Threat Landscape
Six named threat patterns detected across the national aviation checkpoint network. Each represents a distinct failure mode that GateReady identifies autonomously.
CASCADE
CRITICALCascading Checkpoint Failures
A CASCADE event occurs when a checkpoint closure or severe degradation at one terminal propagates to adjacent terminals. As displaced passengers flood alternative checkpoints, wait times spike in sequence. Without detection, a single-checkpoint issue can degrade an entire airport within 30-45 minutes.
Example Scenario
Terminal B checkpoint at a major hub closes unexpectedly at 0700 during morning rush. Within 8 minutes, Terminal A checkpoint wait times increase by 200%. By 0715, Terminal C is also experiencing severe throughput degradation. The cascade has spread to three terminals, affecting an estimated 4,200 passengers.
How We Detect It
GateReady monitors time-series correlation between adjacent checkpoints at every airport. When checkpoint throughput drops below baseline, the system automatically tracks whether neighboring checkpoints show correlated degradation within a 15-minute window. CASCADE is confirmed when 2+ adjacent checkpoints show >50% throughput decline with temporal correlation.
Recommended Response
Immediate notification to airport operations. Recommended actions: activate overflow lanes, deploy additional TSA officers to affected terminals, update passenger signage and airline ground staff. For airlines: proactively rebook passengers on at-risk flights.
Detection Indicators
- Single checkpoint throughput drops >60% in <5 minutes
- Adjacent checkpoint wait times increase >100% within 15 minutes
- Passenger count at affected checkpoint approaches zero
- Time-series correlation coefficient >0.8 between checkpoints
DARK GATE
CRITICALComplete Data Blackout
A DARK GATE event occurs when a checkpoint that was previously reporting data goes silent. The absence of data is itself an intelligence signal. Causes include equipment failure, network outages, security incidents requiring checkpoint evacuation, or deliberate suppression of public-facing data during sensitive operations.
Example Scenario
Airport XYZ has been reporting checkpoint data every 5 minutes for 90 consecutive days. At 1423, all data feeds from Terminal 2 stop simultaneously. No error codes, no degraded data -- just silence. 18 minutes later, local news reports an unattended bag incident at Terminal 2. The checkpoint had been evacuated.
How We Detect It
GateReady maintains a data freshness monitor for every checkpoint across every source. When a checkpoint that has been consistently reporting data fails to produce an update within 2x its normal reporting interval, DARK GATE is triggered. The system cross-references against known maintenance windows, source-level failures, and other airports to distinguish between infrastructure issues and security events.
Recommended Response
Immediate signal loss alert to subscribers. Recommended actions: contact airport operations for status, check backup data sources (community signal analysis, news feeds), escalate if signal loss persists beyond 30 minutes with no explanation. For airlines: prepare for potential gate changes and delays.
Detection Indicators
- Data freshness exceeds 2x normal reporting interval
- All data sources for a checkpoint fail simultaneously
- No scheduled maintenance window active
- Community signal analysis reports activity at the checkpoint
SURGE FRONT
CRITICALNational-Level Throughput Degradation
A SURGE FRONT is detected when 5 or more airports simultaneously experience wait time spikes exceeding 3x their baseline. This pattern indicates a systemic event affecting the national aviation security infrastructure: government shutdowns causing TSA staffing shortages, nationwide security protocol changes, or coordinated disruption events.
Example Scenario
On a Tuesday morning, GateReady detects that 8 major hub airports (ATL, ORD, DFW, DEN, LAX, JFK, MIA, SEA) all report wait times exceeding 45 minutes simultaneously. Historical baselines for this day and time are 12-18 minutes. Investigation reveals the TSA has implemented enhanced screening protocols nationwide following an intelligence bulletin.
How We Detect It
GateReady maintains rolling baselines for every airport by day-of-week and hour-of-day. When 5+ airports simultaneously exceed 3x their baseline, SURGE FRONT is triggered. The system differentiates between holiday-driven surges (predictable, gradual onset) and anomalous surges (sudden, unexpected) using rate-of-change analysis.
Recommended Response
National-level alert to all subscribers. Recommended actions: activate crisis protocols, coordinate with TSA regional centers, issue traveler advisories, airlines should add extra time to connection calculations. For government: assess whether the surge correlates with a known security event.
Detection Indicators
- 5+ airports exceed 3x baseline simultaneously
- Rate of increase >50% within 30 minutes
- Pattern does not match known seasonal events
- No weather or infrastructure explanation
BASELINE DRIFT
MEDIUMGradual Throughput Deviation
BASELINE DRIFT detects slow, persistent degradation of checkpoint throughput over days or weeks. Unlike acute events (CASCADE, SURGE FRONT), this pattern is invisible to threshold-based alerts. Causes include gradual staffing reductions, equipment degradation, increasing passenger volumes outpacing capacity, or changes in screening procedures.
Example Scenario
Over a 3-week period, average checkpoint wait times at a regional airport increase from 12 minutes to 22 minutes. No single day triggers an alert -- each day is only slightly worse than the last. GateReady's baseline drift analysis flags the trend after 10 consecutive days of above-baseline performance, estimating that the checkpoint will reach SEVERE status within 5 days if the trend continues.
How We Detect It
GateReady computes 30-day rolling baselines for every checkpoint and compares current performance against the historical norm. When the 7-day moving average deviates from the 30-day baseline by >25% for 5+ consecutive days, BASELINE DRIFT is triggered. The system also projects future throughput using linear regression to estimate time-to-critical.
Recommended Response
Trend alert to airport operations and airline partners. Recommended actions: investigate root cause (staffing, equipment, passenger volume), review checkpoint capacity planning, consider temporary mitigation measures (additional lanes, extended hours). Early detection enables proactive response before the situation becomes acute.
Detection Indicators
- 7-day moving average exceeds 30-day baseline by >25%
- Deviation persists for 5+ consecutive days
- Linear projection shows continued degradation
- No seasonal or event-driven explanation
ECHO EVENT
HIGHCorrelated Multi-Airport Disruption
An ECHO EVENT occurs when multiple airports exhibit the same disruption pattern within a short time window, but the pattern does not meet SURGE FRONT thresholds. This indicates a common cause affecting a subset of the network: regional weather systems impacting airport throughput, airline-specific operational issues cascading across hubs, or coordinated policy changes at a regional level.
Example Scenario
Three airports in the Southeast (ATL, CLT, MIA) simultaneously report 2x baseline wait times on a clear-weather Wednesday. The pattern is identical: sharp increase at 0800, peak at 0930, gradual return to normal by 1100. Investigation reveals a new TSA screening procedure was piloted at these three airports that morning.
How We Detect It
GateReady performs cross-airport pattern matching using normalized time-series data. When 2+ airports show >90% correlation in their throughput deviation patterns within a 2-hour window, and the pattern does not match known seasonal, weather, or holiday events, ECHO EVENT is triggered. The system identifies the correlated airports and the pattern signature for operator analysis.
Recommended Response
Correlation alert to subscribers with affected airports identified. Recommended actions: investigate common factors (same airline hub, same TSA region, same equipment vendor), check for regional security bulletins, coordinate response across affected airports. Particularly valuable for airline network operations centers managing connections.
Detection Indicators
- 2+ airports show >90% time-series correlation
- Disruption occurs within a 2-hour window
- Pattern does not match known events
- Affected airports share a common factor (region, airline, or TSA district)
POSTURE SHIFT
HIGHCheckpoint Closure/Reopening Patterns
A POSTURE SHIFT detects when the security posture at an airport or across the network changes -- checkpoints close, reopen, or change their operating profile in ways that deviate from historical norms. This is the most subtle pattern: it does not always correlate with wait time changes, but indicates a change in how security resources are being deployed.
Example Scenario
A major international airport normally operates 6 checkpoints from 0500-2200. GateReady detects that for the past 3 days, only 4 checkpoints have been active during peak hours. No increase in wait times has been reported (the remaining checkpoints absorbed the load), but the reduced checkpoint surface increases vulnerability to cascade events. GateReady flags the posture change as a risk factor.
How We Detect It
GateReady tracks the number of active checkpoints per airport over time and compares against historical norms by day-of-week and time-of-day. When the active checkpoint count deviates from the expected count by >20% for 3+ consecutive reporting cycles, POSTURE SHIFT is triggered. The system also performs statistical change-point detection to identify the exact moment the posture changed.
Recommended Response
Posture change alert to airport security operations. Recommended actions: verify whether the change is intentional (planned maintenance, staffing adjustment) or unintentional (equipment failure, staffing shortage). Assess cascade risk -- fewer active checkpoints means less resilience to surge events. Update contingency plans accordingly.
Detection Indicators
- Active checkpoint count deviates >20% from historical norm
- Deviation persists for 3+ consecutive reporting cycles
- Change is not correlated with known events or maintenance
- Remaining checkpoints show increased throughput load
Detect these patterns.
In real time. At your airports.
GateReady Sentinel detects all six threat patterns autonomously. No configuration required. See it working on your checkpoint data.