Podcast: Using digital twin tech to protect aircraft from cyberattacks

Yael Katzwer
Hello and welcome to another episode of Cargo Facts Connect, the podcast of Cargo Facts, the publication of record for the air cargo and freighter aircraft industries for over 40 years. I’m Deputy Editor Yael Katzwer, and it’s Friday the twenty-sixth of September. Today I am speaking with Eliran Almog, CEO of Cyviation, a company that provides cybersecurity solutions and fleet security risk assessments.

Yael Katzwer
So tell me a bit about yourself and cyviation, what does your company do?

Eliran Almog
First, I would like to say that I am very happy to be here with you today, Yael. it’s a it’s very exciting, and we are appreciate the opportunity that cargo, facts gave us to join your community. We also are going to participate, hopefully, in your national like, basically annual summit. So that’s thank you for that first cyviation was founded with a very special goal, exclusively to deal with cyber security for the commercial aviation industry, with the understanding that this this area is being developed a very fast in other industries. However, because of the unique characteristic of the aviation industry, the regulation around aviation because of the need of very clear safety, it’s become kind of a paradox that we are not able to to protect core. Directly appropriately the aircraft. While, on the other hand, everything is become more and more digitized and with more with more connectivity at every aspect of the airplane, whether it’s on the operational side of the airplane or on the customer side, of course, with Wi Fi on board and all the in flight entertainment systems, and, of course, predictive maintenance and machine learning and in a lot of items that are here. And in addition to all that, even if you want to give a security to the aircraft from the cyberattack a when you come to the to the aircraft, let’s say, assuming we will overcome all the regulation aspect, it’s still a very complicated entity to protect many networks, many external communication types, many devices that all of them are well connected, many suppliers, both on the design stage of the aircraft and on the on the operation stage of the aircraft. Think, just think about, you know, how many suppliers are touching the aircraft when it’s coming, coming to the gate on your in the airport. Just look around and think about it with sometimes the the ticketing, even the ticketing system, or the, you know, the all the entry system is, is outsourced or and, of course, the cleaning and the and the services and gas and maintenance, and many of these are outsourced, and that’s make it very complicated to protect, because at the end of the day, cyber is an human derived threat. And while human derives threat is not about, necessarily about technology. You know, my, my specific background is not from from technology. In a when I got into this amazing venture and challenge I got in because very, very soon, I understood that, at the end of the day, cyber security is a is a surface of human behavior, and it’s in everything that you were doing within it is related to that. Of course, the technology is an important aspect of that. But at the end of the day, it’s human.

Yael Katzwer
When you talk about that human element. What is that on the aviation side, or are you talking about the bad actors that are perpetrating cyber

Eliran Almog
attacks? It’s both. It’s at the end of the day. It’s the connection between the bad guys to the good guys. They’re doing their day job right at the end of the day, you your whatever, whether you are on them, at the MRO side, with using a laptop to debug in software or whatever, your human behavior can be a surface Take for the bad guys. It’s, and that’s that’s so there are lots of eventually practices, best practices that the industry need to adopt at every level, whether it’s on the training for the air crew or the cabin crew or the maintenance crew on this level of the human behavior, and, of course, at the organization level, from from management perspective, from top down strategy to understand that the cyber security is indeed a threat, a threat not only on the reputation, but also on the safety, which is important aspect.

Yael Katzwer
And I understand, I understand that savation uses digital twin technology. Can you explain a bit about how that works, what it looks like?

Eliran Almog
Yes, of course. So basically, the one, as I mentioned, one of the issues with regular best practices of of the cyber security is the amount of the devices, the amount of network, but also the fact that any aircraft because of the safety and the regulation they need. You need to be certified, and they need to keep a worthiness the entire time it’s fly in a it’s very hard to apply tactics like penetration test and simulation and crawlers and different so. Turtles and patches that can drive in between, move in between devices to make sure that there are no vulnerabilities. It’s very problematic in the in the aircraft. So we identified that problem, and what we basically decided to do is to develop a risk assessment and risk management approach via the digital twin. And the way we are building it is basically from analyzing data only. We are not touching the aircraft physically, whether it’s an through a software or physically touching at all. We just look at the data, the data of the airplane, the the model data, and the data of the maintenance, the specific data of a specific tail number. We’re looking at the entire data, the the the most, as many right? The more. Let’s say depth of data we will get would be a more reliable digital twin eventually, and from this data, we basically map the entire networks, the entire devices, and the connections and communication between the devices, and starting to assess the through that the digital twin the vulnerabilities. And that’s helped us also, not only to identify the vulnerabilities, but also to assess the risk, assess the severity, because if I can, I know I can compromise a specific device through, let’s say, a maintenance laptop, but I know this device is connected to a critical device in the attacker can do what In the industry call lateral movement, that’s increase. Eventually they see the severity or the likelihood of that to happen, and then, and that’s what, how the digital will help us, and eventually what it gives, it gives visibility to the operation and the security, information security of the airline I see a visibility on the entire threat landscape of the aircraft, because we are not looking only at devices. We are looking at the entire environment of the aircraft, whether it’s external communication from air traffic control, from from radios from GNSS, satellite, etc, or via the maintenance the passengers gates and so on.

Yael Katzwer
Who are some clients that you’re currently working with? If you can tell

Eliran Almog
we are, the industry is a very a, I would say, initial state at this, at this stage, because there is not yet a clear regulation. Now, in 2026 basically Yes, are going to apply first time. In effect, part is part, which is information security regulation that is kind of moving on many airlines to stick solution. We are, we have done few POCs, and we are in a in process with a few airlines to keep a keep these POCs to the next stages in a in working with a few other that are looking at our solutions to in order to comply with the yes regulation and with all the other regulation that are being developed, both bayata and by Iko and other bodies that, and, of course, the FAA as well. So that’s that. But the most important thing for us is that, I don’t want to mention yet the name, although it’s a sign in clear, it’s not yet approved to be published, but we already have a validation and an agreement with be one of the bigger manufacturers that is a a with the willingness to basically offer our solution to their client for the airlines,

Yael Katzwer
and you spoke about regulations. Are there certain regulations that you would like to see enacted in order to enhance security, and are there any regulations. That you feel would hamper you.

Eliran Almog
I think, I think that they the regulation as we see a today. I think they understand the situation, and the regulation bodies do their best effort to bring together a framework that will make the airlines and the industry resilient and well prepared for cyber attacks. But however, it’s a process. It’s a it’s one. It won’t happen in a in a year or two. It’s a process of, I believe, at least 10 to 20 years of understanding what are the right tools, what are the right processes, and also, what are the right standards in order to keep a worthiness and license a with compliance to cybersecurity regulation.

Yael Katzwer
And my final question, where are some areas that you feel commercial aviation is lagging when it comes to security, specifically, obviously, cyber security, as opposed to perhaps other industries.

Eliran Almog
I think, I think the a, it’s a great question, because if you ask me about cyber security in aviation, so the it’s, it’s very kind of It’s a paradox, as I said. I mean, at the end of the day, what is the core business of aviation, flying aircraft, right? And if you look at the entire aviation industry, that the the airline they operate, they, let’s say the see saw of the airline. They have a list of assets to protect, and there is only one asset within that, that named aircraft, and this aircraft is the out of all the assets, is the the number one unprotected out of all these assets, because for cybersecurity, from, from the obvious reason that I, that I mentioned at the beginning. So, so I think that this, this is the area that definitely need a an attention now, within that, there are many areas that need an attention. It’s not only the maintenance, it’s not only the devices, it’s not only the technology, it’s also awareness and training. It’s also procedure, and procedure can get also to the to the cockpit. Okay, today, in the cockpit, in the simulator for training for pilots, they don’t do any sort of cyber security attack. They refer for any malfunction to their Q HR, the regular Q HR, and goes by that however, there are many potential attacks or vulnerabilities that only awareness in a little change in the QHR, for example, can help. I’ll give a not I’ll give a very simple, exact example, instrument landing system, an ILS it’s, it’s basically support the the aircraft when it’s land in cloudy area, and also not in cloud area. But the risk is more when, when it’s cloudy in a this, this, this ILS system. It’s simple RF device that transmit to RF wavelengths, unrest and authentic, authenticated and very simple to spoof and spoofing that can be very problematic. However, adding to the QHR of the pilots just to do a cross verification for their location and altitude at the beginning of the approach. With another system can give them the some sort of a hint that the ILS might be spoofed, for example. So in only being aware that the ILF might be spoof, that’s enough, sometimes even without the QHR, because the awareness is a big issues here, and we believe that. And. Industry need to go there as well, and that’s of course, also related to other professions within the aircraft, whether it’s the cabin crew or the maintenance crew.

Yael Katzwer
Great, thank you so much for sitting down with me today.

Eliran Almog
Amazing, amazing. Thank you very much.

Yael Katzwer
That was Eliran Almog, CEO of Cyviation. And that’s all the time we have today. For more coverage of the freighter aircraft and AAM market, visit cargofacts.com. Thank you very much for tuning in, and join us again next time.