With cyberattacks on aviation skyrocketing by 74% since 2020, experts warn that business aviation operators may make attractive targets for hackers involved in industrial espionage, ransomware attacks or business identity theft.
To gain an advantage over these high-tech criminals, the aviation industry is using AI and data science to learn more about how to protect itself against increasing threats to cybersecurity.
According to Daniel Diessner, executive director of Embry-Riddle Aeronautical University’s Center for Aerospace Resilient Systems (CARS), cyberattackers can range from bored teenagers to social-politically bent “hacktivists” to national or state-sponsored hackers to extremely slippery professional cybercriminals.
“They’re looking for any information they can use either against the person or organization or for monetary gains,” Diessner said. “It’s a multi-trillion-dollar business worldwide – you can buy targeted cyberattacks online through the dark web – it’s just scary how easy it is.”
Expert Offers Personal Security Tips for Bizav Crews Traveling Abroad
“Business aviation principals and passengers are higher-value targets to cybercriminals than the typical commercial airline passenger.”
Daniel Diessner Executive Director, Embry-Riddle Aeronautical University Center for Aerospace Resilient Systems (CARS)
Business Aviation Offers ‘Higher-Value Targets’
“Business aviation principals and passengers are higher-value targets to cybercriminals than the typical commercial airline passenger. However, it’s not only the passenger-related information that cybercriminals try to access and control. Instances of GPS/GNSS interference, ADS-B and TCAS spoofing are all on the rise,” Diessner added. “Another growing concern is hackers attempting to gain access to the aircraft’s network to alter aircraft systems information in ways that might try to confuse the flight crews or change systems operations.”
While there are currently no documented, successful attempts to remotely alter an aircraft’s digital information, according to industry experts, this area requires much greater visibility and attention.
No one will argue that we should keep an eye on our aircraft and passengers’ digital security. The problem is that few of us are trained on what it takes to do that.
“From a flight department’s standpoint, cybersecurity is a very abstract concept. Most people think it begins and ends with a network password,” explained NBAA Security Council Member and Gogo Senior Director, Cybersecurity, Josh Wheeler. “The goal is to protect digital data’s confidentiality, integrity and availability from unauthorized access.
“As our aircraft systems become more digitized, the business aviation industry, as a whole, needs to realize that sooner or later someone will make them targets for cyberattacks,” Wheeler said. “Unfortunately, too many operators think that having something as simple as a password to protect their cabin Wi-Fi network is too ‘inconvenient’ for the passengers. The idea of security is totally out of the picture.”
Enlisting Data Science, AI and Machine Learning
Now, the aviation industry has opened a new front in the war on hackers: the FAA’s Cyber Security Data Science (CSDS) unit has extended its contract with Embry-Riddle’s CARS lab to use data science, AI and machine learning (ML) to bolster aviation cybersecurity.
“Today, most cybersecurity compromises are found long after the hacker has come and gone – if they are ever detected at all,” Diessner said. “From a ‘cybersecurity kill chain perspective,’ the goal is to identify their compromises before the hacker can do any bad things.”
The initial phase of the research will focus on simulating data from aircraft systems to train AI/ML models, as well as analyzing the impacts of complex cyberattacks on aviation systems without compromising actual operational platforms.
Diessner, who has been the Embry-Riddle lead principal investigator of the research effort since its start, said, “This virtual aircraft will add another key aviation ecosystem element to the CARS lab to build out a broad aerospace cybersecurity capability here at Embry-Riddle, in partnership with the FAA, the Department of Defense, the Department of Homeland Security and industry.”
“Essentially, the project is trying to drive the capability forward, so we develop standards that provide better protection for the aircraft’s systems,” said Diessner. “These new aviation standards and upgrades are actively being worked on with groups like the FAA, AIA, A4A, ARINC, RTCA and others to establish guidelines we can all use to detect and protect against cyberattacks.
“We need common globally accepted aviation cybersecurity guidelines and standards to maintain the cybersecurity, cyber-safety, and cyber-resilience of the global aviation infrastructure, because the cyber bad guys are really out to get us,” Diessner said.
Removing Personally Identifiable Information
On another front related to online data protection, the FAA is considering a plan to enhance business aviation security by removing personally identifiable information from the FAA Aircraft Registry, an effort strongly supported by NBAA. Aircraft-specific data enable unwanted tracking and exposure of flight operations, compromising the safety of pilots, passengers and companies.
On March 28, the FAA announced in docket FAA-2025-0638 that it plans to establish a process that allows business aircraft owners to request the withholding of personal data such as names and addresses from public dissemination to satisfy requirements in Section 803 of the FAA Reauthorization Act of 2024.
NBAA is encouraging member companies to make their voices heard on the issue by weighing in through the Federal Register, a government platform for industry feedback on policy changes. The association has made the process simple through its Grassroots Action Center, an online advocacy tool available at nbaa.org/action.
The Mindset That Presents the Most Problems
Some operators might like to think that their aircraft’s cabin is a sanctuary from everything negative, but it’s not. It’s this mindset that presents one of the most significant problems with implementing an effective cybersecurity program.
“In most cases, it just comes down to a lack of a fundamental understanding that everything you do online can potentially be intercepted or altered,” Wheeler said. “But that’s no excuse. As business aviation professionals entrusted with protecting our aircraft and passengers, we must take the lead.”
It’s up to operators to help ensure that all the data flowing on and off the aircraft is safe. Unfortunately, passengers are often the weakest links in your cyber-safety chain. It’s not intentional, of course, but they just don’t know.
“I was on a company jet recently, and they didn’t even use passwords for the Wi-Fi because the ‘boss’ felt it was too inconvenient. I’ve seen incredibly expensive firewalls put in place, and the flight department’s hangar is the weakest link because of the simplest mistakes,” Wheeler said. “I think it all starts with everyone admitting cybersecurity is important and taking ownership of their actions.”
Diessner said that flight departments need the company’s IT department to be fully engaged with the aircraft’s online activities.
“They can establish and help implement some best practices for everyone involved and how they use their connectivity devices,” said Diessner. “Also, you need to train your principals and their fellow travelers on your company’s approved security practices on and off the aircraft.
“While they’re probably going to be the same as those used by the rest of your business, the users and your IT team need to recognize and plan for the aircraft being a totally mobile platform,” Diessner said. “But remember, what protocols work in a branch office may not work aboard your airplane.”
Review the list of companies offering cybersecirty services in the NBAA Buyers Guide
Cybersecurity Starts With the Right Connection
While involving your company’s IT department is an excellent starting point, there’s a good chance they’re not familiar with the requirements and limitations of your aircraft’s air-to-ground (ATG) or satcom system.
“The best first step for most operators is to talk to their connectivity service provider,” said Wheeler. “They should already know about your flight operation and aircraft and be able to help audit your security protocols. You are in their data pipeline, and if they can’t answer your questions as quickly and thoroughly as you expect, then there’s a big problem.”
In addition, both Wheeler and Diessner said developing a workable cybersecurity plan should start by assuming your aircraft and passengers are in a “zero-trust environment,” especially when flying internationally.
“Talk about the worst-case scenario and plan for that,” Wheeler said. “Use VPNs when in FBOs, restaurants and hotels, and ‘burner phones’ are always a good idea. Again, it’s about training and awareness.
“I don’t mean to sound like an extremist, but you have to assume something is going to happen, just like you assume you may have an engine failure and you train for it,” said Wheeler. “If you adopt that ‘it will happen’ mindset, you will be better prepared to mitigate any possible issues. Staying ahead is a lot easier than trying to catch up.”
Review NBAA’s resources on cybersecurity at nbaa.org/cybersecurity.
International Business Aviation Council Ltd.