Airport cybersecurity when the threat never sleeps

Cybersecurity was already a rising concern for aviation before 2020, but the pandemic made it measurably harder. The sudden shift to remote work, the rapid deployment of new health and passenger-processing systems, and the sheer expansion of the digital attack surface all happened at a moment when staff were stretched and processes were improvised. This piece explains why airport cybersecurity became more difficult in that period and how the industry has responded.

It describes published guidance and general industry practice, including material from Airports Council International (ACI) and IATA, rather than any specific incident’s forensic detail.

The attack surface grew overnight

An airport is a system of systems: check-in, baggage, security screening, access control, flight information displays, airfield lighting, and the operational technology on the ramp, much of it interconnected to a degree that would surprise a casual traveller. During the pandemic, remote access to these systems expanded quickly so that a reduced, often remote workforce could keep essential operations running. Every new remote entry point is a new potential route for an attacker. The convenience was necessary; the exposure was real.

Ransomware found aviation

Through the same period, ransomware, the practice of encrypting an organisation’s systems and demanding payment to restore them, became a serious threat across critical infrastructure, aviation included. Several airlines, airports, and aviation technology providers around the world have publicly dealt with ransomware or other intrusion incidents that disrupted operations or exposed data. The pattern is familiar from other sectors: attackers go where the systems are valuable and the tolerance for downtime is low, and aviation ticks both boxes.

The IT and OT boundary

A particular challenge for airports is the boundary between information technology (IT) and operational technology (OT). The IT side, email and booking and corporate networks, is built with cybersecurity in mind, imperfectly but deliberately. The OT side, the systems that actually move bags and aircraft, was often designed for reliability and isolation rather than for defending against a determined network attacker. As IT and OT have converged, the OT environment has inherited IT-grade threats it was never built to resist. Segmentation, keeping the operational systems separated from the corporate network, is the core mitigation.

Guidance and the shared responsibility

ACI and IATA have both published cybersecurity guidance aimed at the airport and airline community, framing cyber as a shared responsibility across the many organisations that operate at a single airport. The honest difficulty is coordination. A large hub has an airline tenant, a ground handler, a fuel provider, a retailer, a government border agency, and the airport operator itself, all connected in various ways. The security of the whole depends on the weakest of those links, which is why the guidance emphasises governance and information sharing, not just technology.

Defence in depth

The prevailing approach is defence in depth: not a single perimeter but layered controls, so that a breach of one layer does not hand the attacker the whole system. That means network segmentation, strong identity and access management, continuous monitoring, tested incident response, and backups that are genuinely isolated from the network they protect. None of it is glamorous, and all of it is the unglamorous reality of running critical infrastructure in 2026.

The unseen layer under the show

Visitors experience an airport as the journey through it, and the airshow calendar as the spectacle of flight, but neither would function without the digital systems running quietly underneath. Cybersecurity is the unseen layer that keeps the aircraft turning, the bags tracking, and the displays accurate, and the work of defending it is one of the less glamorous duties the industry now carries.