What changed
FACT (Federal Register, 2026-07-06): a new rule extends counter-UAS detection and mitigation authority — previously federal-only — to state, local, tribal, and territorial (SLTT) law-enforcement and correctional agencies under a defined certification framework. FACT (Hackster): QuadRF demonstrates open-source, real-time RF/Wi-Fi visualization on ~$100 commodity hardware.
Why now
FACT: the rule published July 6, 2026 and agencies must certify before operating, creating a dateable compliance-then-procurement sequence. HYPOTHESIS: incumbent counter-UAS vendors (priced for DoD/federal budgets) will be slow to reprice for a county jail, leaving a temporary downmarket window.
Converging signals
(1) Regulation: SLTT counter-UAS authorization with certification regime (federalregister.gov 2026-13609). (2) Industrial/hardware: QuadRF-class ~$100 open-source RF sensing (hackster.io). The bridge is real but thin: QuadRF visualizes Wi-Fi propagation for site surveys — it is NOT a drone detector. Turning commodity SDR/RF hardware into reliable drone detection (protocol decoding e.g. DJI DroneID/Remote ID, direction finding, low false-alarm rates) is a serious engineering project, not a packaging exercise. That gap between the two signals is the weakest link in the causal chain.
Customer pain
FACT-adjacent (widely documented, but not in the provided sources — treat as hypothesis here): contraband drone drops into prisons are an acute, recurring problem for correctional facilities. HYPOTHESIS: newly authorized agencies now face a second pain — they must certify and document operations under the new framework but have no affordable tooling, since professional counter-UAS systems cost $50k-$500k+.
Who pays
SLTT police departments and correctional facilities, typically via state/federal grant money. This is government procurement: purchase orders, sole-source justifications or RFPs, insurance/liability requirements, and long approval chains — even a $5k kit usually takes months to clear a county purchasing process.
Solved today
Incumbents: Dedrone (now owned by Axon, with an existing police distribution machine), DroneShield, AeroDefense, Hidden Level, Echodyne. Prisons either buy these at federal-scale prices, rely on state-police assets, or do nothing. Some agencies use free/cheap Remote ID receiver apps (e.g. DroneTag/OpenDroneID scanners) informally.
Why current solutions are bad
Incumbent gear is priced and sold for federal/DoD and large-metro buyers; a rural county jail cannot afford it. Free Remote ID apps don't detect non-compliant/spoofed drones (the ones dropping contraband) and produce no certification-grade audit trail. The compliance/reporting layer required by the new framework barely exists downmarket.
Proposed product
As pitched: a turnkey kit — commodity RF/SDR sensing hardware + software that logs detections, generates certification-aligned reports, and maintains the audit trail the new framework requires — sold as hardware + recurring compliance SaaS. SKEPTICAL RESTATEMENT: the defensible, solo-feasible slice is only the software/compliance layer; the hardware and detection-accuracy layer is where the project dies for a solo founder.
MVP version
Realistic MVP is NOT the kit. It is: (a) a plain-language breakdown of the certification requirements from the rule, and (b) a web app where an agency logs counter-UAS activity and exports the reports/records the certification framework requires, hardware-agnostic (ingest from whatever sensors they have, including Remote ID receivers). Hardware detection kit is explicitly out of MVP scope — false negatives at a prison are a liability event a solo founder cannot absorb.
30-day build
Read the full rule; extract the exact certification, recordkeeping, and reporting obligations. Interview 5-10 correctional-facility and sheriff's-office contacts (fire-service/public-safety background helps get calls returned). Publish a free 'SLTT Counter-UAS Certification Checklist' as lead-gen. Validate: will anyone pre-pay for a compliance/logging tool before certifying?
60-day build
If (and only if) 30-day interviews show agencies actively pursuing certification with grant money in hand: ship the logging/reporting web app to 2-3 pilot agencies free or cheap; document their certification submission end-to-end.
90-day revenue plan
HYPOTHESIS, low confidence: $200-500/mo per facility for compliance/reporting SaaS, 3-5 pilots converting = $1k-2.5k MRR. Realistically, government purchasing timelines make even this optimistic inside 90 days; first paid POs likely land at month 4-9.
Distribution path
State sheriffs' associations, correctional-administrator associations, grant-writing consultants, and the certification/training bodies the rule creates. There is no self-serve path — every sale is a demo plus a procurement process. This directly violates the founder's no-enterprise-sales constraint; government sales is enterprise sales with extra steps.
Pricing hypothesis
Kit fantasy version: $3k-8k hardware + $200-500/mo software. Software-only version: $200-500/mo per facility or per-report pricing. Per-transaction pricing (the founder's proven ELDT model) fits poorly: agencies file for certification once, not repeatedly per event.
Technical difficulty
HIGH for the kit: QuadRF-class hardware visualizes Wi-Fi; reliable drone detection needs SDR protocol decoding, DF/triangulation, weatherproof deployment, and near-zero false-negative tolerance in an adversarial environment (contraband smugglers adapt). MEDIUM-LOW for the software-only compliance layer: standard CRUD + report generation, well within solo AI-assisted capability.
Legal / regulatory risk
Significant. Mitigation (interdiction) remains tightly restricted even under the new framework — a vendor whose gear touches mitigation inherits regulatory exposure. Detection failure at a correctional facility (missed contraband drop leading to a weapon/drug incident) invites lawsuits. RF reception is generally legal, but decoding/interference edges into FCC and federal wiretap-adjacent territory. This is not FMCSA-certificate-upload risk; it is public-safety-failure risk.
Platform dependency
Low on Big Tech platforms; high on the regulatory framework itself — the certification regime's final implementation details (still fresh as of July 2026) could mandate approved-vendor lists or standards that lock out uncertified gear, which would kill a commodity-hardware kit overnight. HYPOTHESIS: an approved-equipment list is plausible and would be fatal.
Founder fit
Mixed, and weaker than it first looks. Superficially rhymes with the ELDT win (new federal framework, parties compelled to comply, build the compliance layer, charge per unit). But the ELDT edge was: private-sector customers (training providers) with recurring per-student filings, self-serve distribution, zero hardware, zero liability. Here the buyer is a government agency, the filing is one-time-ish certification not recurring transactions, the product involves hardware and life-safety liability, and the sales motion is procurement. Founder's industrial-ops and public-safety credibility helps with discovery interviews, but the shape violates his explicit avoid-list (hardware manufacturing, long trust cycles, enterprise-style sales).
Breakout potential
If the certification framework generates recurring reporting obligations (periodic activity reports, incident filings), a hardware-agnostic 'counter-UAS compliance system of record' could become the QuickBooks of a brand-new mandatory activity across thousands of agencies — genuinely large. But that is a 12-24 month grant-cycle grind, not fast cash.
Final recommendation
KILL the hardware kit outright — it stacks hardware manufacturing, government procurement, life-safety liability, and an Axon-backed incumbent against a solo founder needing cash in 90 days. REVISIT LATER (3-6 months) only the software-only angle: if discovery calls reveal the certification framework imposes recurring reporting/recordkeeping obligations on agencies, a hardware-agnostic compliance/logging SaaS is a legitimate ELDT-shaped play worth one week of validation — but it is a 6-12 month revenue play, not 30-90 days. Do not build anything before reading the full rule text and confirming what agencies must actually file, and how often.
Next action
Spend 2-3 hours reading the full rule at the Federal Register URL and extract the exact certification, recordkeeping, and reporting obligations (one-time vs. recurring). If recurring obligations exist, book 5 discovery calls with correctional administrators; if certification is one-time with no recurring filings, kill entirely and move on.