The strongest security system is not the one that assumes trust. It is the one prepared for the moment trust breaks.
The recent Flydubai FZ1073 incident offers a difficult but important security lesson.
On September 30, the Dubai-to-Tel Aviv flight experienced a security incident and was diverted to Tabuk, Saudi Arabia. Flydubai confirmed that the aircraft landed safely and that all passengers were accounted for. The UAE General Civil Aviation Authority said the circumstances and operational and security aspects remain under investigation.
I want to be precise here: this was not reported as a cyberattack.
But from a cybersecurity leadership perspective, it raises a question that every enterprise should be asking:
What happens when the threat already has legitimate access?
The Perimeter Is No Longer Enough
Cybersecurity has traditionally focused heavily on keeping threats outside the organisation.
Firewalls.
MFA.
Endpoint protection.
Network segmentation.
Threat detection.
All remain essential.
But modern enterprises also have another challenge: the trusted identity that behaves unexpectedly.
An employee account, administrator, contractor, service account or AI agent may already have authorised access.
The question then changes from:
“Can we keep the attacker out?”
to:
“Can we recognise when legitimate access becomes dangerous?”
That is where Zero Trust, identity governance and continuous monitoring become strategic capabilities rather than technical checkboxes.
Five Questions I Would Take Into the Boardroom
1. Are we continuously verifying identity?
Authentication should establish who someone is. It should not automatically establish that everything they do is trustworthy.
2. Does every identity have only the access it needs?
Least privilege is not simply an IAM principle. It is a business-risk control.
3. Can we recognise abnormal behaviour?
A valid credential used in an unusual way can be more difficult to detect than an obvious external intrusion.
4. Can we separate critical responsibilities?
No single identity should have unchecked control over highly consequential systems or processes.
5. What happens after the control fails?
This is the question most organisations need to practise.
Can we contain the incident?
Can we revoke access quickly?
Can we preserve critical operations?
Can leadership make decisions under pressure?
Can we recover trusted systems?
The Real Meaning of Resilience
NIST’s Zero Trust Architecture recommends moving away from implicit trust based on network location and towards continuous authentication and authorization, with access decisions based on multiple factors and least-privilege principles.
That philosophy becomes increasingly relevant as enterprises become more dependent on cloud platforms, privileged identities, third-party ecosystems and autonomous AI agents.
Security cannot stop at prevention.
It must extend into detection, response and recovery.
Because eventually, every organisation will face a moment when a control is tested beyond its assumptions.
My CXO Perspective
I don’t believe the answer is to distrust every employee, partner or technology system.
The answer is to design systems that do not require blind trust to remain secure.
That means giving people and machines the access they need, continuously evaluating how that access is being used and maintaining the ability to intervene when behaviour changes.
For me, that is the evolution from traditional cybersecurity to identity-centric cyber resilience.
The objective isn’t simply to prevent every incident.
It is to ensure that when prevention fails, the organisation doesn’t.
The question I would leave with every board:
If a trusted identity became the threat tomorrow, would your security architecture recognise it before the business paid the price?
That is where the real test of cybersecurity begins.
Wishing Indian pilot Smit Machchar a speedy and complete recovery.
Sources: UAE GCAA / Emirates News Agency — Flydubai security incident · Flydubai official incident update · India Today — Flydubai incident live coverage
