The core weakness of scenario-bound safety management is not that scenarios are useless. Scenarios are indispensable for hazard identification, training, and regulatory assurance. The weakness is that scenario catalogues can create a false sense of completeness when the next disruption is unfamiliar or when multiple familiar hazards combine in unfamiliar ways. Glette-Iversen and Aven’s synthesis of black swans, grey swans, dragon kings, and perfect storms shows why definitional precision matters: predictability and knowledge differ across events, and the same event can be surprising for one actor but not another [1].

Critical-infrastructure resilience research makes the same point in practical terms. Mentges et al. define resilience as the ability of a system to deal with impacts of unspecific and possibly unforeseen disruptive events, and emphasize that resilience terminology varies widely unless bounded by context [2]. The relevance for aviation lies in the aviation business, which relies on closely integrated infrastructures of the aircraft, airport, air traffic management, digital notification networks, crew management, passenger traffic, fuel supply, and external emergency services. One disruption can lead to another subsystem for which a full diagnosis may be unavailable.

Resilience engineering moves attention away from the prediction of all hazards to the capabilities that enable work to continue safely in the face of uncertainty. The systematic survey of the resilience engineering indicators identified a few indicators that appear in all high-risk industries, such as awareness, learning, flexibility, and top-management commitment [3]. These indicators are supported by evidence that is directly relevant to aviation SMS audits, such as drill records, decision logs, communication redundancy, and implementation of lessons learnt, and not only making a generic “we are ready” statement.

A second implication arises out of research on resilience training. Resilience should not be thought of as a general psychological trait, but rather as a situational capability, training critical-situation management should focus on that capability, as was found by Ketelaars et al. [4]. In a zero-day aviation emergency, this equates to an emergency drill where leadership is transferred, where teams establish a common operating picture, and by which mutual aid is called when there is insufficient time to comply with normal escalation protocols. Roud’s research on collective improvisation in emergency response also points to a connection between joint training, organizational memory, interorganizational trust, communication, and information sharing and improvisational capability [7].

While aviation is often described as being ‘procedurally mature’, maturity can sometimes make things brittle when there are differences between work-as-imagined and work-as-done. Steen et al. suggest that what adaptive capacity encompasses for pilots and safety organizations can differ, and this capability may be both a friend and a foe at the same time [5]. The implication for the present study is not that rules should be relaxed. Disciplined deviation must be planned, practiced, and tested in advance of the emergency, so that deviation will not be ad hoc, but in an emergency, there must be a safety intention.

A related issue is for air traffic management. Mezentseva et al. conceptualize mindful organizing as a collective ability to predict, identify, and manage existing issues and challenges, and bounce back from them, considering safety climate as mediator of the relationship between empowering leadership and mindful organizing [6]. To be ready for a zero-day, technical systems therefore must be in place, but so also must organizational conditions—teams should not be left in a vacuum, they should have authority to act on incomplete information and be held accountable in terms of the procedures they follow.

Recent aviation-disruption literature illustrates the domain breadth. COVID-19 literature reports an aviation shock that was thought to be historic in size and produced a substantial number of policy and operational research documents [8]. Network analyses of the pandemic indicate that aviation networks can lose demand while maintaining connectivity and that robust networks can come at a price in terms of efficiency and environmental impacts [9][10]. The research areas of aviation cybersecurity focus on the growing dependence of aviation on digital technologies, regulatory requirements, threat detection, training for users, plans for incident response, and secure cyber-physical interactions [11][12].

Unlike several zero-day events, not all aviation-impacting events are aviation-originating events. Airport infrastructure relies on interdependent critical infrastructure, including power systems, telecom, fuel distribution, and physical and cyber strategies. Piekert et al. report that adversarial activities in connected infrastructure can also result in impacts to the operation of the airport and that “early awareness” and collaboration in an airport operations center are still research needs to be addressed [13].

The common operating picture (COP) is the real-life link between ambiguous signals and joint action. Recent disaster-management research defines a COP as a shared display of information that improves situational awareness, decision-making, and coordination among stakeholders, and illustrates how digital twins can support a COP during response [14]. For aviation, the COP need not be a complex digital twin at first implementation; the audit question is whether critical feeds can be fused fast enough to support safe cross-functional decisions.

The literature supports a structured yet flexible model of scenario-independent readiness. Epistemic uncertainty requires explicit classification of what is known, what is partially known, and what is unmodeled [1]. Resilience engineering requires measurable indicators of awareness, learning, flexibility, and commitment [3]. Aviation research requires sensitivity to the tensions between compliance and adaptive work [5]. Emergency-response research shows that improvisation improves when it is trained, trusted, and connected across organizations [7]. Together, these ideas motivate Scenario-Independent Readiness (SIR): a capability set that is independent of any one hazard but auditable within existing SMS routines.

SIR is built around three capabilities. First, authority migration: the practiced ability to move decision rights to the person or team closest to the most reliable information while preserving accountability. Second, COP formation: the ability to assemble a shared, time-stamped operational picture quickly enough to guide safe decisions. Third, boundary-spanning mutual aid: the ability to activate pre-negotiated resources across airports, airlines, air navigation service providers, fuel suppliers, and public agencies without renegotiating roles during the incident.

A qualitative multiple-case design was employed to investigate the processes by which aviation organisations prepare themselves and react in the event of disruption beyond the scope of what had been previously thought possible through their scenarios. This design is suitable because zero-day emergency response is context-dependent, multi-actor, and not easily ethically or practically reproduced in experimental form. The design was reinforced by transparent case-selection criteria, consistent coding rules, and conservative interpretation of descriptive statistics. Case-study rigor was sought via construct clarity, triangulation of public documentation, and through a documented audit trail, consistent with recent guidance of methodological rigor to enhance validity and reliability of case-study research [15]. The analysis is secondary-data based. No primary interview evidence is employed as the available evidence package has no verifiable interview transcript, nor any interview protocol, ethics approvals, or participant documentation. All claims thus covered are, therefore, restricted to structured secondary evidence and public documentation.

Ten incidents were selected because they had direct implications for aviation operations, involved a period of at least 12 hours, caused losses of more than USD 100 million, or were said at the time to be unprecedented or unusually disruptive to the aviation organizations involved. The sample was intentionally selected for maximum variation and not for statistical representativeness, including terrorism, natural hazard, technological disaster, aircraft-accident response, unexplained loss, pandemic onset, software failure, cyber-logistics disruption, mechanical failure, and extreme weather. Appendix A identifies the organizational unit assessed in each disruption and shows how each case met the inclusion criteria.

Prior-modeling status was coded from publicly accessible pre-event artifacts. “Not evidenced in the reviewed record” was assigned when the retained public record contained no hazard-specific scenario, SOP, or regulator- or operator-led drill from the preceding 24 months; it does not prove organizational absence. “Partially modeled” required a similar hazard in risk registers or tabletop materials but no evidence that critical scale, duration, cascading, or interdependency parameters had been exercised. “Fully modeled” required an explicit scenario, relevant SOPs, and a documented exercise or activation within the preceding 24 months. This evidence-bounded definition distinguishes zero-day from partially expected hazards while preserving uncertainty about inaccessible records.

Evidence included a structured secondary data source consisting of official after-action reports, public regulatory documents, aviation-sector summaries, accident/incident documentation, public operational reports, and congressional or governmental records where applicable. The retained record included the 9/11 Commission, NTSB, FAA and U.S. Department of Transportation, EUROCONTROL, ICAO and ATSB, WHO and CDC, IAEA and Japanese government records, and CISA and FBI materials. Searches combined the incident name and year with aviation, after-action, emergency plan, exercise, SOP, regulator, operator, disruption, and response. Proprietary, internal, paywalled, or inaccessible documents were not treated as absent. Each case was represented by standardized fields covering event type, location, prior-modeling evidence, response gaps, consequences, and post-event improvements.

Open coding was conducted on qualitative fields to assess gaps in response and improvements post-event. The retained materials do not identify the number or composition of independently double-coded cases or text units, the full codes included in the calculation, a coder-by-code agreement table, or how disagreements were reconciled. Cohen’s kappa = 0.84 therefore cannot be independently assessed or replicated and is not retained as a reliability result. In qualitative research, intercoder reliability is a debated but useful transparency device for checking coding consistency [16]. A future replication should register its coding unit, double-code all cases or a named subset, report the full agreement table and code prevalence, and document reconciliation before calculating kappa.

The original preparedness ratings were intentionally coarse. “Low” indicated that relevant plans, exercises, and cross-functional coordination evidence were absent or weak. “Moderate” indicated some prior exercise, scenario coverage, or mobilization pathway that could be adapted during response. No case was rated “High” because the dataset did not include independent regulator-certified readiness scores or sufficient internal evidence to support a high-confidence rating. Because those indicators overlap with prior-modeling evidence, the ratings are not retained in the current analysis and no comparison between the two constructs is reported. Table 1 summarizes the rubric used to classify prior-modeling evidence.

Table 1. Coding rubric for prior-modeling evidence.

Note. The rubric was applied before outcome interpretation to reduce hindsight bias. Categories are deliberately coarse because the evidence base is secondary and varies by case.

Descriptive statistics were calculated from the structured fields. Prior-modeling coverage was reported as the percentage of cases classified as not evidenced in the reviewed record, partially modeled, and fully modeled. Response gaps were calculated at the case level. Outcome severity was summarized by deaths directly caused by the aviation-relevant incident, by minimum direct economic loss in 2024 USD when available, and by passenger delay hours. Some losses are censored with greater-than signs, and the sample is small, which means that the ratios are only descriptive signals and not inferential estimates.

Efforts to ensure that case-by-case coding notes would be utilized, exclusion of unsupported primary interview claims, avoidance of post hoc reclassification by the coder, and trustworthiness of a set classification rubric. In this case, no third-party adapted figures are included, and the argument is advanced by use of original tables and text, thus avoiding reliance on third-party copyright in the artwork that can be included in the editable submission package.

Table 2 profiles the ten incidents. Hazard-specific planning was not evidenced in the reviewed record for five cases; two cases were partially modeled and three were fully modeled. This distribution shows that model-breaking conditions were not confined to one threat family. The five ‘not evidenced’ cases involved terrorism, radiation fallout, unexplained aircraft loss, pandemic onset, and cyber-logistics disruption. Partially modeled cases involved volcanic ash and a national NOTAM software outage. Fully modeled cases involved aircraft-accident response, mechanical-failure response, and extreme winter-weather operations. These labels describe available public evidence rather than the total contents of organizational records.

Table 2. Case profile, prior-modeling evidence, and severity indicators.

Note: *Fatalities directly attributable to the aviation-relevant incident. ^†Lower-bound 2024 USD where estimates were reported as greater-than values. ^‡Passenger-delay hours are retained from the structured dataset and should be read descriptively.

Preparedness was not retained as a separate rating because it overlapped with prior-modeling evidence. Table 3 reports lower-bound mean losses and mean delay hours by prior-modeling group while explicitly noting censored values and outliers. Cases for which planning was not evidenced in the reviewed record include the September 11 and COVID-19 onset phases; their five-case lower-bound total is USD 60.88B and mean is USD 12.18B. Delay-hour patterns are not monotonic, and some cases were more consequential for safety or uncertainty without producing the largest measured delay burden. These are descriptive severity patterns, not preparedness comparisons.

However, the principal result is not an accurate loss multiplier. The defensible finding was that cases classified in the original dataset as unmodeled—reported here as “not evidenced in the reviewed record”—included the worst lower-bound tail results and revealed similar organizational deficiencies. This pattern is descriptive, not causal or inferential. The analysis encourages analytic generalization: model coverage can be useful but not enough, so adaptive capacity should be audited directly.

Table 3. Prior-modeling evidence and descriptive severity metrics.

Note: *Lower-bound mean uses USD 40B for September 11 and USD 0.28B for MH370, although the dataset marks both as greater-than values. Values are descriptive and not inferential.

Four themes for gaps in response were commonalities among all cases: lack of real-time situational awareness, fixed command structures, one-point logistical response, and slow interagency coordination. There was a situational-awareness gap in eight of 10 cases; command rigidity in seven; logistical dependency in six; and interagency friction in five. These gaps frequently occur together and align with the SIR focus on COP latency, authority migration, and mutual aid.

The gap profile also shows why scenario-independent readiness is not simply a technology problem. Action is not taken from a dashboard without having decision rights, resources cannot be mobilized from a mutual aid agreement lacking current contacts and exercises, and a trained leader cannot improvise the entire operation without a shared picture of the operating situation. Thus, the evidence suggests that readiness is a sociotechnical capability integrating people, organizations, information, and material resources. Table 4 summarizes the recurrent response gaps and their SIR interpretations.

Table 4. Recurrent response gaps and SIR interpretation.

The cross-case synthesis generated three SIR indicators as capability targets for audit and future testing; it did not test whether anchor presence was associated with lower case-level impact. The first is authority-migration readiness, evidenced by semi-annual drills in which decision rights are explicitly transferred under ambiguous conditions and assessed through decision-latency and hand-off records. The second is COP spin-up capability, evidenced by a time-stamped dashboard or manual fusion process that can assemble minimum viable situational awareness within 60 minutes of incident onset. The third is mutual-aid activation, evidenced by pre-signed agreements that can move gates, staff, fuel, equipment, data, or public-agency support within two hours of request.

The indicators are intentionally audit-ready. They can be checked by reviewing drill logs, decision records, dashboard timestamps, exercise injects, mutual-aid memoranda, and after-action implementation evidence. They are not presented as universal thresholds validated for every airport or airline size. They are proposed as initial benchmarks for pilot audits and simulation-based refinement. Table 5 presents the audit-ready SIR checklist for SMS integration.

Table 5. Scenario-independent readiness checklist for SMS integration.

The findings align with safety-science work that treats safety as an interaction among technical, organizational, and human systems rather than a property of isolated components. The results do not imply that scenario-specific planning should be reduced. Instead, they show why scenario-specific planning should be paired with scenario-independent capability testing. A model can identify known hazards, but it cannot guarantee readiness for unknown coupling, unfamiliar scale, or time pressure.

This contribution is distinct from a conventional aviation disruption catalogue. The unit of analysis is not the hazard type but the named organization’s ability to adapt safely when the hazard type is not sufficient for decision-making. Appendix A distinguishes sector-wide shocks from airline-, airport-, and ANSP-specific responses. By using pre-event artifacts to classify prior-modeling evidence, the analysis avoids a common hindsight problem: treating post-event explanations as if they were available before the event. This improves conceptual clarity around not-evidenced, partially modeled, and fully modeled conditions.

The study also addresses the compliance-adaptation dichotomy, which can be seen in the recent studies of the capacity of aviation to react to various threats [5]. SIR does not demand improvisation on operators’ part when it comes to safety governance. It seeks to have them seek regulations and controls for improvisation, to enact bounded authority migration, to time-stamp sense-making, and to pre-negotiate boundary crossing. This is what a structured flexibility actually translates to.

Changing SIR to auditable evidence is a priority for an airline or airport. Existing SOPs should be supplemented with exercises incorporating ambiguous injects that do not reward unsafe freelancing. The goal is to see if decision rights can flow quickly while maintaining transparency about who acts, what evidence supports the action, how alternatives are considered, and how safety risk is reduced.

Perhaps the most direct improvement for integrated operations centers is a minimum level of a COP. Operators can begin with a simple data-fusion checklist and then move on to purchase more advanced platforms. Aircraft and passenger positions, legality restrictions for the crew, fuel, gate, necessary NOTAMs, weather and infrastructure limitations, public-agency contacts, and a feed confidence rating should be included in the required first-hour view. A degraded COP should be available, as cyber/network disruption may compromise the systems that are supposed to assist the response. SIR provides an additional tool for air navigation service providers and regulators in conjunction with the current SMS audits. Auditors can ask if an emergency plan exists or when authority-migration was last exercised, how long COP formation took, whether or not mutual-aid was tested, and what corrective actions were closed after the last cross-organizational drill.

Cyber-physical and/or linked-infrastructure disruption is becoming a major concern for the aviation industry. Aviation cybersecurity efforts also cite regulatory compliance, threat detection, user training, incident response planning, encryption, and protecting integrated aviation systems as some of the fundamental priorities [11][12]. The utility failure incidents represented in this dataset highlight the need to consider cyber and software incidents as operational safety issues rather than merely information-security issues.

Other independent infrastructure research bears this out. Airports rely on external systems that might be one of the first to experience complications or issues before impacting an airport’s operations center [13]. As a result, SIR includes mutual-aid arrangements and contact trees from external partners next to the internal dashboards. Without the ability to access timely information or resources from all partners involved in the COP, such as fuel, power, telecommunications, law enforcement, public health, and emergency management, a technically sophisticated COP is incomplete. A recent example of this is the 2024 global IT outage caused by a software failure, which reignited the urgency for planning for the unexpected in this area across vital infrastructures [17]. While this event is not included within the 2001-2024 case sample upon which this study was based, this event reinforces the relevance of a cross-infrastructure capability approach to scenario-independent readiness.

There are four limitations of the study. First, the 10-case sample is too small for analytic generalization to be used for estimating population-level probabilities or causal effects. Second, public records do not reveal all proprietary or internal planning evidence, and the retained audit trail lacks the double-coding details needed to assess or replicate the previously reported kappa. Third, consequence data in some cases vary, and greater-than values are censored. Fourth, there may be adaptations and workarounds that are informal and not documented in secondary sources. The strength of the study is in the transparency of the cross-case patterning and in an audit framework that can then be tested, rather than in accurate quantitative prediction.

Further research is needed to simulate, exercise, and independently audit scenario-independent readiness thresholds in airport settings. Agent-based and system-dynamics models could be used to vary common operating picture latency, the speed at which authority migrates during disruption, and the density of mutual-aid resources in order to identify nonlinear breakpoints in airport emergency response. Field studies could also examine how learning effects improve readiness while guarding against the unsafe normalization of deviation. Comparative studies across other safety-critical sectors, including maritime systems, rail systems, emergency medical services, and energy systems, could help assess whether the proposed thresholds are specific to aviation or broadly applicable across critical infrastructures. For air transport management scholarship and practice, the central contribution is the practical value of scenario-independent readiness as a management lens for airports, airlines, regulators, and emergency-planning stakeholders facing disruptions that fall outside existing scenario catalogues.