DJI has published results from an independent cybersecurity assessment by U.S. firm OnDefend, saying the review found no malware, hidden backdoors, or critical, high, or medium-risk vulnerabilities in two tested drones: the consumer-focused DJI Air 3S and the enterprise-oriented Matrice 4E.
For buyers, fleet managers, and organizations weighing DJI hardware, the headline is important but not complete. The assessment gives DJI a useful third-party security argument at a time when its products remain under U.S. government scrutiny. It does not, however, settle every regulatory or procurement concern around DJI drones.
What OnDefend Tested
According to DJI’s summary of the assessment, OnDefend spent five months testing the Air 3S and Matrice 4E across software, firmware, hardware, and radio-frequency behavior. The company says the work included physical inspection, attack simulations, and attempts to identify unauthorized data movement.
DJI says OnDefend bought the test units independently rather than receiving hand-picked samples from DJI. The Air 3S reportedly came from a retail channel, while the Matrice 4E came from dealer inventory. That matters because buyer-sourced units reduce one obvious concern in vendor-sponsored testing: that the tested hardware might differ from what customers actually receive.
DJI Air 3S Fly More Combo
The DJI Air 3S is the consumer model named in the OnDefend assessment, so it is the most natural hardware reference for readers evaluating the audit in a buying context. Buyers should still check seller authorization, firmware status, and any organization-specific procurement rules before purchase.
As an Amazon Associate I earn from qualifying purchases.
The report, as described by DJI, found no evidence that either tested drone transmitted data outside the United States. It also reported no successful compromise or tampering of the aircraft during the assessment window.
The Buyer Takeaway
This is most useful as a risk signal, not a blanket guarantee. The assessment covered two specific products at a specific point in time. Firmware updates, app updates, cloud-service changes, and future hardware revisions can all change the security picture after a test concludes.
That distinction matters for buyers comparing DJI drones against other options for inspection, mapping, public safety, construction, or content production. A clean result on two models may support a purchasing case, especially where DJI’s camera systems, flight performance, and software ecosystem are already the practical fit. It should not replace an organization’s own security review, procurement policy, or legal guidance.
| Question for buyers | What the audit helps answer | What it does not fully answer |
|---|---|---|
| Is there evidence of malware in the tested units? | DJI says OnDefend found none. | It does not prove all DJI products are free of future issues. |
| Were consumer and enterprise drones included? | Yes, the Air 3S and Matrice 4E were tested. | Other DJI models were outside the stated scope. |
| Can regulated organizations rely on this alone? | It may support due diligence. | It is not the same as a government-directed review. |
Low-Risk Issues Still Matter
DJI says the assessment identified 10 low-risk findings, including weak TLS protocol support in a companion app and authentication tokens appearing in URLs. Those details have not been independently verified here, so they should be treated as claims from the published audit summary rather than a separate finding.
Even low-risk issues deserve attention in drone programs. Weak transport settings, token handling, update behavior, and account security can matter when aircraft are used around sensitive locations, customer sites, public infrastructure, or internal mapping data. DJI says it is addressing the findings through firmware updates.
NANUK 920 Hard Case for DJI Air 3S
A fitted hard case helps keep the aircraft, controller, batteries, cards, and cables organized between jobs. For teams handling site imagery or customer data, physical control of the kit is part of the broader security checklist.
As an Amazon Associate I earn from qualifying purchases.
Regulatory Risk Has Not Gone Away
The audit lands against the backdrop of continuing U.S. concern over Chinese-made drones and DJI’s place in sensitive public-sector and commercial use. Some reported legal and regulatory timelines around DJI’s dispute with U.S. agencies remain difficult to confirm from the source material alone, so buyers should avoid treating any single date or claimed financial impact as settled without checking current filings and agency notices.
What is clear is that the security debate is not only technical. Procurement teams also have to account for policy, supply availability, authorization status, customer restrictions, and future support. A drone can test clean in a cybersecurity review and still face market access or compliance problems.
Verdict: Useful Evidence, Not a Final Answer
For individual creators and private buyers, the OnDefend result may reduce concern about the specific tested DJI models, especially if the main decision is whether the Air 3S or a comparable drone fits a normal camera or inspection workflow.
For enterprise, government-adjacent, and security-sensitive buyers, the better reading is narrower: the audit is a helpful data point, but it does not remove the need for internal review. Ask which model will be used, which firmware is installed, what data leaves the device or app, how accounts are managed, and whether your organization is exposed to current or pending purchasing restrictions.
The short version: DJI now has a stronger security argument for the Air 3S and Matrice 4E than it had before this assessment. Buyers still need to separate product security findings from regulatory risk before making a purchasing decision.