts are checked every six hours, changed areas above a minimum size can become findings automatically, and on a disconnected site the emails wait in a queue.
Most people who act on a monitoring result will never open Omniris: a duty officer, a security manager, a regulator, a ministry, a court. The situation report is one PDF that tells the story of a site between two dates. In the Compare section, choose the two dates and a colour map layer, pick English or Polish and click Generate report. The PDF is also saved to the vault with its own custody record, in the later image's folder or, if you cannot add files there, a Reports folder of your own.
The site, the two dates, when it was generated (UTC and local time) and by whom.
The later imagery with the area's outline, the site's reference layers, a scale bar and a north arrow, or "Imagery unavailable", never an outline passed off as the area.
Both dates side by side on one grid, at the same scale and without colour adjustment; the elevation change when both dates have a surface model; the AI change counts and how the dates were lined up.
Each changed object pictured on both dates (up to 40), then every other open finding in the area that you may see. Items not yet reviewed by a person come first.
Per image: source, capture date, custody chain, fingerprint, upload and processing history including the AI change event, and a custody certificate issued at generation that anyone can check offline.
The model and its licence notice, the thresholds, what "unchanged" means, and the comparison's caveats.
The app itself is in English; Polish is offered for the situation report. The Compare section's elevation and index comparison report can also be downloaded as a PDF.
An on-premises Omniris site is a normal connected installation that can run disconnected. It does not depend on reaching Omniris, or anyone else, to keep its core work going. That matters for vehicle-mounted systems, closed networks, and sites that lose their link in the very incident they have to respond to.
For a true air gap, the control is the site's firewall: Omniris stops its own processes connecting out, not the operating system or other software. The installation guide gives an example rule set.
| While disconnected | Examples |
|---|---|
| Works | Uploading, viewing, searching, downloading and exporting; maps, 3D models and AI detection on the site's own graphics processors; Compare, AI change and situation reports; findings and AI checking; encrypting and opening protected files (the key service is on the site); the custody record and legal holds; the street basemap and its labels; publishing to an ArcGIS Enterprise portal on your own network |
| Waits in a queue | Email notifications; the weather and place name for newly uploaded photos; independent timestamps for the custody record. Each goes out when the link returns |
| Stops, and says so | Orion, the AI assistant; address search; live weather (the last forecast is shown with its time); satellite basemap imagery; new Google, Apple, Microsoft or Facebook sign-ins; Hybrid jobs in the Omniris cloud; US airspace lookups and LAANC; publishing to ArcGIS Online |
Every on-premises site holds a full planet-wide street basemap built from OpenStreetMap data, not a pre-cut region. The installer copies it onto the site's own storage and checks it byte for byte against a published fingerprint before switching it on. A connected site checks weekly for a newer build. The fonts for every label are built into the software, so the Streets, Light and Dark basemaps keep their labels with the cable pulled. Satellite and Hybrid backgrounds come from an internet imagery service and show as offline; a disconnected site's imagery is its own drone maps and any national orthophoto or other GeoTIFF added to the vault.
A connected on-premises site uses the internet for maps, address search, weather, email, Orion and licence renewal, often through Omniris on its behalf so that no provider key sits on the site. This section describes what happens when that link is switched off or lost. The Security paper lists what a connected site sends, and to whom.
Omniris computes positions, elevations and differences from your photos and ground control, and shows their uncertainty. That is not a survey certified by a licensed surveyor, and Omniris claims no national accuracy class. Where a result has legal weight, such as a boundary or a contract quantity, have it checked by someone licensed to certify it (Stitching paper).
A monitoring result can end up in an incident review, a regulator's file, an insurance claim or a court. Every file in Omniris carries a tamper-evident custody record, on in every edition (Evidence Integrity paper).
Omniris provides verifiable records and the means to check them. Whether evidence is admissible, and what weight it carries, depends on the jurisdiction and the case.
Roles are set in Omniris. Work accounts can sign in through Microsoft, and each person's role (manager, pilot, or viewer limited to granted folders) is assigned in Omniris rather than mapped from a corporate directory.
On Microsoft Azure and Google Cloud the storage and database services encrypt everything they store. On premises and in the data center edition, disk encryption comes from the servers' own setup rather than from Omniris; on premises, disk encryption and HTTPS are the site's choice. The Security paper covers all of this in full.
Repeatable missions. Monitoring only works if the same area is flown the same way each time. The mission planner turns an area into flight lines from the camera, height and overlap, with terrain following, and estimates photos, time and batteries. Omniris never connects to the aircraft: it writes a mission file for DJI Pilot 2, DJI Fly, Litchi or QGroundControl/Auterion (or a boundary file for apps that plan their own lines), which can be saved to the vault with its own custody record. A job can carry up to 50 no-fly zones, such as a substation yard, kept out of the route (Mission Planning paper).
Airspace from FAA data. The airspace check reads the US Federal Aviation Administration's data, walks the whole route at the height actually flown, and says whether LAANC or air traffic control authorization is needed. Outside FAA coverage it says the data does not apply and never calls the area "clear".
Cameras. Processing starts from the photo files you upload. Colour cameras feed maps and 3D models; DJI and FLIR radiometric thermal and MicaSense multispectral cameras are recognised automatically; LiDAR point clouds are processed too (LiDAR paper). Because Omniris works from files, the fleet you fly is your decision under the rules that apply to you (see The rules that shape the work).
| Channel | What it does |
|---|---|
| Reports and certificates | The situation report and comparison report PDFs; signed custody certificates for a file, folder or finding, verifiable offline |
| Findings API and webhooks | Read or read-and-write tokens scoped to one organisation or vault: search findings, follow a change feed, fetch evidence, update status or assignee, request certificates. Signed webhooks announce changes; on premises they can go to approved machines on your own network |
| Exports | Findings as GeoJSON, CSV or KML (up to 20,000 at a time); maps as GeoTIFF; elevation surfaces to CAD in the site's frame |
| Publish to ArcGIS | GeoTIFF maps to your ArcGIS Online or ArcGIS Enterprise; an Enterprise portal on your own network works without the internet. Protected files are never sent |
| Shares and links | Share codes (read-only, full access or frozen snapshot) and public links with password, expiry and view limit, each use recorded in the custody record |
Shared Site Navigator links show a site's dated maps and never include encrypted layers. Orion, the Omniris AI assistant, answers questions about your sites from the data you may see; a cloud language model answers them, so Orion needs the internet (Sharing and Delivery, Orion).
The software is the same in all four editions; what differs is whose hardware it runs on, and so where the data and keys live.
| Edition | Files, database and processing | Encryption keys and custody signing key |
|---|---|---|
| Omniris cloud (Microsoft Azure) | Azure, West US 3 region, United States | Omniris's key service in its private Azure network; Azure Key Vault |
| Omniris cloud (Google Cloud) | Google Cloud, us-central1 region, United States | Omniris's own key service on Google Cloud; Cloud KMS |
| Omniris data center edition | Omniris's own servers | A key service on those servers; TPM chip or protected key file |
| On premises | Your own servers, with processing on your own NVIDIA or AMD GPU workers. Can run disconnected | A key service on your server, keys generated there and never leaving; TPM chip (or other PKCS#11 hardware) or protected key file |
A monitoring record is only useful if its boundaries are clear. These are the ones to rely on: