Perimeter overwatch of critical sites.

The mission

A large industrial site — a refinery, a transformer yard, a fuel terminal — keeps a persistent aerial watch on its perimeter: a patrol drone flying the fence line on a schedule, fixed cameras on masts covering the gates and the blind corners, everything feeding the control room where the shift supervisor decides what is an animal, what is a contractor, and what is the start of a bad night. The site matters enough that someone might one day probe it deliberately, which means the watch has to be designed for the night when somebody wants it blind.

What breaks

The site itself is the first adversary. Tank farms, switchgear and stacked steel carve the grounds into radio shadows; the electrical plant raises the noise floor; a drone on the far leg of the fence line is shadowed from the control room by the very infrastructure it is guarding. Any single link — one Wi-Fi backbone, one buried fibre run, one cellular modem — has holes the site’s own geometry guarantees.

The second adversary is the deliberate one. Perimeter communications concentrate in a few obvious places — a pull box, a mast feed, a single band — and cutting one cheap thing before an intrusion is an old and effective move. A watch that dies with one cable is not overwatch; it is a schedule of when the site is blind.

The architecture on this mission

Every element of the watch runs a node: the patrol drones, the fixed masts, the control room. Together they form one encrypted mesh over the site, so a drone shadowed from the control room by a tank farm is not shadowed from the nearest mast — the feed hops through it, each leg separately measured and separately encrypted, and the route re-forms as the drone flies on. The site’s existing backbone, whatever it is, becomes one path among several rather than the single thing everything depends on.

The deliberate-attack answer is independence. The bond into the control room runs the site network and public cellular together — different cables, different bands, different failure modes, deliberately nothing in common — so severing the obvious cable moves traffic onto the remaining routes within a second rather than starting an outage. When measured loss or latency climbs on the paths that remain — whatever the cause — adaptive redundancy escalates from one transmission path to two to three for the critical classes, and scales back when conditions clear. Throughout, the command channel to the drone holds its reserved floor: video sheds resolution under pressure, but the ability to send the aircraft somewhere never contends for the thin pipe.

And because every link is probed continuously, the journal records the attack as data: the exact second the fibre died, which paths carried, what the adversary’s move actually bought them — which is to say, an alarm and nothing else.

How the shift unfolds

1. Shift start. The drone lifts for the first fence run; masts, drone and control room are already one mesh. The supervisor’s dashboard shows every node and every path’s measured state — including the quiet degradations worth a maintenance ticket.
2. The far leg. Behind the tank farm the direct path to the control room dies, as it does every lap. The feed hops through the eastern mast without a switchover event; nobody in the control room can tell from the video which route it took.
3. The cut. At 02:14 the buried fibre to the far mast goes dead — cleanly, all at once, the signature of a tool rather than a fault. Within a second the mast’s cameras and the drone’s feed are riding the remaining routes, and the control room holds an unbroken picture plus an alarm saying exactly what just died.
4. Pressure on what remains. Loss and latency climb on the surviving paths. Adaptive redundancy steps the command channel and the priority feed up to duplicate, then triplicate transmission; video sheds quality in enforced order. The drone is retasked to the cut — the one place the site most needs eyes — on a command floor that has not flinched.
5. Resolution. The response team clears the sector; conditions ease; redundancy de-escalates on its own and video climbs back to full quality. The repaired fibre later rejoins the bond as simply one more measured path.
6. The review. The journal gives the security review a timestamped account: what was cut, what carried, what the watch saw throughout. The incident becomes evidence and a hardening plan, not an unexplained gap in the recording.

What each mechanism contributes

• Site mesh with per-hop encryption — drones and masts relay for each other around the site’s own steel; routes re-form as the aircraft moves. Shipped.
• Bonding across independent routes — site network and cellular as one measured fabric with nothing shared to cut. Shipped.
• Adaptive redundancy — one to two to three simultaneous transmission paths for critical traffic as measured conditions worsen, scaling back when they clear. Shipped.
• Class floors and ordered degradation — the command channel reserved, video elastic; the order enforced, not hoped for. Shipped, opt-in.
• Continuous measurement and the journal — the attack, and every quiet degradation before it, recorded as data for the review. Shipped.

The honest boundary: Atlas contributes the network layer; the cameras, the analytics, the guards and the response are the site’s. If every independent route is physically destroyed at once, no software keeps the feed alive — the architecture’s promise is that there is no single cheap thing whose loss blinds the watch, and that any loss is survived in order and recorded. And a plain statement, because this page will be read carefully: the mechanisms respond to measured degradation whatever its cause, but resilience against deliberate RF interference is not a field-validated claim we make — our field record is controlled link-degradation trials, with links cut, delayed and degraded live. Physical-layer and procedural measures remain the counterpart for that threat; this architecture multiplies them rather than replacing them.

What a pilot should prove

• Feed continuity through a scripted cut of the site’s primary route during a live patrol lap, with the failover interval measured by the journal.
• Command-channel continuity — the drone retaskable throughout the worst induced interval, on the reserved floor.
• Mesh relaying around the site’s real shadows: the far-leg feed demonstrably arriving via a mast, with per-hop measurements.
• The review artefact: a timestamped journal of the exercise a security auditor can read without a network engineer beside them.

One site, one shift, one scripted cut. The evaluation format covers the structure.