Protecting business aircraft operations from cybercrime

Market Insight

by CJI Expert

November 11, 2026

A modern business aircraft is part aircraft, part office and part connected data environment. Words by Iain Houseman, president of ZenithJet.

During a single trip, sensitive information moves between the aircraft, crew, flight department, company systems and a long list of outside providers. That connectivity makes the operation work. It also gives criminals more places to look for a weak point.

The answer is not to make every pilot, engineer or dispatcher a cybersecurity specialist. It is to give people clear rules, reliable tools and the confidence to pause when something does not feel right. Strong access controls, secure aircraft connectivity, careful supplier management and a rehearsed response plan make that possible.

Why business aviation attracts cybercrime

NBAA points to a simple reality: business aircraft carry people and information that may be unusually valuable. A passenger list can reveal who is travelling. A schedule can reveal when a senior executive is unavailable. A cabin conversation may involve a transaction, legal matter or strategy that would never be discussed in public. Smaller flight departments may also have less dedicated security support than an airline or a large corporate IT function. [1][2]

Attackers understand the rhythm of the operation. A late schedule change, a fuel release, a maintenance finding or an urgent payment request can arrive when the team is busy and working across time zones. That pressure is useful to a criminal, because it encourages people to act before they verify.

AI makes impersonation faster and more convincing

Poor spelling and clumsy wording once made many scam messages easy to spot. AI has removed much of that warning. It can copy an executive’s tone, reproduce a familiar voice and combine information from company websites, social media and stolen data. A fraudulent request to change bank details or release passenger information can now look and sound completely genuine.

NBAA’s July and August 2026 Business Aviation Insider article describes AI-assisted phishing and deepfake executive impersonation as growing threats. An NBAA Security Council member estimated that attacks affecting business aviation were doubling each year. It is important to treat that as an experienced practitioner’s estimate, rather than a complete industry incident count, but the direction of risk is clear. [3]

CJI describes a separate demonstration in which Gogo’s Josh Wheeler recreated a colleague’s voice from a voicemail and used it to request an aircraft from a flight department. This illustrates impersonation, rather than a verified theft or unauthorised flight. [17]

What the NBAA figures show

The following charts separate incident growth, survey opinions and vendor vulnerability research. They cannot be added together or used to calculate a business aircraft’s probability of attack. No complete business aviation incident census is provided by these sources.

Figure 1 NBAA reports a 600% increase in reported aviation-sector ransomware attacks between 2024 and 2025, citing Thales [9]. Index calculated as 100 × (1 + 6) = 700. Actual counts and collection methods are not given on the NBAA page; this is not a count of compromised business aircraft.

Figure 2 NBAA reproduces CyberAngel/GetApp’s 2024 survey of data security experts [9]. These percentages measure concern, not attack frequency; categories may overlap and are not identified as an aviation-only sample.

Figure 3 NBAA’s June 2026 interview reports Cyviation’s in-house findings [10]. The maintenance bar marks the stated 60% threshold; the actual share exceeds it. The second category is approximately 20%. Sample size, denominator and fleet coverage are not disclosed; no residual category is inferred.

Where an attacker may aim inside the organisation

Cyber risk does not sit neatly inside the IT department. NBAA’s reporting shows how the same piece of information can be used against different people: an itinerary can help impersonate an executive, a maintenance connection can expose an aircraft system and a supplier invoice can be redirected through the finance team.

Organisational target	What the attacker wants	Typical route into the operation
Owner board and executives	Authority, identity, confidential discussions and travel patterns	Deepfake calls, executive impersonation, social media and stolen credentials
Finance and administration	Payments, banking information and supplier records	Altered invoices, urgent transfer requests and compromised email threads
Flight operations and dispatch	Schedules, manifests, permits and operational continuity	Phishing, supplier compromise and loss of planning or communications systems
Crew	Aircraft access, passenger information and connected devices	Public or FBO Wi-Fi, weak passwords, mobile devices and social engineering
Maintenance	Diagnostic access, software loading, records and aircraft-connected equipment	Legacy laptops, removable media, remote access and uncontrolled updates
IT security and suppliers	Administrator access, cloud data and trusted connections	Credential theft, vulnerable integrations, subcontractors and ransomware

The main operational attack paths

Exposure	How it can be exploited	Operational response
Identity and payments	Phishing, stolen credentials, deepfake calls and altered supplier invoices.	Use phishing-resistant MFA where practical and verify payment or bank-detail changes through a separately sourced channel.
Aircraft connectivity	Weak Wi-Fi passwords, cached credentials, unpatched cabin systems and insecure FBO networks.	Disable unnecessary wireless services under approved procedures; control authorised connections, apply approved updates and verify network separation.
Passenger and schedule data	Exposed manifests, itineraries, registrations, photos and social-media posts can support targeting or physical surveillance.	Limit collection and access, use secure channels, define retention periods and control publication of identifying information.
Maintenance and mobile devices	Diagnostic laptops, removable media, electronic records and vendor remote access can bridge corporate and aircraft environments.	Use managed devices, approved media, least privilege, malware scanning, logging and controlled vendor access.
Suppliers	Flight planning, connectivity, FBO, maintenance, catering, transport and payment providers can expose data or interrupt operations.	Assess vendors before appointment, include security and incident-notification terms, and review critical suppliers periodically.
Navigation and communications	GNSS jamming blocks signals; spoofing introduces false position, navigation or timing data.	Brief affected routes, follow manufacturer and regulator guidance, recognise indications and retain alternative navigation procedures.

A maintenance laptop can carry the threat aboard

In Rob Hodgetts’ H1 2026 Corporate Jet Investor report, Wheeler recounts a malware-infected maintenance laptop connecting to an aircraft’s Wi-Fi, recording keystrokes and attempting to transmit data externally. Gogo detected the attempted transmission and alerted the OEM. The owner requested replacement of the router and modem. This is an interview account, not a published forensic investigation; it does not establish compromise of flight controls. [17]

For maintenance oversight, require an agreed device-access process before work begins. Record which managed device connects, its authorisation, the purpose of access and when that access ends. Agree how the MRO and connectivity provider will preserve evidence and escalate an alert. If compromise is suspected, coordinate containment with approved technical support; replacing hardware alone should not be assumed to resolve the incident.

Cabin disruption also needs an operational response

CJI’s contributors identify privacy loss, disrupted connectivity, nearby access at FBOs and cabin interference as concerns. Cyviation’s Roy Arad warns that disruption could distract crews. These are risk scenarios and expert assessments, not evidence that cabin Wi-Fi access gives control of an aircraft. [17]

Assess the safety consequences of distraction separately from the commercial consequences of losing internet service. A passenger’s need for connectivity may affect the decision to travel, but airworthiness and dispatch eligibility must be determined under the aircraft’s approved requirements and the operator’s procedures.

Controls that make a practical difference

The most useful controls are the ones people can follow on a difficult day, during a time-critical trip or when a senior person is asking for an immediate answer. They should make the safe action obvious and give staff a clear route for checking anything unusual.

Govern the risk

• Assign an accountable executive and a named operational owner for cybersecurity.

• Maintain an inventory of aircraft-connected systems, company devices, privileged accounts, software, data flows and critical suppliers.

• Set policies for data handling, aircraft and public Wi-Fi, personal devices, remote access, removable media, social media and software updates.

• Use the six functions in NIST Cybersecurity Framework 2.0 – Govern, Identify, Protect, Detect, Respond and Recover – to organise responsibilities and improvement work. [4]

Strengthen identity and payment controls

• Require MFA for email, cloud services, VPNs, scheduling systems, maintenance systems and administrator accounts. CISA recommends phishing-resistant MFA for high-risk and critical services. [5]

• Give each person a unique account and remove access promptly when roles change or employment ends.

• Restrict administrator privileges and review them regularly.

• Verify new bank details, changes to payment instructions and unusual urgent transfers by calling a known contact on a number obtained independently of the request.

• Use dual approval for high-value or exceptional payments. Independently authenticate unusual aircraft-use requests and changes to authorised passengers or destinations. A familiar voice, email thread or caller identity is insufficient approval on its own.

Secure aircraft connectivity and maintenance access

• Disable unnecessary aircraft wireless services while parked in accordance with approved procedures. Where connectivity supports authorised maintenance or monitoring, restrict and supervise that access rather than applying a blanket shutdown.

• Use strong, unique passwords; change them after maintenance, charter activity or suspected disclosure.

• Do not allow devices to connect automatically to FBO or public networks.

• Ask connectivity providers how traffic is encrypted, who monitors security alerts, who responds outside office hours, how router configuration changes are controlled, where data is stored and how incidents are reported.

• Verify separation of passenger, crew and maintenance traffic against the approved installation. Document permitted data flows, including remote diagnostics and off-aircraft telemetry, and reassess them after connectivity modifications.

• Apply manufacturer-approved updates to cabin, connectivity and maintenance systems. Do not make unauthorised changes to certified aircraft systems.

• Control diagnostic laptops, removable media and remote maintenance sessions; log access and scan approved devices before connection.

CJI also highlights expanding transfers of engine and operational data off the aircraft. This warrants review of interfaces; it does not by itself demonstrate failure of certified network separation. [17]

Protect flight and passenger information

• Treat manifests, itineraries, contact details, aircraft identifiers and executive travel patterns as sensitive operational information.

• Share information only with people and suppliers who need it, through approved secure channels.

• Limit aircraft photographs, registration details and real-time trip information published online. NBAA specifically recommends policies for aircraft identification and social-media use. [1]

• Review logs for aircraft connectivity, email, scheduling and critical cloud services so that unusual access can be investigated.

Manage the supply chain as part of the operation

NBAA security specialists recommend treating vendor vetting as a continuing process rather than a one-time check. The aircraft is an extension of the executive office, and providers may handle aircraft access, payment details, itineraries or passenger information. [6]

• Identify which suppliers can access the aircraft, systems or sensitive data and rank them by operational impact.

• Check ownership, reputation, references, financial health, staff screening, access controls and data-security policies.

• Contract for minimum controls, prompt incident notification, cooperation with investigations, secure data return or deletion and oversight of subcontractors.

• Review critical providers periodically and remove dormant accounts or connections.

• Maintain workable alternatives for essential services such as flight planning, communications, fuel, maintenance and ground transport.

Prepare for GNSS interference

NBAA’s 2025 checklist highlights jamming and spoofing, particularly near conflict areas. EASA defines jamming as interference that prevents or degrades reception and spoofing as counterfeit signals that produce false position, navigation or timing information. EASA and EUROCONTROL reported in 2026 that interference had become a regular occurrence near conflict zones. [2][7]

• Include current interference information in route and threat briefings.

• Train crews to recognise inconsistent position, timing or navigation indications and to apply aircraft manufacturer and regulator procedures.

• Retain proficiency in alternative navigation and cross-checking methods.

• Report events through the applicable operational, safety and regulatory channels so that trends can be assessed.

GPS spoofing and jamming are different threats

GPS is one constellation within GNSS. Jamming can deny reception; spoofing can supply convincing false position or timing. These events belong in the safety and security risk assessment, but their presence alone does not establish cybercrime, a criminal motive or an intrusion into the aircraft network. State activity, authorised testing and unintentional interference must be considered separately. [12]

Figure 4 IATA reports a 220% increase in GPS signal-loss events from 2021 to 2024 in its GADM Flight Data eXchange [11]. Derived endpoints are 100 and 320; intervening years are not estimated. Signal loss is not a spoofing-only count or an all-aircraft global census. Absolute counts and flight exposure are not supplied in the release.

The operational effect can extend beyond a moving map. FAA guidance identifies possible effects on hybrid inertial navigation, PBN capability, terrain warnings, ADS-B outputs and aircraft clocks used for CPDLC. Independent position cross-checks and manufacturer procedures matter: an EFB or a second display is not necessarily an independent source. [12]

Changing NOTAMs require a current briefing

A NOTAM describes an operational condition over a stated area and period; it is not a complete map of every interference event. Treat published warnings as one input to dispatch, alongside regulator advisories, recent reports and approved flight-planning information. Absence of a warning should not be treated as assurance that GNSS will remain reliable. The following briefing workflow is an operational recommendation, rather than a claim that every jurisdiction has adopted a new NOTAM rule.

Before release and again after a material delay or route change, obtain current route, FIR, destination and alternate NOTAMs through the approved briefing service. Check the notice identifier, whether it is new, replacing or cancelling another notice, validity in UTC, daily activation schedule, geographic coverage and altitude limits. Read the operational text as well as the coded fields. Include GNSS-dependent approaches, conventional navigation-aid outages and the missed approach in the assessment.

Distinguish a planned GPS or WAAS interference test from a warning about reported jamming or spoofing, and from predicted RAIM unavailability. A RAIM availability prediction cannot prove that counterfeit signals will be absent. EUROCONTROL’s AUGUR combines RAIM prediction, GNSS NOTAM information, interference advisories and aerodrome dependency tools; it supports, rather than replaces, the operation’s approved briefing process. [15]

Guidance changed through 2025 and 2026

June 2025: IATA and EASA called for common radio reporting and standardised NOTAM Q codes, alongside better monitoring [11]. This is a harmonisation objective, not evidence that implementation is complete everywhere. March 2026: NBAA highlighted the substantially revised FAA resource guide, version 1.1 [16]. Also in March, EASA and EUROCONTROL published a joint action plan covering near-term safety and longer-term resilience [14].

3 July 2026: EASA published SIB 2022-02 Revision 4, adding emphasis on pilot–ATC phraseology, EFB integration, operational and training measures, and ATC capacity [13]. EASA’s associated affected-region information is updated weekly. Operators should therefore control the revision of guidance in their manuals and briefing packs, as well as the currency of individual NOTAMs. A Safety Information Bulletin is distinct from a NOTAM or an airworthiness directive.

Briefing and reporting should close the loop

Dispatch should identify usable navigation and approach alternatives, any capacity restrictions and fuel contingency. Crews should apply aircraft-specific procedures, cross-check position where suitable independent aids exist and request ATC assistance when needed. FAA guidance includes a specific reporting exception for known NOTAMed testing areas unless assistance is required. After flight, record anomalies for maintenance follow-up and submit a detailed report through the applicable authority’s channel. [12]

For oversight, record the NOTAM identifier and revision, briefing time, affected segment, crew acknowledgement, operational decision and post-flight outcome. Useful internal measures include the proportion of affected flights with a refreshed briefing and the time taken to close interference-related maintenance findings. These are proposed management measures; no industry-wide performance percentages are asserted.

Build an incident response that supports safe operations

A cyber incident rarely arrives with a clear label. It may begin with a suspicious invoice, an unusual login or a scheduling system that suddenly stops working. By the time the pattern becomes clear, the operation may also be dealing with exposed passenger information or uncertain maintenance records. The response plan must therefore bring flight operations, safety, maintenance, IT, legal, communications, insurers and key providers together quickly.

• Define who can isolate an account or device, suspend a supplier connection, delay a transaction or move the operation to an alternate process.

• Publish a simple reporting route for staff and preserve relevant messages, logs and device information.

• Keep offline or otherwise protected backups of critical records and test restoration.

• Maintain printed or securely available continuity information for essential contacts, passenger handling, dispatch and maintenance coordination.

• Pre-agree notification thresholds for management, customers, insurers, regulators and law enforcement, taking account of applicable jurisdictions.

• Run table-top exercises covering phishing, a compromised maintenance laptop, a cloned-voice aircraft request, supplier compromise, loss of connectivity or scheduling, passenger-data disclosure and GNSS interference.

Training should follow the operating cycle

People remember a short exercise based on a realistic flight far better than a long annual presentation. NBAA compares cyber awareness with recurrent aviation training, and the comparison is useful: skills need refreshing, and the scenario should resemble the decisions people actually make before, during and after a trip. [3]

• At induction: approved devices, passwords, MFA, data handling, public Wi-Fi and reporting.

• Before international trips: local cyber risk, device preparation, connectivity, sensitive discussions and GNSS interference.

• For finance and managers: payment diversion, executive impersonation and out-of-band verification.

• For crew and maintenance: aircraft networks, removable media, diagnostic equipment, software approvals and abnormal navigation indications.

• After exercises or incidents: a concise review of what happened, what was detected and which control or procedure must change.

Standards and assurance

ISO IEC 27001 can provide a formal information security management system, supported by ISO IEC 27002 controls and the cloud-focused guidance in ISO IEC 27017 and 27018. NIST CSF 2.0 offers a flexible management structure, while ICAO guidance connects cyber risk with aviation safety, security and operational resilience. [4][8]

Certification can demonstrate discipline, but operators should judge effectiveness by evidence: known assets, controlled access, current approved software, tested recovery, trained personnel, managed suppliers and a response process that works under operational pressure.

A practical ninety day programme

Period	Priority actions	Evidence of completion
Days 1 to 30	Name owners; map systems, data and suppliers; enforce MFA; establish payment verification; identify unsupported or unpatched assets.	Approved responsibilities, current inventory, MFA coverage report and documented payment protocol.
Days 31 to 60	Review aircraft and FBO connectivity; assess critical vendors; confirm backups; publish reporting and response procedures.	Connectivity review, vendor risk register, successful restore test and incident contact list.
Days 61 to 90	Run phishing and incident exercises; brief crews on GNSS interference; close priority findings; brief senior leadership.	Exercise report, training record, risk decisions, action owners and target dates.

Staying ahead

Business aviation already knows how to manage risk. It assigns responsibility, uses checklists, trains repeatedly and learns from reports that something nearly went wrong. Cybersecurity needs the same practical discipline. Technology matters, but it cannot make up for an unchecked payment request, an unmanaged supplier, an exposed itinerary or a response plan that nobody has practised.