Fleet management is the new domain admin.

One over-scoped API token and an entire fleet becomes reachable. Three architectures, three ways in.

Every drone programme of any size grows a fleet management platform: a web application that knows where every aircraft is, holds its telemetry history, and can push configuration and firmware to it. That platform is the highest-value target in the system, and it is usually the newest code in the company.

Three architectures

• Aircraft-holds-token — a long-lived credential on the aircraft, scoped to the tenant rather than the aircraft. Recover one aircraft, reach the fleet.
• Gateway-mediated — the ground station holds the credential. Better, until the ground station is a Windows laptop in a truck.
• Per-device identity — each aircraft has its own key, rotated, scoped to itself. Rare, and the only one that survives a lost aircraft.

What we test

Tenant isolation on every read and write path, credential scope and lifetime, the firmware push path end to end, and what happens when an aircraft that should have been decommissioned reconnects.

The decommissioning question

Ask your platform team what happens when an aircraft is lost in the field and someone else powers it on. If the answer takes more than a sentence, that is the finding.