Third time lucky: why businesses need to boost their resilience

In September, the UK’s air traffic control system NATS suffered not one, but two outages.

In the first, a reported software glitch in NATS’ main systems caused the cancellation of over 2,000 flights. The defect happened “in the space of a millisecond”, according to an initial NATS investigation. This, in turn, caused corrupted data and forced NATS to limit UK air traffic for most of September 8th.

The second incident, a “connectivity issue” at its Prestwick centre in Scotland, was more minor, affecting some 150 flights. But at the time of writing, its full impact was still being assessed. The organization said air traffic control was back up to “full capacity” by the evening of September 21st.

Impactful beyond initial issue

Airlines, though, warned of knock-on effects. Ryanair said 140 of its flights were delayed, affecting 25,000 passengers. “Passengers are once again suffering lengthy delays because NATS has failed to deliver either a reliable system or an effective back-up,” said Neal McMahon, the airline’s chief operating officer, in a statement. Ryanair called on NATS CEO Martin Rolfe to resign, or for the government to sack him.

The failures are only the most recent to affect NATS. Back in 2023, the air traffic control service experienced another IT shutdown over the Bank Holiday weekend. Then, 700,000 passengers were delayed. A further, smaller incident forced the cancellation of 150 flights in 2025.

As far as we know, none of the incidents at NATS were caused by a cyber attack or other malicious action. Instead, it appears that all the incidents were the result of IT failures.

The organization’s initial report into the September 8th outage said that corrupted data forced NATS to restart the National Airspace System (NAS) and reload data. To do this, they had to restrict all of the UK’s airspace. The report also stated that the incident was not connected to the 2023 outage.

NATS claims it has invested more than £1bn in technology over the last 10 years. Airlines and their passengers will be questioning whether that was money well spent. But NATS's issues illustrate how fragile modern IT systems can be, and why organizations need to plan for failure.

“In its 2023 failure incident, NATS had a backup. It failed the same way as the primary, at the same moment, because it ran the same logic on the same input,” Ivan Milenkovic, vice president for risk technology EMEA at Qualys, a security vendor, told ITPro.

“After 2023, the CAA’s independent review produced 34 recommendations across NATS, the regulator, airports, airlines and government. The review was formally completed in June 2026 with all recommendations closed,” he explains. Less than three months later it failed again, in the same flight processing area. NATS says it was a different sub-system this time. Even so, I’d expect the new review to ask why “closed” recommendations didn't prevent another day like this.”

Far-reaching consequences

Clearly, air traffic control is critical to national infrastructure (CNI), and operators cannot take chances with safety. In the case of the NATS outages, the organization will have had no choice but to close airspace and to divert flights.

But disruption on this scale has consequences far beyond the inconvenience to individual passengers, or even to airlines and airport operators. They also cause a significant economic impact.

The 2023 NATS outage is calculated to have cost airlines £65m, and costs to passengers, airports, tour operators, insurers and others brought the total to £75m to £100m, according to the Civil Aviation Authority’s independent review. Understandably, governments want to see organizations, especially those running CNI, improve their resilience and recovery planning.

“It wasn’t a recent software update that caused the incident, rather a defect that had been present for some time, but the specific course of events hadn’t occurred to trigger it,” James Watts, managing director at Databarracks, told ITPro.

“You prevent this type of issue through testing software before rolling out into production. Once an incident occurs, the challenge is recovering systems, maintaining operations and minimising the impact. Fixing the defect comes later.”

As Watts says, once NATS found they had a problem, they moved quickly to implement their major incident plan. “The priority in transport and aviation must always first be to safety. NATS’ incident processes here look to be strong, and it operated according to its incident and crisis management planning,” he notes. But there are still lessons enterprises can learn.

The first is not about technology, but communications. NATS’ systems were offline for a relatively short time, but the impact was still significant. Even though NATS has come in for plenty of criticism, there are other organizations that have handled IT outages far less well. So CIOs, CISOs and heads of operations need to ensure their communications plans are as well-drilled as their business recovery processes.

More than just a tick-box exercise

Organizations also need to keep up with changing laws and regulations, even though compliance on its own does not necessarily improve resilience. Enterprises could face a growing regulatory burden while also having to redesign systems to be robust during an incident and easier to restore afterwards.

“Regulation cannot be a substitute for effective organizational and operational practices which seek to anticipate and simulate risks and take anticipatory steps to mitigate them,” James Morris, director of CSPR, a think-tank focused on business resilience. Organizations across critical infrastructure need to embed a “culture of prevention”, he argues.

In the near future, laws such as the EU’s Cyber Resilience Act, DORA and the UK’s Cyber Security and Resilience Bill will set minimum standards in some areas. But this might not be enough to make the economy better able to withstand accidental outages, let alone hostile acts.

“There is still a question over how exactly “critical national infrastructure” will be defined,” Chris Dimitriadis, chief global strategy officer at ISACA, told ITPro.

“Cyber attacks on major retailers such as M&S and Jaguar Land Rover have highlighted the wide-reaching impact of organizations that are not currently classed as critical national infrastructure. Regulation is moving in the right direction, but there is still a clear job for organizations to ensure that they are compliant.”

Businesses should review their business continuity and cyber incident plans now, and not wait for regulators to force their hands. This means reviewing skills, practices, and protocols, Dimitriadis says.

Otherwise, there could be far more than a missed flight at stake.