Manchester Airports Group

magairports.com · 15 vendors

Resilience scores

Technology vendors

Insights

Last updated 2026-08-31 · revision 2

15 direct vendors, 231 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Manchester Airports Group's migration readiness score is 45, placing it in the medium readiness category. The primary challenge stems from a significant reliance on on-premise and potentially legacy infrastructure for core airport operations, including Chroma AODB, FIDS, IPTV, Managed LAN, CCTV, and radio communications systems. Migrating such deeply integrated and critical systems typically involves substantial re-engineering, cost, and time. While the presence of modern elements like Flight Information APIs, Passenger Flow APIs, a Digital Experience Platform (DXP), and the CAVU propel™ platform suggests some areas are more amenable to cloud adoption or integration, these likely do not encompass the most complex operational systems. Critical unknowns significantly hinder readiness: there is no specified data on regulatory environment, data residency requirements, or financial stability (which impacts the ability to fund a large-scale migration). The vendor landscape, with 'Total Services: 23' from vendors across 4 countries, presents a complex picture. While geographic diversity in vendors can be positive, the 'Unknown' vendor lock-in risk is a major concern. If these 23 services are from a few critical vendors with proprietary systems, it could lead to high lock-in and significant migration hurdles. The lack of clarity on the number of distinct vendors and contract complexities makes a precise assessment of vendor lock-in difficult, but the sheer number of services suggests a potentially intricate web of dependencies.

Compliance

13 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

As a critical national infrastructure operator handling sensitive passenger data, biometric data, operational technology (OT) systems, and air traffic-adjacent IT systems, ISO 27001 certification is highly relevant and likely expected by regulators, partners, and government stakeholders. The CAA and UK government's cyber resilience frameworks for aviation strongly encourage or require ISO 27001-aligned controls. MAG IT's role as an internal IT service provider further increases the relevance. Non-certification does not constitute non-compliance per se, but absence of a certified ISMS at this scale represents a significant governance gap.

Evidence: https://magairports.com/about-us/mag-it/, https://magairports.com/about-us/cavu/, https://www.iso.org/isoiec-27001-information-security.html, https://www.ukas.com/find-an-organisation/

Modern Slavery Act 2015 — Compliant

MAG is required to publish an annual Modern Slavery Transparency Statement under Section 54 of the Modern Slavery Act 2015, given its turnover exceeds the £36 million threshold. MAG has consistently published statements from 2016 through 2026, demonstrating active compliance. Risk is Medium because supply chain complexity in aviation (retail, construction, cleaning, catering, ground handling) creates inherent modern slavery risks that require ongoing due diligence.

Evidence: https://magairports.com/work-with-us/policies-and-statements/, https://assets.live.dxp.maginfrastructure.com/f/73114/x/d060906b02/modern-slavery-transparency-statement-2026-final-240726.pdf, https://assets.live.dxp.maginfrastructure.com/f/73114/x/1e492d9ded/modernslaverystatement_mag_2025.pdf, https://www.legislation.gov.uk/ukpga/2015/30/section/54

UK NIS Regulations 2018 — Assessment Required

MAG is the UK's largest airport group and is almost certainly designated as an Operator of Essential Services (OES) under the UK NIS Regulations 2018. Aviation is explicitly listed as a transport sub-sector under NIS. As an OES, MAG must implement appropriate and proportionate security measures and report significant incidents to the Civil Aviation Authority (CAA), which is the designated competent authority for aviation NIS. Non-compliance can result in fines up to £17 million. The scale of MAG's operations (61.3 million passengers, critical national infrastructure) makes this a high-risk area. The UK government's Cyber Security and Resilience Bill will expand and strengthen these obligations.

Evidence: https://www.legislation.gov.uk/uksi/2018/506/contents/made, https://www.caa.co.uk/our-work/publications/documents/content/cap1753/, https://magairports.com/

Financials

Three-year financials

Financial Resilience Score: 7/10

Manchester Airports Group demonstrates strong financial resilience underpinned by its position as the largest UK airport group, serving approximately 1 in 5 UK air travellers through Manchester, Stansted, and East Midlands airports. FY25 delivered record revenue (£1.34bn), EBITDA (£570m), and passenger volumes (65m), fully surpassing pre-pandemic levels. Investment-grade credit ratings of Baa1 (Moody's stable) and BBB+ (Fitch stable) reflect solid financial standing, supported by over £0.7bn total liquidity including a £500m undrawn RCF and £135m standby facility. The group benefits from a diversified revenue mix across aeronautical (35%), car parking (30%), retail (24%), and property/other (11%), reducing single-stream dependence. Long-dated debt maturities extending from 2034 to 2058, including a debut €500m Eurobond in March 2025 and a £300m 18-year bond in April 2024, provide refinancing flexibility. Supportive shareholders (Greater Manchester local authorities plus IFM Investors) demonstrated commitment via a £300m equity injection during Covid. However, several risks temper the score. Net Debt/EBITDA rose to 3.7x in FY25 (from 3.2x in FY24), and a substantial £2.5bn capex programme over five years will push leverage toward the top of the 3.5x–4.5x target range. Geographic concentration in three UK sites, airline concentration among Ryanair, easyJet, and Jet2, and exposure to cyclical/exogenous shocks (as demonstrated by Covid reducing FY21 passengers to ~7m) present ongoing vulnerabilities. Rising interest rates have materially increased refinancing costs, with new bond coupons of 5.75%–6.125% replacing older 2.875% debt.

Key strengths: Largest UK airport group with ~20% share of UK air travellers, Record FY25 revenue (£1.34bn) and EBITDA (£570m), Investment-grade ratings: Baa1 (Moody's) / BBB+ (Fitch), both stable, £0.7bn+ total liquidity including £500m undrawn RCF, Long-dated, laddered debt maturities from 2034 to 2058, Diversified revenue mix (aero 35%, parking 30%, retail 24%), Supportive shareholder base (Greater Manchester councils + IFM Investors), Strong cash generation (£570.7m from operations in FY25)

Risk factors: Geographic concentration in three UK airport sites, Airline concentration (Ryanair, easyJet, Jet2), £2.5bn capex programme over next 5 years increasing leverage, Net Debt/EBITDA rising to 3.7x, near top of 3.5x-4.5x target range, Cyclical/exogenous exposure (pandemics, geopolitics, consumer spending), Rising interest rates increasing refinancing costs (5.75%-6.125% vs prior 2.875%), Regulatory oversight of aeronautical charges, Decarbonisation obligations (Net Zero by 2038), Significant debt burden including £902m shareholder loans and c.£2bn listed bonds

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report