A telecommunications failure at the Federal Aviation Administration kept every departing U.S. flight on the ground for about five hours on Friday, November 13, 2026. The agency ordered the ground stop at 3:54 p.m. Eastern. Transportation Secretary Sean Duffy said switches and routers on the legacy network overloaded with data and fed controllers inconsistent radar and communications information, while the FAA's new IP switches stayed up. Homeland Security Secretary Markwayne Mullin said officials saw no sign of a cyberattack and described the overload as appearing to follow new equipment added to the system. Neither official named the equipment.
During Black Hat, security leaders raised a related point about enterprise preparedness: most organizations skip testing for true operational resilience. Teams run tabletop exercises or test individual system failovers, then stop before examining what happens when an external dependency stops working.
A Ground Stop on Every Departure Reaches Well Past the Airport
Duffy said recovery would be slow because planes and crews needed repositioning after the order lifted.
Thousands of flights were canceled across the country.
I felt the ripple myself. My vacation ended a day early when my flights were canceled, and the cancellations carried over to my reserved Uber and to the hotels.
The technology around me handled much of it. American Airlines rebooked me with seats and I choose new seats. My reserved Uber monitors airline schedules, told me my flight was canceled and suggested I cancel the ride. My Claude Duet texted me to expect schedule changes as soon as the FAA ground stop news broke. Duet is a proactive agent from Anthropic that works in the background across connected apps, and I have early access through the research preview Anthropic opened on October 21, 2026. A dependency map can do the same work for your business if it lists which outside signals your systems should watch and what they should do when one changes.
Three other incidents, each with a different trigger, show where those dependencies sit.
CrowdStrike Shows That an Automatic Update Is a Dependency You Installed
On July 19, 2024, CrowdStrike delivered a content update to its Falcon sensor for Windows. CrowdStrike reverted it after about an hour and a quarter, but Microsoft estimated that 8.5 million Windows devices crashed in that window (TechTarget, 2024), less than 1% of all Windows machines. CrowdStrike's own review said its Content Validator tool missed a flaw in the update. Recovery took hands-on work: many hosts sat in a reboot loop and had to start in Safe Mode or the Windows Recovery Environment so technicians could delete the faulty file. No attacker was involved.
The update reached those machines through a trusted security vendor's delivery channel, outside the release process you manage. Check whether your change control covers content that vendors push on their own schedule, and count how many of your machines would need a person standing next to them to recover.
IndiGo Shows That a Rule Change Can Become the Outage
India's aviation regulator, the Directorate General of Civil Aviation, notified revised pilot duty time limits in January 2024 and phased them in across 2025. Phase 2 took effect November 1, 2025, and cut permitted night landings per crew to two from six, according to Outlook India. Outlook India also reported that IndiGo ran heavy night operations on lean staffing, which left little cushion. IndiGo told the regulator it had canceled 1,232 flights, 755 of them tied to crew shortages under the new rules (Moneylife, 2025).
The regulator's order said the airline could not forecast crew availability, complete training on time or realign rosters despite advance notice, and that the gaps led to cascading delays and cancellations. IndiGo described a confluence of factors that also included technology glitches, winter weather and airport congestion, and the regulator relaxed parts of the rules for a period so the airline could stabilize. India's civil aviation minister, Ram Mohan Naidu, said other airlines had adopted the rules without comparable trouble.
The dependency had a published start date.
List the regulations, contract terms and platform changes that take effect in the next twelve months, then check whether anyone has run your operation at the reduced capacity those changes imply.
Microsoft 365 Shows That Recovery Tools Can Sit Inside the Failure
One day before the FAA stop, Microsoft opened incident MO1550821 for a widespread Microsoft 365 outage that began at 1:26 p.m. Eastern on November 12. Microsoft said customers might be unable to connect to Exchange Online, Teams, SharePoint Online, Microsoft 365 Copilot and Defender XDR, according to BleepingComputer, and services were recovering in stages at 8:05 a.m. Friday. Microsoft said it found no indication of malicious activity. In a status update reported by ABC7, it said a process on the affected servers responsible for establishing secure connections becomes overwhelmed, which causes the servers to stop processing requests. When the reports cited here were published, Microsoft had not released a full root cause. Mullin said at the FAA briefing that the two events were unconnected.
An outage of this kind takes out mail and chat, and Microsoft's own list also included the security console. If your incident bridge, your customer communication drafts and your security alerts live in one tenant, the people who coordinate the response lose the tools they would use to coordinate it. Find out where your team talks when that tenant is unreachable, and who holds the phone numbers.
Your Monday Resilience Review Needs Four Questions
Your business continuity plan accounts for a server outage or a ransomware event. Ask your operations and security teams these four questions on Monday:
- Map external dependencies: Which vendors can change your systems without your approval, and which third-party infrastructure failures outside your control can halt your core delivery within four hours? (CrowdStrike)
- Calendar the dated changes: Which regulations, contract terms or platform changes take effect in the next twelve months, and has anyone run operations at the capacity they leave you? (IndiGo)
- Test multi-layer degradation: When did you last test a full operational fallback where collaboration tools, your security console, air travel, regional telecom or cloud transit degraded at the same time? (Microsoft 365 and the FAA)
- Audit contract metrics: Do your vendor contracts and service level agreements measure recovery time for cascading ecosystem delays, or only single-system uptime?
Al Jazeera. "FAA Ground Stop Lifted: Why Were US Flights Grounded, and What's Next?" Al Jazeera, 14 Nov. 2026, www.aljazeera.com.
CBS News. "FAA Lifts Nationwide Ground Stop That Disrupted Thousands of Flights, White House Says No Indication of 'Nefarious Act.'" CBS News, Nov. 2026, www.cbsnews.com.
Martin Cid. "FAA Ground Stop: Officials Tie Outage to New Equipment Overloading Old Switches." Martin Cid, 14 Nov. 2026, www.martincid.com.
Yahoo News. "FAA Says Nationwide Ground Stop Is Over After Thousands of Flights Canceled." Yahoo News, Nov. 2026, www.yahoo.com.
BleepingComputer. "Massive Microsoft 365 Outage Disrupts Outlook, Teams, Copilot Worldwide." BleepingComputer, 12 Nov. 2026, www.b
