Running Blind: the timing risk nobody owns

Ask an organisation what it depends on and you will get a list: power, connectivity, cloud, payments, people. GNSS timing does not appear on that list, and yet 34.9% of respondents say their organisation relies on it critically or heavily. For 14.2%, core operations would fail without it outright.

That reliance is not the problem. The problem is what sits alongside it. 43.3% were only vaguely aware, or not aware at all, that GNSS signals can be deliberately jammed or spoofed. Only 19.7% said their organisation actively considers it.

This is an unusual shape for a risk. Most critical dependencies are understood as risks precisely because their failure modes are familiar: power cuts, outages, breaches. GNSS timing has no such folk memory. It has never visibly failed at scale in the UK, so it registers as a utility rather than an exposure. The dependency has outrun the awareness of its primary failure mode.

Interference is not hypothetical, and it is not rare. The aviation monitoring group OPSGROUP, whose 2024 GPS Spoofing WorkGroup drew more than 950 participants from across the aviation industry, found that spoofing rose from an average of around 300 affected flights a day in the first half of 2024 to approximately 1,500 a day by August, a five-fold increase in a matter of months. Over one month from mid-July to mid-August 2024, some 41,000 interference events were reported. What was once confined to conflict zones now appears in ordinary operating conditions across European airspace and shipping lanes.

The economic exposure has been quantified. London Economics, in research for the UK Space Agency published in 2023, estimated the benefit of GNSS to the UK economy at £13.62 billion a year, the impact of a seven-day loss at £7.64 billion, and the impact of a loss lasting just 24 hours at £1.42 billion.

A dependency worth £13.62 billion a year, with a single-day failure cost of £1.42 billion, is actively considered by fewer than one in five of the organisations that carry it.

“This is not a risk that has been assessed and accepted.”

29.9% say a 24-hour loss of accurate timing would be serious or catastrophic, with 8.2% choosing catastrophic outright.

A further 17.0% could not say what the impact would be at all. That figure deserves as much attention as the first. One in six people working in the UK's two most timing-dependent sectors cannot estimate what a day without accurate time would do to their organisation. Set against the £1.42 billion national figure for exactly that scenario, an unquantified dependency is not a small risk. It is an unmeasured one.

Now set both against the testing figures.

42.9% have never tested how their timing systems behave under interference. A further 18.1% say testing is planned but not done, which means 61.0% have no completed test behind them, with a further 9.2% unable to say. Only 8.2% test formally and regularly. In total, just 29.8% have carried out any form of test at all.

This is not a case of risk being weighed and accepted. Accepted risk looks different. It has a rationale, a compensating control and a review date. This looks like a risk recognised in the abstract and never converted into an action.

How long could they last?

Respondents were also asked how long their organisation could continue operating normally if GNSS timing became unavailable or unreliable.

10.2% said indefinitely, because they hold a time source independent of GNSS. A further 8.9% said several days, giving 19.1% with a buffer of days or more. 34.8% put it at about a day.

That accounts for 53.9% of respondents. The remaining 46.1% either said they could keep operating only a few hours, or could not say at all.

The figure carries weight without that division. Both states describe an organisation that has not established its own tolerance: one has a thin buffer, the other has an unmeasured one. Against a national estimate of £1.42 billion for a 24-hour national outage, close to half of the people closest to these systems cannot place their own organisation on the right side of that day.

The prepared minority

One pattern runs through the whole study and is easy to miss, because it appears three times in three different places.

• 10.2% hold a time source independent of GNSS.
• 8.2% test formally and regularly.
• 7.1% are very confident they could prove their timing to a regulator.

Three separate questions, asked about three different capabilities, each answered affirmatively by somewhere between one in ten and one in fourteen organisations. Independence, testing and evidence are not the same capability, and there is no mechanical reason these figures should align. That they do suggests a small, consistent minority that has treated timing as a genuine dependency and built accordingly, and a large majority that has not addressed it in any of the three respects.

This is the most useful finding in the study for anyone deciding what to do next. The prepared minority is not distinguished by scale or sophistication. It is distinguished by having asked the question and acted on the answer. Roughly nine organisations in ten have not.

The clearest structural finding in the study is that the risk has no settled home.

Asked who owns the risk of a timing or positioning failure, 46.9% named IT or technology. Only 11.0% named risk and compliance and 8.9% a dedicated resilience function, meaning just 19.9% place the risk with a risk professional of any kind. Operations accounted for 17.1%. A further 16.1% could identify no owner at all: 3.0% said no one specifically owns it, with 13.1% unable to say.

Two features of the sample sharpen this considerably.

First, the resilience gap. 19.2% of respondents work in a resilience or business continuity function. Only 8.9% say a dedicated resilience function owns timing risk. The capability exists in more than twice as many organisations as it owns this particular risk in. Where a resilience function has been built, timing has largely not been placed inside it. It has been left where it started, with the people who run the equipment.

Second, respondents are not defending their own territory. Only 20.1% of the sample works in IT, yet 46.9% named IT as the owner. Respondents are overwhelmingly assigning this risk to a function other than their own, which is the opposite of what self-interest would produce. This is not a survey of people passing the parcel. It is a survey of people describing where the parcel has landed.

The comparison with cyber security is instructive. Cyber risk was once distributed exactly like this: a technical concern, owned by whoever ran the systems, invisible to the board. It converged on the Chief Information Security Officer, and convergence is what made it governable, fundable and testable. PNT resilience has converged on no one. Accountability falls between IT, risk and security, and a risk that falls between functions does not get tested, budgeted or reported.

If interference reached these organisations today, most would not know.

50.1% are not very or not at all confident they would detect a jamming or spoofing event. Only 13.3% are very confident they would. A further 17.0% could not say either way.

And after the event, most could not demonstrate what happened. 40.2% are not confident they could prove to a regulator or auditor that their timing was accurate during a disruption. Only 7.1% are very confident they could.

That last figure is the sharpest number in the study. Fewer than one in fourteen people working in the UK's most heavily regulated timing-dependent sectors is very confident their organisation could evidence its own time.

These two findings compound in a way that neither does alone. An organisation that cannot detect an event and cannot evidence its timing afterwards is not merely exposed to disruption. It is exposed to disruption it will attribute to something else. Timing failures do not announce themselves. They surface as reconciliation breaks, sequencing anomalies, synchronisation errors and audit discrepancies, each of which has a dozen more familiar explanations. A cause that cannot be detected and cannot be evidenced will be recorded as something else entirely.

That is the practical meaning of running blind. Not that an attack would go unnoticed, but that its consequences would be misdiagnosed.

49.0% understand their organisation's regulatory obligations on timing accuracy and operational resilience not very well, or not at all. Only 8.1% say those obligations are actively managed.

The obligations exist regardless, and they are more specific than most organisations realise.

MiFID II requires trading venues and their members to synchronise business clocks to Coordinated Universal Time, under Commission Delegated Regulation (EU) 2017/574, commonly cited as RTS 25. The requirement is tiered rather than uniform. Voice and manual trading sits at one-second granularity; general algorithmic trading at one millisecond; high-frequency algorithmic trading at a maximum divergence from UTC of 100 microseconds with one-microsecond granularity. Two consequences follow from the drafting. A free-running clock is non-compliant however stable it is, because the standard measures divergence from an external reference rather than internal stability. And where time is derived from GNSS, the offset between GNSS time and UTC must be documented and removed, not assumed to be zero.

UK operational resilience rules require firms to identify their important business services, set impact tolerances, map the people, processes, technology, facilities and data that deliver them, and test that they can remain within tolerance under severe but plausible scenarios. These rules were made in FCA Policy Statement PS21/3 and PRA Supervisory Statement SS1/21, came into force in March 2022, and the transitional period ended on 31 March 2025. Full compliance is now expected, not pending.

DORA, Regulation (EU) 2022/2554, has applied since January 2025 and imposes ICT risk management, testing and third-party oversight obligations on EU financial entities. UK firms are in scope through their EU operations and through their role as service providers to EU entities.

Every one of those frameworks assumes timing that can be proven. Read alongside the 40.2% who are not confident they could prove their timing to a regulator, and the 7.1% who are very confident they could, the exposure is not that firms are knowingly failing a rule. It is that a substantial proportion do not yet know the rule attaches to a dependency they have never examined.

A firm that has mapped its important business services without mapping its timing dependency has an incomplete map. The rule has been in force since March 2025.

There is demand for a way out of this.

43.9% describe an independent assessment of their timing and positioning resilience as valuable or extremely valuable, with a further 32.2% seeing at least some value in one.

Read against the rest of the study, that appetite is coherent rather than surprising. These are organisations that recognise the dependency, rate its failure as serious, and know they have not tested it. The willingness is not in doubt.

What separates the prepared minority from everyone else is a single step, and it is regular testing against up-to-date scenarios, not a one-off exercise that gets filed away. Independence, evidence and confidence all follow from it. An organisation that has tested what happens when timing degrades knows its own tolerance, can describe its exposure to a board, and can evidence its position to a regulator. An organisation that has not tested is relying on an assumption, however sound its architecture may be.

This is why 61.0% having no completed test is the operative finding in this report rather than a supporting one. Every other weakness the study describes – unowned risk, undetected events, unevidenced timing – persists because the dependency has never been put under load and observed. Testing is not one option among several. It is the step that converts a dependency into a managed risk, and it is the step that has not been taken.

The study describes a dependency that is widespread, largely unexamined, poorly owned, undetectable in the moment and unevidenced afterwards. Recognised as serious by three in ten of the people who operate it, tested by fewer than three in ten, and evidenced with confidence by fewer than one in fourteen.

Four questions are worth putting to any board.

1. Do we know where we depend on GNSS timing, and how long we would last without it? Not whether we use GPS, but where precise time enters our operations, what breaks without it, and what our actual tolerance is. Only 10.2% hold a time source independent of GNSS, and 46.1% could last only a few hours or could not say.

2. Would we detect an interference event, and could we prove our timing held? Detection and evidence are separate capabilities and most organisations sampled have neither. Only 7.1% are very confident of the second.

3. Who owns this risk? If the answer is "IT", that is the same answer 46.9% of organisations gave, and it is the finding this study exists to challenge. If your organisation has a resilience function, ask specifically whether timing sits inside it. In most of those sampled, it does not.

4. Should our important business services mapping include timing? Regular testing is a quick win here: it lets an organisation quantify its risk and measure its own improvement against it. The UK operational resilience transitional period ended on 31 March 2025. A map that omits a dependency this fundamental is not a complete map.

The organisations that come out of this well will not be the ones with the most sophisticated timing architecture. They will be the ones that asked the question at all.

ICDM does not provide testing or assessment services. Organisations seeking to establish their own exposure should approach a specialist provider of PNT test and measurement capability.

GPS Spoofing: Final Report, published by the OPSGROUP International Ops workgroup.

Resilient PNT: Prepare, Act, Recover, best practice and guidance published by the Royal Institute of Navigation.

Direct Intelligence Ltd, of which ICDM is the research arm, offers a confidential PNT resilience assessment, delivered with its global PNT test and measurement partner. A short self-assessment is available at pnt.directintelligence.co.uk. This is disclosed here rather than in the body of the report so that it is read as a commercial relationship and not as a finding.

About ICDM

The Institute of Critical Infrastructure Decision Making researches how decisions are made, evidenced and owned across critical national infrastructure. Its programme covers decision rights and accountability, evidence and audit trails, standards and conformity assessment, and resilience under dependency failure. ICDM publishes original research, the Signal series and the Decision Architecture Series. It is chaired by Gary Daniel Doran.

About Direct Intelligence

Direct Intelligence Ltd, company number 16278923, is a UK critical infrastructure intelligence and standards firm. ICDM is a trading name of Direct Intelligence Ltd. More at directintelligence.co.uk.

Survey data. All survey figures from a study of 1,000 UK respondents working in financial services and in data centre, colocation and cloud infrastructure, commissioned by ICDM and fielded July and August 2026 via an independent research panel. Full response distributions are reproduced in the appendix.

GNSS interference in aviation. OPSGROUP, GPS Spoofing: Final Report of the GPS Spoofing WorkGroup, published 6 September 2024. Reports an increase from approximately 300 spoofed flights per day in Q1–Q2 2024 to approximately 1,500 per day by August 2024, and approximately 41,000 reported interference events between 15 July and 15 August 2024. ops.group/blog/gps-spoofing-final-report/

Economic impact. London Economics, The economic impact on the UK of a disruption to GNSS, commissioned by the UK Space Agency, published via gov.uk, 18 October 2023. Estimates annual GNSS benefit to the UK economy at £13.62bn, seven-day loss at £7.64bn and 24-hour loss at £1.42bn. gov.uk/government/publications/report-the-economic-impact-on-the-uk-of-a-disruption-to-gnss

Clock synchronisation. Commission Delegated Regulation (EU) 2017/574 (RTS 25), supplementing Directive 2014/65/EU (MiFID II), Article 50. Tiered accuracy requirements set out in the Annex, Tables 1 and 2.

UK operational resilience. FCA Policy Statement PS21/3, Building operational resilience, and PRA Supervisory Statement SS1/21. In force 31 March 2022; transitional period ended 31 March 2025. fca.org.uk/publications/policy-statements/ps21-3-building-operational-resilience

Digital operational resilience. Regulation (EU) 2022/2554 (DORA), applicable from 17 January 2025.