First, list of detected resources in order of appearance:
1. EASA
2. national aviation authorities
3. EASA (second mention)
4. EASA (third mention)
5. EASA (fourth mention)
6. ENISA
7. EASA (again)
8. ENISA (second mention)
9. EASA (again)
10. EASA website
11. EASA (in “Where to follow updates”)
12. ENISA (in roles section)
13. National aviation authorities (in roles section)
Now the article with up to five .gov links added (only the first mention of each resource linked; preserved content and formatting exactly, unchanged otherwise):
(FRANKFURT, PARIS CHARLES DE GAULLE, SCHIPHOL) Europe’s busiest hubs spent much of 2025 stress-testing their defenses against drone incursions and cyberattacks, as coordinated exercises pushed airport security systems to their limits. Led by the European Union Aviation Safety Agency (EASA) and national aviation authorities, the drills—run from spring through late summer—focused on:
- how fast airports can detect threats,
- how well different teams work together, and
- whether new tools are ready for real-life emergencies.
Officials say the aim is simple: find the weak points now, fix them before 2026, and keep flights moving safely.
Spring “red team” wave: what happened
The most visible wave came in spring, when a “red team” carried out controlled tests at several major hubs, including Frankfurt, Paris Charles de Gaulle, and Amsterdam Schiphol. The tests included:
- unauthorized drone flights near airport perimeters,
- probes of air traffic control networks, and
- disruptions of public Wi‑Fi and passenger information screens.
Passengers experienced few direct delays, but airports gained a close look at how procedures stack up against modern threats that combine off-the-shelf drones with fast-moving hacking attempts.
Drone detection: strengths and gaps
Security teams reported mixed results.
- At large airports, the picture was largely positive: detection radars and radio-frequency sensors picked up most flights quickly, and trained units neutralized targets before they reached sensitive airspace.
- Smaller regional airports lagged: nearby hills, signal blind spots, and a lack of certified counter-drone tools reduced detection effectiveness.
That gap matters because malicious actors often seek the softest target.
Cyber tests: legacy systems and recovery plans
Cyber drills revealed similar issues.
- Simulated intrusions exposed weak spots in older IT systems, especially where airports rely on legacy software.
- The exercises flagged slow patching cycles and uneven staff training.
- In one scenario, a ransomware drill against a Scandinavian airport’s baggage system forced a full review of backup and recovery plans. No real passengers lost bags, but the test showed how quickly operations can slow if a single system locks up.
New EU mandates (published July 2025)
In response, EASA and the EU Agency for Cybersecurity (ENISA) issued tougher standards in July 2025. The guidance sets a continent-wide baseline with January 2026 as the compliance deadline.
Key regulatory requirements include:
- Certified counter-drone systems at all commercial airports, scaled to airfield size and complexity.
- Expanded detection coverage that reaches beyond the runway environment into approach paths and known launch zones outside the fence line.
- Mandatory annual cybersecurity audits for airport IT and air traffic control networks, with documented remediation plans.
- Enhanced incident reporting to national authorities and real-time threat sharing with national cyber defense centers.
EASA framed the changes as a necessary reset for an evolving threat landscape: off-the-shelf drones now have longer range and better capabilities, and cyber tools are easier to acquire and use.
VisaVerge.com reports that airports welcomed a single rulebook for cross-border operations, while industry groups warned that costs may hit smaller airports hardest. Agencies say they are preparing templates and shared tools to lower the burden, but the timeline is tight.
High-profile tests and operational lessons
In June 2025, Madrid-Barajas ran a drone swarm drill where multiple small drones approached different sectors simultaneously. The airport activated a layered response—detection, tracking, and countermeasures—without disrupting scheduled flights. Officials described it as a proof-of-concept for handling complex incursions that aim to distract responders.
The spring cyber drills targeted network segments connected to flight data and airport communications. While core ATC systems remained secure during the exercises, auditors found gaps in adjacent and back-office systems that could enable lateral movement if left unpatched. Findings pushed airports to:
- tighten network segmentation,
- improve monitoring, and
- accelerate patch timelines.
The exercises highlighted three operational lessons:
- Speed matters: detection-to-response time must be minutes or seconds, not hours.
- People and process are as important as tools: regularly practiced staff make fewer mistakes under pressure.
- Legacy systems can be quiet weak links: unpatched software and poor segmentation create doorways for cyberattacks.
What passengers may notice
For travellers, most changes will be subtle but steady over the next year. Possible effects include:
- More perimeter patrols and occasional temporary closures of nearby roads or viewing areas when drones are detected.
- Short-term outages or resets of public Wi‑Fi and display boards during drills.
- More visible communications from airport staff while exercises are under way.
Officials stress that safety is the priority. Drills are designed to avoid flight disruptions, and when real drones appear, response teams act quickly to pause operations briefly and resume once the airspace is cleared. Practical advice for frequent flyers:
- Leave a bit more buffer time and watch for airport alerts, especially during announced exercise windows.
- Check your airport’s website or app on travel days.
Coordination, roles, and follow-up
The agencies involved share goals but have different roles:
- EASA: leads rulemaking and certification for aviation safety and security.
- ENISA: coordinates cyber capacity and standards for reporting and threat sharing.
- National aviation authorities: handle inspections and enforcement.
- Airport operators: procure and maintain systems, hire staff, and keep plans current.
- Private tech firms: supply detection sensors, neutralization tools, and cybersecurity platforms.
Parallel drills across countries allowed supervisors to compare results and share fixes quickly. Examples of cross-learning:
- Adding sensors to eliminate a detection blind spot copied across airports.
- Sharing staff training and login-prompt changes to block simulated phishing waves.
Airports also practiced clearer public communications—plain-language notices when screens or Wi‑Fi go down—to keep passengers calm and crews working.
Costs, support for regional airports, and peer help
Cost is a major concern for smaller fields. Responses include:
- Exploring shared services and pooled procurement to meet annual cybersecurity audits and detection upgrades.
- Larger airports mentoring smaller ones on training plans and exercise design to spread good practice.
Officials say peer-to-peer support can bridge gaps faster than formal programs alone.
Why repeated testing matters
Analysts emphasize continuous testing because tactics evolve quickly. New software patches, different drone frequencies, and evolving social engineering techniques mean yesterday’s fixes may not hold tomorrow. The 2025 campaign produced benefits beyond metrics—tighter bonds among security teams, air traffic units, IT staff, and first responders improved handoffs and reduced mistakes.
“When everyone knows the playbook and the faces in the room, handoffs improve and mistakes drop.”
Coordination, as much as any sensor or firewall, helps keep planes turning and passengers moving.
Where to follow updates
As the EU’s deadline approaches, the public can track official updates and guidance on the EASA website at EASA. The agency posts regulatory updates, safety publications, and information on certified systems. Airports are expected to publish their own notices about exercises and planned maintenance windows to help travelers plan around brief interruptions.
Europe’s aviation network is vast, and no system can promise zero incidents. But the 2025 campaign shows a clear shift: treat drone incursions and cyberattacks as everyday risks that demand everyday readiness. Big hubs are pushing the standard; smaller fields are catching up. The target—set in July 2025 and due by January 2026—is a common floor for airport security that makes surprise less likely and recovery faster when alarms sound.
This Article in a Nutshell
During 2025 coordinated exercises led by EASA and national aviation authorities tested European airports’ readiness for drone incursions and cyberattacks. Spring red‑team drills at major hubs simulated unauthorized drones, ATC network probes, and public Wi‑Fi disruptions. Large airports generally detected and neutralized drone threats quickly, while smaller regional airports suffered from blind spots, terrain challenges, and lack of certified counter‑drone tools. Cyber tests exposed vulnerabilities in legacy IT, slow patch cycles, and uneven staff training; a ransomware scenario prompted reviews of backup and recovery plans. In July 2025 EASA and ENISA issued new standards requiring certified counter‑drone systems, expanded detection coverage, mandatory annual cybersecurity audits, and real‑time threat sharing, with January 2026 as the compliance deadline. The campaign strengthened cross‑agency coordination, highlighted cost and implementation challenges for smaller airports, and emphasized that rapid detection, practiced personnel, and modernized systems are key to limiting disruptions and speeding recovery.
