As investigations continue into the cause, Andrew Peck, a cyber resilience researcher at Loughborough University, explains that this is the latest in a series of wake-up calls for how we consider resilience, threats, and the growing risks facing critical infrastructure.
“NATS has ruled out a cyber-attack, and there is nothing in the evidence so far to doubt that. No attacker, no hostile intent, just a routine technical change that grounded aircraft worldwide within hours. The incident bears striking similarities to the CrowdStrike outage in 2024, where a faulty software update disrupted millions of systems across banks, hospitals, government services and airlines. Alongside the 2023 flight planning failure that caused widespread disruption across the UK aviation network, we now have a well-established pattern, but systems that treat this pattern as a series of surprises instead.
"The reason these failures keep catching us out is that large infrastructure organisations are rarely challenged in a genuinely adversarial way until something goes wrong. Much assurance activity is documentary: policies, audits and compliance frameworks. That has value, but it tests whether an organisation can describe its resilience, not whether it has it.
“A red team's job is to find the assumption nobody thought to write down, and that work is most valuable early in design and procurement, which is precisely when it is least often commissioned. By the time a system is handling 2.5 million flights a year, the cost of finding a flaw has moved from the design office to the departure board.
"We shouldn't just ask, 'Could someone break this?' We should ask, 'When this breaks for any reason, do the fallbacks work, and do the people running them know what to do at 3am?' They are really the same question, and adversarial testing is how you answer it. Resilience is only a claim until someone has tried to break it.
“Most revealing was how quickly a large part of the public decided that this was a state-level attack. Within an hour, that idea had taken hold. This says less about air traffic control and more about the times we live in. When official communication is slow, speculation fills the gap, and once spread it is much harder to correct, and can erode trust in operators who may have done nothing wrong.
"This highlights a challenge across critical national infrastructure, not just aviation. Risk looks very different from the inside than from the outside. Organisations understand risk through their processes, controls, experience and very detailed knowledge of their systems. The public, passengers and partners will judge against a world in which almost everything they depend on is digital, interconnected and occasionally fails without warning. Neither view is wrong, but they can drift apart, meaning incidents are often perceived very differently by those managing them and those affected by them. Bringing those perspectives together through external challenge, joint exercises and independent testing is one of the most valuable things operators, regulators and researchers can do.
"The independent review announced this week is welcome. My hope is that in addition to asking what failed and why, it also asks who had ever seriously tried to make it fail — and how long before go-live they were asked to."
ENDS
For further comments or interview requests with Andrew Peck, please email the PR team or call 01509 222224.