The evolving risk landscape at airports

Since the earliest days of commercial aviation, airports have been a prime target for those seeking to cause damage, death and terror. Tragedies such as the 1988 bombing of Pan Am Flight 103 over Lockerbie spurred stricter regulation on cargo and passenger screening. The 9/11 attacks resulted in the introduction of fortified cockpit doors, sharp items banned from carry-on luggage, 100% checked bag screening and the creation of the Transportation Security Administration (TSA). In 2006, the foiled transatlantic liquid explosives plot led to the restriction on liquids, aerosols and gels in carry-on baggage.

With the advancement of technology, the development of global politics, macro-economic issues and social change, this has brought forth new security threats, which evolve daily and challenge airports.

Recent security incidents

Stowaways

On 8 January 2025, at Nikola Tesla Airport in Belgrade, a woman crawled under the automated passport gate to bypass security, managing to board a flight without a ticket or a passport. In August 2024, a Norwegian man confounded German authorities when he managed to sneak onto not one, but two flights without a ticket. The man boarded a flight at Munich Airport Terminal 2, supposedly tailgating a passenger through the automated ticket checks. The only reason he was discovered was that the flight was full and there was therefore no seat for him. He was handed over to the police but was later released. Not discouraged by his foiled first attempt, he returned the next day and boarded a flight to Stockholm and made it to his destination this time, however, was intercepted in the capital city. 

Incidents like these not only cause major disruption to passengers and airlines, they are also lucky escapes that could have been a lot worse.

On 24 December 2024, a body was discovered in the wheel well of a United Airlines aircraft that had landed in Maui from Chicago. The discovery was made during standard post-flight inspections. The wheel well is only accessible from outside the aircraft, which means the person gained access to the restricted area and managed to climb into the wheel well undetected.

While it is difficult to say whether stowaways on aircraft are on the rise, there have been several high-profile incidents recently, which has raised questions about aviation security. It can also be said that as complex humanitarian crises and conflicts develop around the world, the aviation world could see a rise in this type of security challenge in the future.

Stowaways in the instances above exploited inadequate security fences and automated security gates. These aviation security incidents highlight vulnerabilities in the security system.

Runway incursions

In January 2025, a woman in a vehicle entered a construction site and drove through a guarded – but open – gate, ignoring multiple warnings and nearly reached the runway at Appleton International Airport.

Climate activism is also on the rise, with German airports seemingly at the epicentre of this trend, having seen multiple co-ordinated incidents at major airports including Munich, Berlin Brandenburg, Stuttgart, Cologne-Bonn and Nuremberg in 2023 and 2024. Munich Airport was the focus of the media in May 2024 when six climate activists glued themselves to the runway, leading to 60 flight cancellations. According to ABC News, the activists broke through a security fence before entering the runway. Similarly, at Frankfurt Airport, activists cut through a wire mesh fence according to Reuters. There have been calls, especially from German politicians, to implement prison sentences of up to two years for unauthorised airfield access and a stern word to airports to wise-up on protecting their properties from unlawful intrusion.

Imposters

On 6 March 2025, a 17-year-old boy masquerading as airport ground crew by wearing cargo trousers, a high-vis jacket and tool belt breached a security fence at Avalon Airport and boarded a Jetstar plane bound for Sydney pretending that he was going to do maintenance on the aircraft. The boy, who had a loaded shotgun and knives in his tool belt, reportedly told passengers that he had bombs in his bag, and was apprehended by the Pilot and a passenger until police arrived. Again, the boy gained access through a hole in a security fence.

This was a frightening event for passengers and staff and revealed the ease at which potential trespassers can exploit surveillance blind spots and low-quality fencing to potentially gain access at some airports.

Mental health crises

In November 2023, Hamburg Airport was closed for several hours with an 18-hour-long stand-off after an armed man forcefully breached security gates and drove onto the apron and parked under an airplane, which was full of passengers. The man, who drove through the security barrier at speed, had reportedly taken his daughter hostage and shot his weapon twice in the air and threw burning bottles from the vehicle. The police engaged with the man through a negotiator and following the incident, the authorities said the man had been in an “exceptional psychological situation due to custody disputes with his ex-wife,” according to the BBC.

According to Project Hope, mental health issues are rising globally and over two-thirds of people with mental health conditions don’t receive treatment. Half of the global population will experience a mental health disorder in their lifetime, according to a study by Harvard Medical School and the University of Queensland.

While there may have been no specific link as to why the situation above played out at Hamburg Airport, the fact that airports can be stressful environments, combined with the above statistics, should be noted by airports. Airports may include training specifically geared towards dealing with mental health crises for their employees.

Suspicious packages

International Airport Review reported on the London Gatwick security incident in November 2024 when the UK’s second busiest airport had to evacuate its southern terminal after a ‘suspect package’ was found in luggage.

An explosive disposal team was sent in as a ‘precaution’, with flights to and from being cancelled or delayed, with rail services to the airport also suspended. 

A London Gatwick spokesperson said: “Working closely with Sussex Police, we were able to swiftly address the situation. Evacuating the terminal is not a decision we take lightly, but the safety and security of staff and passengers is always our top priority.”

Two people were detained for enquiries but were released.

How have these recent breaches been allowed to occur? And what vulnerabilities do they expose in airports?

We sought the views of three security experts in the field, who spoke exclusively to International Airport Review.

Patrick Cuschieri, Aviation Security Consultant, Qatar Civil Aviation Authority, said that these events “expose critical lapses in perimeter control, identity verification and staff oversight. These incidents reveal that while technology has advanced, basic security protocols and human factors remain vulnerable points. Airports must reassess ground-level access and close co-ordination gaps to prevent future incidents.”

Dvir Rubinshtein, Aviation Security Division Manager of the Ministry of Transport in Israel, commented: “The vulnerabilities that were exposed during the recent events are connected to security procedures and protocols that were not updated with regards to the new challenges that airports struggle with. In addition, authorities do not follow their own security protocols and required procedures.”

Drones

The airport industry will never forget the famous incident which occurred in 2018 and saw London Gatwick Airport thrown into chaos after multiple drone sightings. The airport shut down its runway for 33 hours across three days and saw more than 1,000 flights cancelled and 150,000 passengers affected. The incident cost airlines around £50m in lost revenue and passenger care costs according to The Independent.

While nobody was ever arrested for the Gatwick drone incursions, it was decided that it was a serious and deliberate criminal act that was intended to cause danger to the airport’s operations.

Drones have continued to cause a security risk – and a nuisance to airports and passengers. Since 2018, there have been numerous airport closures in Dubai International Airport (February 2019) Madrid-Barajas Airport (February 2020), Dublin Ireland – which closed a whopping six times in the first eight weeks of 2023 – and Stockholm Arlanda (September 2024).

Insider threat

Despite the Gatwick drone mystery never being solved, Chris Woodroofe, then Chief Operating Officer (COO) of the airport, told BBC’s Panorama: “It was clear that the drone operators had a link into what was going on at the airport.”

The COO also went on to say that the drone pilot could either see what was happening on the runway, or was able to follow the airport’s actions by eavesdropping on radio or internet communications. Plus, whoever was responsible had also selected a drone that could not be seen by the DJI Aeroscope drone detection system that Gatwick was testing at the time.

On this topic, Dvir Rubinshtein, told IAR: “The most pressing challenge for airport security these days, is the human factor. On one hand, we need to pay attention to the insider threat from our own manpower such as airlines, airports employees and service providers. On the other hand, the quality and the professional level of our aviation security manpower.”

While there is no single solution to insider threat, airports can significantly reduce the risk by taking a multi-layered, holistic approach that combines robust vetting and background checks on employees, restricting access control using biometrics, multi-factor authentication and employing “need-to-access” basis, behavioural detection and monitoring, staff reporting and whistleblowing systems, random screening and CCTV audits. Also, taking care of the mental health and wellbeing of their staff, as disgruntlement, blackmail, mental health issues or financial pressure are common causes of insider threat.

As an airport, your people are your greatest asset, and they are who you will need to rely on in a crisis. Speaking exclusively to IAR, Neville Hay, Head of Aviation Security Advisory, Strategy, Partnerships and Director of Training for INTERPORTPOLICE, said: “Developing a positive organisational culture is vital for driving progress and fostering collaboration across all levels of the workforce. Investment in human-centric strategies is essential to address vulnerabilities stemming from challenges such as leadership gaps, retention issues and recruitment difficulties. To propel growth and enhance operational resilience, airports must prioritise attracting innovative talent while also investing in structured career pathways, apprenticeships, mentorship programmes and strategic resource planning. Recognising employees as the organisation’s most valuable asset is fundamental. Ensuring roles such as security are professionalised with competitive remuneration aligned to that of policing is key.”

Weapons

The Transportation Security Administration (TSA) in the United States recently reported that it intercepted a total of 6,678 firearms at its airport security checkpoints in 2024, a minor decrease from the 6,737 detected in 2023. Approximately 94% of these firearms were loaded according to the TSA. However, “one firearm at a checkpoint is too many,” said TSA Administrator David Pekoske. “Firearms present a safety risk for our employees and everyone else at the checkpoint. It’s also costly and slows down operations. If individuals who carry a firearm intend to travel, we remind them that the firearm must be unloaded, locked in a hard-sided case, declared to the airline at the check-in counter and transported in checked baggage.”

In April 2025, a passenger at Chicago O’Hare International Airport was arrested after running into the sterile area with a gun. The gun was in the passenger’s hand luggage, which was detected by the TSA when it was scanned by the X-ray checkpoint. As per the TSA policy, the bag was kept inside the tunnel, but the passenger reached in and retrieved the bag. Luckily, no injuries were reported, but it raises questions about how X-ray machines are designed. Passengers should not be able to reach easily inside and retrieve their bag. Airports should consider installing panels that prevent passengers from doing so.

Cyber-security

With the rise of ‘hacktivists’, and big game hunting (BGH), airports, airlines, operating authorities and the air traffic control system are prime targets for cyber-attacks as key national infrastructure, as well as being treasure chests of sensitive data such as passenger information and financial records et cetera.

According to CrowdStrike’s 2024 edition of their Global Threat Report, the speed and ferocity of cyber-attacks continues to accelerate, and with the rise of generative AI it has ‘the potential to lower the barrier of entry for low-skilled adversaries, making it easier to launch attacks that are more sophisticated and state-of-the-art’. The report goes on to say, ‘We are entering an era of a cyber arms race where AI will amplify the impact for both the security professional and the adversary. Organisations cannot afford to fall behind, and the legacy technology of yesterday is no match for the speed and sophistication of the modern adversary’.

According to SecurityScorecard, the aviation sector scores an average of ‘B’ on cyber-security. While not a failing grade, organisations with a B rating are 2.9 times more likely to be victims of data breaches than those with an A rating, according to SecurityScorecard. The report continues to say that ransomware is a top threat and highlights the vulnerability of aviation-specific software and IT vendors, which ‘pose substantial third-party risks for their airline customers’.

Kuala Lumpur International Airport discovered it was a victim of a cyber-attack in March this year. The cyber-attack provoked computer outages resulting in hours of disruption. Flight information display systems, check-in counters and such were affected. The ransom demand of $10 million was refused.

Even the International Civil Aviation Organization (ICAO) confirmed in January this year that it was investigating an information security incident involving the release of around 42,000 recruitment application data records by a threat actor called Natohub, which is known for targeting international organisations.

Others such as Seattle-Tacoma International Airport, Japan Airlines and Querétaro International Airport have also been recent victims of ransomware gangs that have damaged their systems.

According to a recent report from the Foundation for Defense of Democracies, a number of systems in the U.S. aviation system are ‘alarmingly outdated’ and vulnerable to critical failures, as well as attack. The report cites ‘fragmented oversight, insufficient investment in cyber-security and modernisation, and an under-resourced workforce’ as the main barriers.

Conclusion

The recent wave of security incidents, from stowaways and runway incursions to insider threats and cyber-attacks, paints a sobering picture of the evolving risk landscape at airports. These incidents underscore that while technology plays a critical role in aviation security, human factors, procedural gaps and outdated infrastructure remain significant vulnerabilities. As threats become more diverse and sophisticated, the aviation industry must respond with a multi-layered, adaptive approach—strengthening not only its systems and defences, but also its culture, workforce and resilience.

Make sure you stay tuned for part 2 published this week, which explores how the industry is leveraging new technologies to improve threat detection and response, and what can be learned from incidents like these.