Blackout scenario planning: Is your security team ready?

Electricity is the invisible backbone of modern infrastructure. From security systems and data centres to hospital wards and airport terminals, we rely on uninterrupted power to function safely and efficiently. But when that power disappears, whether through accident, failure, or attack, what’s exposed is often more alarming than the darkness itself.

Take the recent blackout at Heathrow Airport, where a sudden loss of power didn’t just delay flights. It created a breakdown in communication, halted luggage systems, shut down access controls, and left passengers stranded in critical areas with minimal guidance. The systems failed. But so too did the processes behind them.

The reality behind the darkness

A blackout is more than a power issue, it's a stress test. It reveals exactly how well (or poorly) people and processes respond when the structure they depend on vanishes.

Here’s what tends to unravel in those moments:

• Access Control Fails: Electronic systems seize up, doors remain locked or open without intent, and manual overrides are either inaccessible or misunderstood.

• Surveillance Ceases: CCTV systems often lack sufficient backup. Without visibility, security teams are effectively blind especially if they are linked to the mains.

• Alarms Are Silenced: Alarm systems tied to mains power can go down completely. Even battery backups may not sustain critical operations long enough to matter.

• Communication Disintegrates: Internal networks collapse. Radios may work, assuming they’re distributed, charged, and staff are trained to use them under pressure.

  
  

But above all, what emerges most starkly is a human response gap.

The human factor: stress, hesitation, fatigue

Blackouts introduce a unique kind of pressure. With systems down and time ticking, staff are forced to rely on memory, instinct, and improvised coordination.

Fatigue plays a major role. Security teams, often understaffed or stretched across multiple tasks, are placed in high-stakes situations without clarity or rest. Leadership, if not present on site, may struggle to assert control remotely. Middle-tier personnel, unsure of what falls under their responsibility in this specific type of event, may hesitate.

Panic, confusion, and miscommunication can rapidly become the most dangerous elements in the room.

This is why organisations must plan for more than just “power contingency.” They must prepare for operational and psychological failure points.

Rehearsing reality: why red team exercises matter

Testing your plan in theory is not the same as testing it in chaos.

Red Team exercises simulate realistic, unannounced scenarios that force your staff, systems, and strategies to react in real time. A well-designed "red team" scenario, such as a staged blackout during peak hours, doesn’t just reveal flaws in the technical setup. It reveals how humans behave under stress.

These exercises:

• Uncover assumed knowledge gaps: What you think people know often differs from what they remember under pressure.

• Expose chain-of-command breakdowns: During a crisis, unclear authority leads to conflicting instructions or silence.

• Challenge complacency: Teams often overestimate their readiness. A real-time simulation quickly adjusts expectations.

• Highlight resource limitations: From spare torches to physical keys, a blackout simulation reveals what’s actually available and accessible, and what isn’t.

  
  

We explored this further in another of our "Insights" at Red Teaming and Simulated Threat Exercises, where we dive into the methodology, design principles, and long-term benefits of regularly testing security under duress.

Crucially, these aren’t about assigning blame. They’re about learning through exposure, identifying weak points and building muscle memory, so the real event isn’t the first time people are tested.

A blackout tests any organisation's security protocols.

Ripple effects go far beyond the building

A single blackout doesn’t just impact the site it occurs on. It can have far-reaching effects across sectors, regions, and reputations.

• Transport Hubs: Blackouts delay flights and cause significant downstream disruption to global travel schedules.

• Residential Complexes: Failure in entry systems can trap residents or expose them to unauthorised access.

• Healthcare Facilities: A stalled lift, a frozen operating system, or darkened corridors can have life-or-death consequences.

• Corporate Environments: Data loss, physical breaches, and delayed emergency responses may lead to regulatory consequences or insurance complications.

  
  

All of this reinforces one truth: power may fail, but preparedness doesn’t have to.

Conclusion: the blackout is the beginning, not the end

While the image of a darkened facility may seem symbolic, it’s what follows that matters most. Every power loss is a live scenario, whether rehearsed or real, that reveals how well your systems, teams, and protocols respond.

Blackouts strip away the comfort of automation. They reveal whether you’ve built resilience into your people, not just your infrastructure.