Cybersecurity firm SecurityScorecard has assigned a “B” rating to the global aviation sector, highlighting ongoing risks associated with extensive digital supply chains vulnerable to security flaws.
Performance within the industry is uneven, with airlines generally achieving better scores compared to certain specialized aviation technology vendors. This discrepancy introduces significant third-party risks for customers. However, the relationship is reciprocal, with some airlines also creating risks for their vendors due to weak security practices.
SecurityScorecard’s findings revealed recent incidents where breaches at airlines compromised information about their aerospace and aviation suppliers. Additionally, the report highlighted that software and IT services account for up to 75% of third-party breaches across various sectors.
The 2024 report further identified “aggressive nation-state threats” as another critical risk factor for both airlines and the broader aviation industry. The analysis covered 250 companies within the sector, including commercial airlines, manufacturers, maintenance and repair organizations (MROs), service providers, and IT and software vendors.
Despite 70% of the evaluated entities receiving grades of “A” or “B,” the overall outlook is concerning, with 23% scoring “C” or lower and 4% receiving the lowest grade, “F.”
Notably, the report found significant disparities in cybersecurity performance. For instance, airlines with better overall business performance tended to score higher in cybersecurity, although budget constraints did not necessarily correlate with lower performance, as low-cost carriers did not perform worse than their competitors.
Geography also played a role, with Western European and Australian companies outperforming their Asian counterparts in cybersecurity. The report also identified that insecure proprietary apps were a major factor, with 34% of lower-scoring companies seeing their grades adversely affected by such vulnerabilities.
“The aviation industry’s intricate network of partnerships means that the security of any company is dependent on its weakest link. Our research indicates that airlines are not fully aware of third-party risks. It’s imperative for the industry to strengthen security measures across the entire network to prevent potential disasters,” warned Ryan Sherstobitoff from SecurityScorecard.
