A Hybrid Cybersecurity Assessment Framework for Unmanned Aircraft Vehicles Based on IMECA and Penetration Testing

Unmanned aerial vehicles (UAVs) are increasingly used for various applications, including monitoring critical infrastructures, wildfires, and military operations. Using consumer-grade UAVs in security and safety-critical operations makes these systems highly susceptible to cyber threats. This paper proposes a hybrid UAV cybersecurity assessment framework that combines the structured analytical method IMECA (Intrusion Modes and Effects Criticality Analysis) with practical vulnerability exploitation (penetration testing) procedures. The approach includes detailed information gathering, identification of known and zero-day vulnerabilities, risk-based threat analysis and modelling, and penetration testing. A key element of this methodology is utilising IMECA-based analysis of criticality mode and intrusion consequences, both in its preliminary and a posteriori forms, to assess the operational impact of threats and develop appropriate countermeasures. The proposed concept bridges the gap between theoretical risk assessment and penetration testing in real-world conditions, providing practical recommendations for improving cyber resilience UAVs. The paper describes each stage of the method and provides an example of an IMECA application. Further work will focus on empirical verification of specific examples and enhancing the framework using simulation to assess risks of exploiting zero-day vulnerabilities.