The disruption at Heathrow Airport on March 21st, 2025, served as a stark reminder of the vulnerabilities within even the most well-prepared infrastructure systems. While the full root cause analysis is not yet publicly available, early reflections offer valuable insights into the broader resilience landscape and the practical lessons that can be drawn for the resilience profession.
Resilience Forward spoke to Aston Business School, Aston University based crisis and disaster management expert, Dr. Komal Raj Aryal to discuss the lessons that he believes can be learned from the incident.
A high-impact, low-frequency wake-up call
The Heathrow incident – marked by a serious systems failure that grounded flights and caused operational paralysis – was a textbook case of a high-impact, low-frequency event. These types of incidents, although rare, are profoundly disruptive.
“Business continuity and emergency planners often don’t give high-impact, low-frequency events enough weight. They’re easy to overlook or discount until they happen – and by then, it’s too late,” said Dr. Aryal. “Planners are within their rights to decide that such incidents are too improbable to plan for, but this must be a considered decision, not simply an omission.”
While Heathrow had measures in place, including backup power, the incident underscored how system redundancies can still fall short when an event deviates from standard scenarios. Business continuity planning conventionally focuses on impacts rather than causes, but if the impacts that are planned for are too small scale, then response and recovery plans will inevitably fail in high-impact, low-frequency events.
Resilience is not just compliance
A key takeaway from the incident is the difference between regulatory compliance and genuine resilience. Heathrow, like many large critical infrastructure organizations, adheres to risk register protocols, mandatory drills, and emergency plans. But as Dr. Aryal emphasized, “This wasn’t a regulatory failure – it was a planning problem. ” The implication is clear: ticking the boxes on compliance does not equate to readiness.
True resilience requires a mindset that goes beyond minimum standards. It involves continuous, dynamic assessment of risks – including those that may not have historical precedent. The Heathrow failure teaches us that business continuity and emergency planning must evolve alongside the complexity of our systems and environments.
The importance of local intelligence and contextual awareness
One of the more intriguing aspects of the interview with Dr. Aryal was a discussion of localised risks observed by councils such as the London Borough of Hillingdon (within which Heathrow airport is situated) but which may not make it into organizational risk registers. Copper theft from infrastructure, is an example here. While seemingly minor or isolated, these incidents form part of a broader ecosystem of vulnerability.
Dr. Aryal shared experiences from previous risk mapping exercises around Heathrow, including collaboration with emergency planning officers:
“We identified hazard intelligence in and around the local authority area – things that might not be on the national radar but are critically relevant locally,” he explained.
This illustrates the need for resilience practitioners to engage with local authorities and community-level intelligence. No organization is an island and the community within which it operates needs to be considered during planning. Community-specific risks need to be understood and planned for. National frameworks are essential, but they must be complemented with ground-level insights.
The illusion of backup systems
Another key learning from the incident is that having a backup doesn’t guarantee operational resilience or business continuity. Heathrow had recovery capabilities but these failed to prevent disruption.
“Many things were in place,” Dr. Aryal noted, “but by the end of the day, it wasn’t enough.” This serves as a caution against over-reliance on single points of redundancy. A backup that mirrors the primary system’s vulnerabilities isn’t really a backup – it’s a duplicate waiting to fail in the same way.
Diversity in resilience planning – both in technology and strategy – is essential. Alternative systems must be tested not just for functionality but also for resilience under abnormal conditions.
A call for planning to consider worst-case scenarios
One of the recurring themes in Dr. Aryal’s commentary was the need for planning that addresses worst-case, non-linear scenarios. “This kind of event shows us that we need to think beyond the usual impacts,” he said. “Unusual incidents can result in unexpected impacts and as a result business continuity and emergency plans may be fundamentally inadequate unless high-impact low-frequency events are considered during the planning process,”
Scenario-based planning that explores unlikely but plausible events enables organizations to stretch-test their assumptions. It’s not about predicting the future perfectly – it’s about being less surprised by it.
Resilience professionals should push for planning exercises that are creative, extreme, and even uncomfortable. The Heathrow incident wasn’t about a predictable storm or a known cyberattack. It was about something unexpected happening at a system’s weak point – and it is here where the most valuable planning can happen.
Collaboration is critical
Another point raised in the interview is the benefit of informal, long-term collaboration. Dr. Aryal referenced his long-standing ties with people working in emergency planning and how informal relationships often make a critical difference during a crisis.
Professional resilience efforts should invest in building networks across organizational and sectoral lines. In times of disruption, formal structures may falter, but informal collaborations can provide the flexibility and trust needed for rapid, effective, assistance.
Looking forward: embedding resilience as a culture
Ultimately, the Heathrow incident reinforces that resilience must be embedded into the culture of an organization – not just its compliance processes. From frontline staff to executive leadership, everyone must understand the value of adaptability, awareness, and constant learning.
Dr. Aryal stressed this in his closing thoughts: “It’s not just about tools or policies. It’s about the mindset. You’ve got to keep learning from every incident – not just your own, but others’ as well.”
This culture shift means rethinking how organizations view resilience. It’s not a siloed function but a lens through which to view strategy, operations, and investment. It requires leadership commitment, cross-functional engagement, and a willingness to ask the hard ‘what if’ questions – even when the answers are uncomfortable.
Conclusion
The events of March 21st at Heathrow were a shock to the system – literally and figuratively. But they also present an invaluable opportunity for learning. For the resilience profession, the message is clear: it’s not enough to prepare for the expected. True resilience lies in preparing for the unexpected, by fostering a culture that’s proactive, locally informed, strategically diverse, and deeply collaborative.
The author
Dr. Komal Raj Aryal BSc(Env Science),MSc(DMSD),PhD,FHEA, is Lecturer in Crisis and Disaster Management and Module Lead: Global Risk and Resilience Management, at Aston University.
