The Psychology of Rapid Recovery: How Intelligent Intuition Shaped Crisis Leadership at Glasgow Airport

• 18 May 2026
• Gillies,  Jon

• 0

  Comment

Drone and missile strikes on airports across the Middle East are a sharp reminder that civil aviation infrastructure remains a target in periods of geopolitical instability. When an airport is attacked, the engineering question of structural damage is usually resolved quickly. The harder question is human: do leaders actually perform under pressure the way the crisis plans assume they will?

On 30th June 2007, a vehicle-borne improvised explosive device was driven into the terminal entrance at Glasgow Airport. The airport reopened to full operations in exactly 23 hours and 59 minutes. That outcome was not luck. It reflected years of deliberate preparation - plans tested under realistic pressure, senior leaders who participated in exercises rather than observed from a distance, clearly allocated authority during a crisis and recovery time objectives treated as firm commitments rather than vague aspirations.

This case study revisits that event through a psychological lens. The central argument is that recovery speed was determined not solely by the plans themselves, but by the intelligent intuition of the leaders executing them. Drawing on the first-hand account of Gillies Crichton, then Head of Assurance at Glasgow Airport and a key architect of its crisis and recovery plans, and examined through a psychological theoretical lens, the case identifies three cognitive mechanisms that shaped the outcome: experience-driven pattern recognition, goal anchoring around the recovery time objective, and availability-driven rapid threat updating. The argument is not that these leaders took shortcuts. It is that they had developed, through sustained and deliberate preparation, the kind of expert intuition that performs precisely when analytical reasoning cannot. At a time when airports again face live and evolving threats, these lessons are both practical and timely.

Glasgow Airport is located approximately eight miles west of Glasgow city centre and occupies around 340 hectares with a single runway operation. The airport handled approximately 8.1 million passengers in 2024, its busiest year since the pandemic and close to pre-2020 levels. It currently serves more than 100 destinations through a network of over 20 airlines, providing important domestic, European, and long-haul connectivity and acting as a major international gateway for Scotland.

Glasgow Airport Limited directly employs roughly 420 staff, while the wider airport campus supports around 4,500 on-site jobs across airlines, ground handling, retail, hospitality, and support services. The airport also plays a wider economic role within Scotland’s transport system. Earlier economic impact studies commissioned by Scottish Enterprise, Glasgow City Council and Renfrewshire Council estimated that the airport supported over 7,300 jobs nationally and generated approximately £200 million annually for the Scottish economy.

More recent economic analysis suggests that the broader airport ecosystem now contributes over £1.4 billion in gross value added and supports tens of thousands of jobs across Scotland, reflecting the airport’s expanding connectivity and economic footprint.

As part of the United Kingdom’s critical national infrastructure, Glasgow Airport has formal resilience responsibilities under national emergency planning legislation. It is designated as a Category 2 responder under the Civil Contingencies Act 2004, meaning it plays a supporting role in multi-agency emergency response and resilience planning. The airport also became the first European airport to achieve ISO 22301 certification in 2012, the international standard for Business Continuity Management Systems.

Civil aviation infrastructure presents a persistent and high profile target for terrorism and geopolitical violence. Glasgow Airport operated in an environment where the prevailing assumption, shaped by decades of IRA activity that had largely spared Scottish targets, was that the risk of a terrorist attack on Scottish soil was relatively low. This perception did not remove the need for planning, but it did influence the perceived hierarchy of risks. Within operational risk assessments, terrorism often sat below more familiar and historically frequent threats such as aircraft incidents, severe weather disruption, volcanic ash and pandemic risk.

The challenge facing Glasgow Airport was therefore not simply whether to plan for terrorism, but how to build a leadership culture capable of executing those plans under conditions of genuine shock - when the event was both unexpected in timing and ambiguous in its early stages. The specific risks and pain points included:

• A busy terminal on one of the airport's highest-footfall days of the year, with school holidays having begun the previous day
• An attack that initially presented as a car fire, delaying recognition of its terrorist nature and requiring rapid reframing of the response
• Approximately 3,500 passengers already through security - invacuated rather than evacuated - who each required individual police interviews before release
• Sprinkler heads activated by heat from the fire, flooding the terminal ground floor and basement for approximately six hours due to the shutoff valve being within the designated crime scene
• Over 800 media enquiries in the first 24 hours, alongside 129,091 website hits compared with 6,127 the previous week
• The need to negotiate actively with Category 1 emergency responders, particularly regarding the prioritisation of forensic searching, to enable progressive reopening of terminal doors

The underlying challenge was cultural and cognitive. Could an organisation whose leaders had prepared extensively but had never faced a live attack of this nature translate rehearsed plans into effective and coordinated action under real pressure. And could they do it fast enough to reopen the airport within 24 hours?

Glasgow Airport’s approach to resilience was built on a philosophy of planning for anything rather than everything. Rather than developing scenario specific plans for every conceivable threat, the airport grouped its continuity planning around three domains: people, assets and utilities, and designed plans to be flexible and cause agnostic. This meant that when the attack occurred no single terrorist attack plan was activated. Instead, relevant sections from existing people, assets and utilities plans were applied to the specific conditions faced.

Understanding why this worked requires a psychological explanation. Crisis decision making does not operate in the way that formal planning processes often assume. Dual process theory distinguishes between System 2 thinking, which is slow, analytical and deliberate, and System 1 thinking, which is fast, automatic and pattern driven. Under conditions of acute pressure, limited time and incomplete information, System 2 thinking is largely unavailable. Leaders cannot carefully analyse options when a burning vehicle has just been driven into a terminal building. What they can do is recognise situations quickly and respond with confidence if their System 1 has been built on the right experience.

It is important to be clear about what this means. The speed and automatic nature of System 1 is often discussed in terms of its potential for error, the cognitive biases and shortcuts that can lead to poor judgement. That framing misses something important. When System 1 is built on genuine expertise it does not produce bias. It produces intelligent intuition. This is the rapid and reliable judgement of people who have encountered enough of the right situations to recognise what a new one requires almost immediately. The Glasgow Airport response was not fast because leaders were careless. It was fast because they were experienced. Their training and exercise programme had deliberately developed the intuitive competence that analytical reasoning cannot replicate under pressure.

Glasgow Airport’s training and exercise programme therefore functioned as a System 1 preparation mechanism. Quarterly Crisis Management Team exercises, increasing realism and visible participation from senior leadership were not primarily about transferring knowledge. Their purpose was to build the rapid and automatic competence that performs when deliberate reasoning is no longer possible.

The approach was underpinned by several structural elements:

Business Impact Analysis

A formal business impact analysis was undertaken to identify critical activities and single points of failure, ensuring that recovery time objectives (RTOs) were grounded in operational reality rather than aspiration. The 24-hour RTO established for major incidents became a mantra - tested, rehearsed and internalised across the Crisis Management Team.

The Seven R's Strategy

Gillies Crichton developed and embedded a business continuity strategy known as the Seven R's: Risk, Resilience, Response, Recover, Rehearse, Review and Reputation. This model provided a continuous improvement framework connecting risk identification through to post-incident review and was integrated into the airport's broader Managing Responsibly System - a 14-step management process based on the Plan-Do-Check-Act principle.

ISO 22301 Certification

In 2012, Glasgow Airport became the first European airport to achieve ISO 22301, the international standard for Business Continuity Management Systems. This formalised the airport's preparedness approach and provided an external benchmark against international best practice.

Crisis Management Team Structure

The Crisis Management Team (CMT) was deliberately constructed rather than assembled by default. Members were selected for the right skills and were required to attend a minimum of two exercises per year to retain their place on the team. The CMT met quarterly for tabletop and practical exercises. Critically, the Managing Director participated in these exercises as an active member rather than as an observer, setting the cultural tone from the top. The Managing Director in post at the time of the attack had taken part in a CMT exercise on his first day in the role.

Multi-Agency Integration

Glasgow Airport was one of five UK airports selected to pilot the Multi Agency Threat Risk Assessment (MATRA) process in 2003 following the Wheeler Review of airport security. Inter-agency training, exercises and liaison with Category 1 responders including Strathclyde Police, Strathclyde Fire and Rescue and NHS partners were well established before the attack. This ensured the airport had a seat at the multi-agency tactical command table during the incident, allowing business recovery objectives to be represented alongside emergency service priorities.

The Response on the Day

When the attack occurred at 15:11 on 30th June 2007, the Airport Duty Manager initiated CMT callout. Gillies Crichton - as CMT leader - was the first member on site, establishing the team within one hour of the attack. Clear aims and objectives were set immediately, with preservation of life as the primary objective and the 24-hour RTO as the recovery anchor. A separate Business Recovery Team, led by the Managing Director, was established in a physically distinct location to ensure the CMT could focus on the immediate crisis without pressure from longer-term recovery demands.

The outcomes of the Glasgow Airport response were measurable, significant and, given the severity of the attack, remarkable:

• The terminal building reopened for full operations in exactly 23 hours and 59 minutes after the vehicle was driven into the building
• Zero fatalities among airport staff, passengers or members of the public - the only fatality was one of the two attackers
• Approximately 3,500 invacuated passengers were safely managed, interviewed and released in an orderly process
• 800+ media enquiries handled within the first 24 hours through a coordinated media response
• 129,091 website hits recorded in the 24-hour period, compared with 6,127 the previous week - managed without communication failure
• Both perpetrators were apprehended at the scene and positively identified as the individuals responsible for the failed London car bomb attacks the previous night
• Glasgow Airport received widespread recognition and plaudits from passengers, partner agencies and the resilience community, including the Recovery of the Year award at the 2008 CIR Awards
• First European airport to achieve ISO 22301 certification in 2012, formalising the lessons of the 2007 response into an internationally recognised standard

Scotland’s First Minister commented in the aftermath that emergency procedures, airport operations, and liaison between airport staff, police and fire services had been practised many times over, and that this was why they worked so effectively. The qualitative impact on organisational confidence, multi-agency trust and staff morale was equally significant. Staff went well beyond normal duties, and on the following day a queue of passengers nearly half a mile long was met with patience and good humour.

Several elements proved decisive in achieving recovery within 24 hours. These were not incidental. They were the product of deliberate organisational design:

• Senior leadership participation in exercises: The Managing Director attended quarterly CMT exercises as a willing participant, not an observer. This set an unambiguous cultural signal and ensured the most senior leader in the building during the crisis had already rehearsed his role.
• Pre-allocated authority: Decision-making roles were clearly defined before the crisis hit. There was no hesitation about who led what under pressure.
• Recovery time objectives as firm commitments: The 24-hour RTO was established at the moment the CMT convened and treated as a genuine target, aligning every agency around a shared restoration objective.
• Multi-agency relationships built through years of joint training: Prior interoperability with Category 1 responders enabled difficult in-crisis negotiations - such as persuading police to prioritise clearing a specific terminal door for early reopening - to happen quickly and constructively.
• A seat at the tactical command table: Glasgow Airport's presence in the multi-agency command structure ensured business recovery objectives were never subordinated entirely to emergency service priorities.
• A culture of learning from external events: Previous incidents including the Madrid bombings, the London attacks and 9/11 had been studied and incorporated into planning. Intelligence from the London car bombs discovered the night before the Glasgow attack was acted upon immediately despite the absence of specific local intelligence. This demonstrated how learning translated into protective behaviour.

The central lesson is uncomfortable for many organisations. Untested plans are little more than documented intentions. Glasgow Airport’s recovery was not the result of a superior plan. It was the result of leaders whose intelligent intuition, built through sustained rehearsal and deliberate learning, replaced hesitation with confident and coordinated action under pressure.

Three cognitive mechanisms were particularly decisive. Each can be understood through the lens of fast and frugal heuristics, an idea developed by psychologist Gerd Gigerenzer. Under conditions of uncertainty and time pressure, simple experience-based rules often outperform complex analytical strategies. This is not a failure of rationality. It is rationality adapted to the environment, and it is what expert intuition looks like in practice.

The Glasgow Airport response illustrates three such mechanisms. Together they help explain how rehearsed plans were translated into rapid and coordinated action during the crisis.

• Experience-driven pattern recognition: Crisis leaders did not reason from first principles under pressure. They recognised familiar patterns and acted on them what Gary Klein's Recognition-Primed Decision (RPD) model describes as the defining characteristic of expert performance under real world pressures. Klein's research across firefighters, military commanders and emergency responders consistently shows that experts do not compare options; they identify the first workable course of action that fits the situation, based on pattern matching against a rich store of prior experience. The Glasgow Airport CMT did exactly this. Years of exercises and deliberate learning from external incidents had built the recognition library that allowed leaders to act with speed and confidence when the situation was genuinely novel.
• Goal anchoring: The 23 hours and 59 minutes reopening target was not merely operational. It was behavioural. In dual process terms it functioned as a System 1 override for a common System 2 failure mode. Under sustained pressure analytical reasoning can become preoccupied with the immediate crisis while recovery objectives fade into the background. By setting a concrete and non negotiable target at the moment the CMT convened, the organisation effectively removed that decision from further debate. Every subsequent judgement, including the negotiation with police over the sequencing of forensic searches, was filtered through a single shared reference point.
• Psychologists describe this as an implementation intention. It is a specific if then commitment that bypasses deliberative reasoning and triggers goal directed behaviour automatically. The target aligned multiple agencies around a single restoration outcome and prevented the recovery drift that often lengthens closure times when organisations lose focus during the emergency phase. The 23 hours and 59 minutes target became, in the words of those present, a mantra. That is precisely how implementation intentions work in practice.
• Rapid threat updating: When car bombs were discovered in London the night before the attack, the Airport Police Commander repositioned officers on the forecourt without any specific intelligence about Glasgow. In dual process terms, this was System 1 at its most effective. It involved a fast, automatic inference from a recognised pattern, made without the time or information required for System 2 analysis. In fast and frugal terms, it illustrates what Gigerenzer calls the take-the-best heuristic. A single highly salient cue, the discovery of a failed VBIED attempt in London, was sufficient to trigger a protective response. No committee, no risk matrix, no analytical framework was needed. This was rapid threat updating as a practical and effective decision strategy. It directly reduced the consequences of the attack the following day.

Organisations that run the same tabletop exercise each year without increasing realism, rotating participants, or involving senior leadership are not building crisis ready cultures. They are maintaining the appearance of one. Setting a clear recovery time objective at the moment a crisis begins, and holding to it, is a discipline that requires deliberate practice rather than good intentions.

The psychological implication for resilience professionals is significant. If crisis performance depends primarily on System 1, on the intelligent intuition of leaders who have genuinely learned to read and respond to pressure, then the quality of that performance is determined long before the crisis begins. It is shaped by the richness and realism of the experience that leaders acquire through training, exercises and deliberate learning from the experiences of others.

Organisations that assess their readiness by the comprehensiveness of their plans are measuring the wrong thing. The more important question is whether their leaders have developed the cognitive fluency, the intelligent intuition, required to act effectively when the plans run out.

Recent drone and missile strikes on airports across the Middle East have made the questions examined in this case study newly urgent. In each of those incidents, the structural and security questions were addressed through systems and procedures. The harder question was human. How quickly and effectively leaders made judgements under real pressure, with incomplete information and intense public scrutiny. That question was answered by people, by the quality of their preparation, by the depth of their experience, and by the intelligent intuition that was or was not present when it was needed.

The Glasgow Airport case demonstrates that a recovery of 23 hours and 59 minutes from a live terrorist attack was arguably not primarily a planning achievement. It was a human one. The three mechanisms identified in this case study, experience driven pattern recognition, goal anchoring and rapid threat updating, were not the result of sophisticated analytical frameworks applied during the crisis. They were the result of years of deliberate investment in developing the kind of expert intuition that holds under pressure. To be clear, this is not an argument that planning, rehearsal and structured preparation are secondary. They remain essential. What this case demonstrates is that plans alone are insufficient without leaders who have developed the intuitive competence to adapt and execute, especially when real conditions diverge from those the plan anticipated – which is often the case.

For resilience professionals the practical implication is direct. The question is not whether an organisation has a crisis plan. The question is whether its leaders have developed the intuitive competence to execute that plan when conditions are nothing like those the plan assumed. That competence is built through exercises that increase in realism, leadership participation that is genuine rather than symbolic, and a culture that treats learning from the incidents of others as a professional responsibility rather than an optional interest.

Future work will focus on expanding the library of intelligent intuitive heuristics available to crisis leaders. This includes mapping the judgement patterns that experienced responders already carry, often without being able to articulate them, and identifying what may be missing from their repertoire when they face threat environments that have no historical precedent. Geopolitical attacks on aviation infrastructure, hybrid warfare scenarios and cascading systemic failures do not present themselves in forms that existing pattern libraries were built to recognise. The risk is not that leaders will reason poorly under pressure. The risk is that they will encounter situations for which their intelligent intuition has no established pattern to draw upon.

Building resilience for this environment requires deliberate expansion of the experience base from which expert judgement develops. This can be achieved through higher fidelity exercises, cross sector learning and structured reflection on near misses and novel incidents that stretch the boundaries of what leaders have previously encountered. The aim, therefore, is to provide resilience professionals with a practical framework for assessing and developing intelligent intuition within their leadership teams. It should not be treated as a psychological abstraction but as a living capability that grows with experience and ultimately determines recovery outcomes when formal plans meet real pressure.