Hybrid Threats Are a
Leadership Question

Most airport leaders can explain what happens when a particular system fails or a familiar operational disruption occurs. The more difficult question is what happens when several things go wrong at once, none seems particularly serious on its own, and nobody can say with confidence whether they are connected.

That is one of the defining challenges of hybrid threats. The immediate incidents may be handled by security, operations, IT or another specialist function, but the consequences can quickly extend across the entire airport. At that point, the quality of the response depends as much on leadership, judgement and coordination as it does on technical capability.

In our work with airports and critical infrastructure operators, we increasingly see resilience becoming a question for the whole executive team. It concerns how an organisation understands an uncertain situation, agrees priorities and keeps essential functions operating while the picture is still developing.

The difficulty is not always the incident itself

Airports are experienced at responding to disruption. They deal with technical failures, operational irregularities and security incidents every day, supported by well-established procedures and specialist teams. Those arrangements remain essential. The challenge with hybrid threats is that several incidents can overlap or reinforce one another, crossing the boundaries between functions that are usually managed separately.

A disruption in a digital service may coincide with an operational problem and misleading information circulating publicly. Each issue might be manageable in isolation. Together, they can put pressure on decision-making, create uncertainty among passengers and employees, and make it harder for the airport to establish what matters most. The organisation may have good procedures for every individual event but still struggle to form a common understanding of the situation.

It is also important not to assume that every combination of disruptions is deliberate. The cause and intent may remain unclear for some time. Airport leaders cannot wait for definitive attribution before protecting people, maintaining safe operations and communicating responsibly. They must be able to make proportionate decisions with the information available, adjusting their response as their understanding improves.

This is why buying more equipment, however valuable in the right circumstances, cannot be the whole answer. Technology can help detect, protect and restore. Whether that information leads to timely decisions is ultimately an organisational question.

An airport is more than the infrastructure inside its fence

Traditional aviation security has rightly concentrated on protecting aircraft, passengers, baggage, access and the secure aviation environment. That responsibility has not diminished. But airports also depend on a much wider network of services and organisations: power and telecommunications, digital suppliers, transport connections, fuel and logistics, airspace and navigation services, contractors and public authorities.

The practical implication is that leaders need to think not only about which assets to protect, but which functions the airport must be capable of maintaining or restoring. There is an important distinction between keeping an airport fully operational as a business and preserving the functions that society depends upon. In a serious and prolonged disruption, those priorities may not always be the same.

That discussion belongs at executive and board level. It requires airports to consider their particular role in regional connectivity, emergency response, essential supply chains and, where relevant, strategic mobility. It also requires an honest understanding of what the airport can control itself and where continued operations depend on decisions taken elsewhere.

What readiness looks like in practice

Experience suggests that effective preparation starts with a few disciplines that are easy to describe but less straightforward to establish consistently.

First, there needs to be clarity about leadership and decisions. When security, operations, IT, safety and communications are all involved, somebody must bring the information together and somebody must have the authority to set priorities. The answer does not have to be the same organisational structure at every airport. It does have to be understood and practised. A short, workable decision matrix that senior leaders have actually discussed can be more useful in the first stages of a disruption than a comprehensive plan that is difficult to apply under pressure.

Second, the different functions need a shared view of the situation. This is not simply a matter of connecting systems or introducing another reporting platform. It depends on familiar routines, a common language and enough trust between departments to share incomplete information without waiting until every detail has been confirmed. These habits are built through everyday cooperation, not improvised during a crisis.

Third, exercises should challenge the way the organisation makes decisions. There is value in testing an individual contingency procedure, but hybrid resilience requires more. Senior leaders should practise situations involving incomplete information, overlapping events, uncertain responsibilities and the need to communicate while the facts are still emerging. A useful exercise is one that reveals where information stops, where assumptions differ and where decisions are delayed. The real value comes from what the organisation changes afterwards.

Fourth, preparation needs to extend beyond the airport operator. The airport should know which external dependencies matter most and have established working relationships with the organisations responsible for them. Understanding what a key supplier, service provider or authority can realistically deliver during a disruption is considerably more useful before the crisis than during it.

Finally, the people working across the airport must be part of the resilience capability. Employees and contractors often notice unusual behaviour, emerging problems or changes in the operating environment before they appear in formal reports. But that knowledge is only useful when people understand what to report and trust that somebody will listen. A strong security culture is therefore not an additional initiative alongside resilience; it is one of the things that makes resilience work.

We have discussed that wider relationship between listening, trust and early warning in our article When Your Best People Leave Before They Resign. The context is different, but the underlying leadership lesson is closely related.

How can leaders tell whether the organisation is ready?

A useful starting point is to ask the executive team how it would respond during the first half-hour of a situation affecting several airport functions. Who builds the common picture? Who decides which critical activities take priority? When are public authorities brought in, and who takes responsibility for communication with employees, passengers and partners? If those answers differ significantly around the table, there is work to do.

The same applies to exercises and follow-up. It is not enough to know that an exercise has taken place. Leaders should be able to explain what it revealed, what was changed as a result and who is responsible for carrying those changes through. An airport does not become resilient through documentation alone; it becomes more resilient when new understanding changes everyday practice.

Where public authorities can make the difference

Airport operators have a clear responsibility for the safety, security and continuity of their operations, but they cannot meet every challenge on their own. Hybrid threats can involve capabilities, information and legal powers that sit with the state. That is especially important when the threat has a strategic or state-level dimension.

The first contribution authorities can make is to provide threat information in a form airports can actually use. General warnings have value, but operational decisions are easier when information is timely, sufficiently specific and shared through established, trusted channels. This requires regular dialogue in both directions: authorities need to understand airport operations just as airports need to understand the developing threat picture.

The second is clarity about responsibilities and escalation. Airport operators cannot be expected to assume powers or capabilities they do not possess. Where a situation requires intervention by the police, defence or another competent authority, the thresholds and procedures should be agreed before an incident occurs. The same principle applies to the division of responsibilities for detecting and responding to drone activity, including actions that only public authorities are empowered to take.

Regulation also needs to reflect the way airports actually function. Aviation is already subject to extensive security and safety requirements, alongside wider frameworks for cyber security and critical infrastructure resilience. New expectations should be proportionate, compatible with those existing obligations and coordinated between the relevant authorities. Having to report the same event through several disconnected channels adds work at precisely the wrong moment.

There is also a legitimate question of funding. Some resilience measures are part of an airport operator’s normal responsibilities; others address threats and consequences that extend well beyond the airport and serve a wider societal interest. Clearer expectations about capabilities, state support and cost-sharing would help airports plan sensibly, particularly smaller and medium-sized operators. Organisational improvements do not always require major investment, but the wider resilience challenge cannot be solved without resources.

Finally, authorities and airports need to exercise together. Joint exercises establish working relationships, expose differences in assumptions and make the division of responsibilities more practical. In a real event, there is rarely time to begin building that understanding from scratch.

A shared responsibility, grounded in operational reality

There is encouraging experience to build on. Airports across Europe have invested in security, cyber capabilities, contingency planning and closer cooperation with external partners. The problem is not an absence of effort. It is that development has taken place at different speeds, with different levels of support and often without a sufficiently common approach across the wider system.

For airport leaders, the priority is to connect what already exists, make responsibilities clear and practise making decisions when the situation is ambiguous. For authorities, it is to provide information, intervention arrangements and policy frameworks that enable airports to meet those responsibilities. Neither side can deliver meaningful resilience in isolation.

At Copenhagen Security Excellence, our work focuses on that practical connection between strategy and daily operations: helping leadership teams clarify governance, examine critical dependencies and test how their organisations make decisions under pressure. We do not supply security personnel or technology. Our contribution is independent operational and leadership experience, applied to the particular circumstances of each airport.

Ultimately, the question is not whether an airport has a plan for every possible threat. No organisation can. It is whether the people responsible for the airport know how to work together, what must be protected first and when they need help from others. That is where meaningful resilience begins.