On September 30, flydubai flight FZ1073 left Dubai for Tel Aviv with 174 people on board. About two hours into the flight, the first officer attacked the captain inside the cockpit and tried to take control of the aircraft. According to initial reports, the aircraft dropped nearly 14,000 feet in under 30 seconds. Passengers and crew forced their way into the cockpit, restrained him, and handed the controls to two off-duty flydubai pilots who happened to be traveling on the flight. They landed safely in Tabuk, Saudi Arabia.
Corporate travel programs are built around delays, lost luggage, and the occasional medical emergency. FZ1073 is a reminder that once employees board an aircraft, their safety depends on an airline's hiring and screening, its cockpit procedures, and whatever is happening in the airspace below them. Security teams control none of that. What they can control is how well they understand the risks along a route and how quickly they can respond when a trip goes wrong.
The UAE is leading the investigation. Its attorney general said on October 3 that the first officer attacked the captain with the aircraft's emergency crash axe and tried to take over the flight controls, and that investigators had determined he began carrying out a terrorist act. Prosecutors are still examining his motive, whether there was prior planning, and whether anyone else was involved. Early indications reported by NBC News suggest he ac33ted alone, though U.S. officials cautioned that the investigation is at an early stage.
The detail that matters most for security teams surfaced after the landing. There are additional reports, citing unnamed sources, claiming that authorities in Oman had previously barred him from flying in that country over concerns about extremist views. If this evidence holds, a serious concern about this pilot existed in one country and did not prevent him from flying for an airline based in another.
That gap is common. Pre-employment screening captures a person at a single moment. Concerns raised afterward, or held by a previous employer, a regulator, or authorities in another jurisdiction, often never reach the people who need them. The same pattern applies well beyond aviation, to anyone with privileged access: control room operators, executive drivers, systems administrators, and staff with access to sensitive facilities.
Duty of care is an employer's obligation to take reasonable steps to protect its people, and it travels with them. ISO 31030, the international guidance standard for travel risk management published in 2021, gives organizations a structured way to assess and treat travel risks, and it applies to domestic and international trips.
Air travel is where an employer's direct control is weakest. A company chooses the destination and the airline, but it has no say over who sits in the cockpit or what happens in the airspace along the route. What it can do is understand those risks before a trip and act quickly when something goes wrong mid-journey.
FZ1073 shows how fast a routine trip can change. Passengers bound for Israel ended up in Saudi Arabia and waited more than 10 hours before a replacement aircraft took them on to Tel Aviv. flydubai then suspended all of its flights to and from Israel, leaving other travelers stranded in the UAE until Israeli carriers arranged rescue flights. An employee on that aircraft, or booked on the next day's return, would have needed their employer to know where they were, what had happened, and how to get them home.
The flydubai attack happened against a backdrop of rising risk to civil aviation in the Middle East. On October 5, Yemen's Houthis claimed a ballistic missile strike on King Khalid International Airport in Riyadh and Abha Airport in the country's southwest. Saudi Arabia's aviation authority confirmed the strikes and said three people were injured. The group also warned airlines against operating in Saudi airspace, outside the areas over Mecca and Medina, for as long as Saudi Arabia supports Yemen's government forces.
Saudi airspace sits on the routes between Europe, the Gulf, and South and Southeast Asia, so the warning affects travelers who never set foot in the kingdom. Route suspensions in the region have also become long-running. American Airlines has pushed its New York to Tel Aviv service back to January 2027, after a series of delays and cancellations stretching more than two and a half years.
For a security team, the itinerary on file shows the departure and arrival cities. The airspace a flight crosses, the countries it could divert to, and the public statements of armed groups along the way often go unmonitored.
Everything above applies to executives, with added exposure. Senior leaders' travel is often visible in advance through conference agendas, earnings roadshows, and colleagues' social media posts. Public flight-tracking data can track corporate aircraft movements. A fixated individual or an activist group can learn where an executive will be, and when, from open sources.
Executive protection programs generally plan carefully around ground movements, venues, and residences. Air travel deserves the same attention. Watch for online chatter that references an executive's travel plans, review what an itinerary reveals publicly, and assess route and destination risk before each trip.
If you want to see what your own leadership team's exposure looks like from the outside, Liferaft's Executive Protection Assessment is a starting point.