1 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

2 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Airports and airline ground operations rely on complex OT and IoT

networks made up of dispersed subsystems with overlapping ownership,

making them difficult to monitor and secure.

Every component must operate continuously and predictably to ensure

safety and avoid disruption. In this environment, cybersecurity isn’t just an

IT issue — it’s a human safety priority.

Airlines are prime targets for cyberattacks due to the value of their data

and their sensitivity to downtime, with attackers increasingly focused on

disrupting critical infrastructure.

A single breach in a connected system can trigger

cascading operational failures.

Airports: Safety & Reliability First

3 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance 3 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Pervasive IT/OT/IoT

convergence

Complex ownership

with blurred lines

Threat actors targeting

critical infrastructure

Stringent regulatory

requirements

Reducing Cyber Risk and Maintaining Operational Resilience

THE CHALLENGE

Airports face four major cybersecurity challenges:

3 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

http://nozominetworks.com/techspecs

4 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Perimeter SecurityTerminal BuildingsSmart Grid

Water and Waste Management

Traffic Management And Parking

Security Checkpoints Baggage System Gates

Conveyor System

Safety Cameras

Safety Cameras

Safety Cameras

Solar Panels

Smart Meter

Safety Cameras

Autonomous Trains

Info Display System

Parking Sensors

Communications Devices

Safety Cameras

Entry CamerasSafety

Cameras X-ray

Machine Door - Card Key Access

Fire Sensor Ticket ScaNNERS

Water Management

Sensor Waste Management

Network Device

Display Screens

Digital Signage

Traffic Lights

Smart Street Lights

Smart Ticketing

Handheld Scanner

From baggage handling and passenger screening to approach lighting and instrument landing systems, OT and IoT networks play a crucial role in

ensuring the safety, efficiency and reliability of airport operations. A single terminal may have thousands of connected OT and IoT devices – many if

not most of them unmanaged.

The Connected Airport

5 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Terminal buildings & supporting infrastructure

Airport terminals have the same BMS challenges as other smart buildings – but

on a much larger scale. Add to that power grids, water and wastewater systems,

autonomous trains, traffic management and parking control.

Baggage handling systems that cannot fail

Mission-critical BHS sit at the intersection of operational continuity, passenger

experience, safety and revenue. Few systems can cause instant, visible and cascading

disruption as quickly as a BHS failure.

Perimeter security and security checkpoints

Passport control, kiosks, baggage scanners, CCTV and other physical security devices

and their communications must function flawlessly to ensure smooth security checks

and passenger safety.

Display boards, sensors and other IoT devices that keep airports humming

Found throughout the airport, IoT systems are connected to a variety of otherwise

secure networks, often wirelessly, and lack basic cybersecurity hygiene, which makes

them easy to compromise.

Top Cyber-Physical Risks for Airports

Pervasive IT/OT/IoT

convergence means

a cyberattack on any

connected system can

trigger cascading failure,

degrading essential

services and causing

operational shutdowns.

Here are some of the

OT and IoT systems that

must be secured.

6 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Complex Ownership Blurs Lines and Increases Cyber Risk

Airports are complex environments, operated by a mix of public

authorities, private passenger and cargo airlines that lease terminal

space, and third-party companies that operate most ground and

flight support services, including baggage handling systems, gate

operations, fueling and more. Moreover, outsourced services require

persistent access to airport- and airline-controlled networks, which

greatly increases the attack surface.

• Baggage Handling System (BHS) backbone

• Power, HVAC, BMS, life-safety, fire systems

• Runway / taxiway lighting & NAVAIDs

• Perimeter intrusion + access control

• Public Wi-Fi, FIDS, way-finding, signage

• Airside CCTV, parking, traffic

management

• Fuel hydrant farms (often)

• Departure Control Systems (DCS)

• Passenger check-in, boarding

& MUSE-class kiosks

• Crew & flight planning systems

• Aircraft data link / EFB ecosystem

• Loyalty + payment systems (PCI scope)

• Tenant-managed network and

Wi-Fi VLANs

• Ground handling (push-back,

marshalling, GSE)

• Fuel trucks, hydrants, quality

monitoring

• Catering, cleaning, lavatory, waste

• De-icing trucks + glycol systems

• BHS service & sortation maintenance

• Shared IT platforms (e.g. Collins MUSE)

• Cargo handling + ramp coordination

ACCOUNTABLE TO: ACCOUNTABLE TO: ACCOUNTABLE VIA CONTRACT:

TSA / EASA Part-IS (aerodrome) / national CAA /

NIS2 essential entity

TSA aircraft-operator SD / EASA Part-IS (operator)

/ NIS2 / PCI DSS

Airport / airline supply-chain clauses; few are

NIS2 essential entities directly

Airport Operator Airline / Tenant Third-party / Ground Handler Owns terminals, runways, apron, perimeter and shared OT infrastructure.

Leases gates and back-of-house — owns its own ops tech, identity, and crew/passenger data.

Persistent network access — most expansive attack surface, lowest direct accountability.

Who's responsible when there's a breach or failure?

7 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Prime Targets in a Sky-high Threat Landscape

Geopolitical tensions correlate with increased

cyberattacks on critical infrastructure, aiming to

disrupt systems that underpin daily life, including

safe travel

Artificial intelligence enhances the speed, scale

and adaptability of attacks, allowing opportunistic

actors to scan for insecure, exposed OT and IoT

devices that grant them initial access to then

move laterally

With their imperative to transport

passengers and cargo safely and on-time,

airports and airlines are prime targets

for threat actors including nation-state

advanced persistent threat (APT) groups,

ransomware groups, hacktivists and

malicious or negligent insiders.

Two factors are exacerbating these threats:

Recent High-profile Cyberattacks

Multiple European Airports

Aeroflot / Sheremetyevo Airport

Seattle-Tacoma International Airport​

EU - A ransomware attack on a shared third-party aviation IT service

provider disrupted passenger-handling systems across multiple

European airports. Check-in, boarding, and baggage systems were

unavailable, forcing airports to revert to manual operations, resulting

in widespread delays and flight cancellations.​

RUSSIA - A major cyberattack on internal IT infrastructure led to

widespread system outages affecting flight scheduling, check-in, and

passenger communications. The incident resulted in the cancellation

and delay of dozens of flights, causing severe disruption at

Sheremetyevo Airport and stranding passengers.​

USA - Authorities worked with the FBI and CISA after the Russian-

affiliated Rhysida group demanded $6 million in ransom to decrypt

systems. They refused to pay the ransom but had to manually handle

7,000 pieces of luggage and issue paper boarding passes while

internet, web and Wi-Fi remained down.​

2025

2025

2024

8 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

For aviation, 2025–26 is when "guidance"

became enforceable obligation.

Airports and airlines are heavily regulated globally, as both critical

infrastructure and within the aviation sector. In addition to the NIS2

Directive, EASA Part-IS in the EU and the TSA Security Directives

and Emergency Amendments in the U.S. and are the most

challenging. Arguably the most stringent aviation cyber regulation,

EASA Part IS increasingly serves as the global benchmark.

Cybersecurity Regulatory Compliance for a “System of Systems”

The European Union Aviation Safety Agency (EASA) warns

that aviation is a “system of systems” where cyber incidents

can cascade into safety risks. Part-IS requires stakeholders across

the aviation sector to protect all safety-critical systems, including

OT and IoT, from cyber and information threats through:

• Asset inventory

• Risk management, including supply chain risk

• Continuous monitoring and detection

• Incident reporting

The Transportation Security Administration (TSA) has

statutory authority to issue mandatory directives immediately,

at any time. The TSA Security Directives for Aviation require:

• IT/OT segmentation, OT visibility and OT patching

programs

• Securing of baggage systems, fueling and access control

– without disrupting operations

• A cybersecurity implementation plan with evidence of

effectiveness

• Timely incident reporting to CISA

“With the rapid pace of digitalization,

regulations may not keep up with the

emerging cyber risks. Aviation-sector

organizations need to ensure their

cyber risk posture and efforts extend

beyond compliance, towards a holistic

risk management approach.” – World Economic Forum

9 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance 9 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Asset visibility and

vulnerability management

Continuous threat and

anomaly detection

Prioritized remediation for

measurable risk reduction

A Complete Platform for OT/IoT Cyber Resilience

THE SOLUTION

To achieve operational resilience and meet compliance requirements, airports and airlines need:

9 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

http://nozominetworks.com/techspecs

10 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

The Leading AI-powered Platform for OT and IoT Visibility and Security​

The Nozomi platform helps aviation organizations

comply with regulations and keep airplanes flying by

providing a complete, accurate inventory of OT and

IoT assets, risk-based vulnerability management,

network segmentation validation and continuous

security monitoring to detect and respond to the

threats and anomalies that matter most.

Gain Context with Unparalleled Asset Visibility and Vulnerability Management

• Build an accurate, real-time asset inventory with passive and active

discovery techniques for wired and wired networks and fluency

in over 200 OT and IoT protocols, along with active scanning on

sensitive OT endpoints that IT security agents may damage.

• Asset profiles are enriched via data integrations and an AI engine

that learns from millions of global to fill in information and provide

complete visibility into asset status and behavior.

• Automatically detect and assess vulnerabilities in “insecure-by-design”

OT and IoT devices, many of which lack authentication, encryption and

other security standards. Benefit from regularly updated vulnerability

databases and OT and IoT security research from Nozomi Networks Labs.

Prevent Incidents from Becoming Outages with Continuous Threat and Anomaly Detection

• Leverage signature-based threat detection and the Nozomi Threat

Intelligence feed to detect known threats, with sensors continuously

updated with emerging malware and IOCs specific to OT and IoT

• Use AI-powered behavior-based anomaly detection techniques, including

deep packet inspection, to detect operational anomalies and zero-days.

Prioritize Remediation Efforts So SOC Teams Never Miss a Critical Issue

• Calculate risk by asset, sensor, zone, site and enterprise using

weighted risk factors that reflect asset criticality and exploitability,

including CVSS, EPSS and KEV scores and more.

• Reduce alert fatigue with an AI engine that continuously identifies,

analyzes, correlates and prioritizes issues across your environment,

focusing attention on the threats with the greatest potential impact.

11 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

• Diverse and extremely complex OT, IoT, and IT environments

• Low visibility into the mix of OT/IoT/IT systems and isolated

networks with high volumes of traffic

• Multiple integrations required with third-party systems,

e.g., data lake/SIEM/SOC

• Consolidated visibility across diverse systems and

thousands of endpoints

• 90% reduction in time to visibility and improved security

analysis

• Real-time insights into OT/IoT vulnerabilities and risks

Challenge

Results

CASE STUDY

Top 5 Global Airport

Nozomi Networks helped a Top Five global airport

improve visibility and security with real-time insights

into OT/IoT vulnerabilities to quickly address cyber

and operational risks.

12 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Where Are You on Your OT/IoT Cyber Journey? Where Do You Need to Be?

Asset Visibility Incident Response Risk Management

Actively Manage Vulnerabilities

□ Classify and prioritize vulnerabilities based on asset criticality and exploitability

□ Exposure, vulnerability trends, and predicted risks are tracked

Have Continuous Asset Discovery

□ AI-powered asset enrichment □ Targeted active queries to collect OS, firmware,

patch level, etc. safely.

Automated & Centralized Asset Tracking

□ Have basic vulnerability mapping

□ Can visualize basic network topology, zones, and protocol use

□ Global asset database

□ Wired, wireless, & endpoint sensors

□ CMDB integrations

Assets Tracked Manually

□ Excel-based □ Sales orders

OT/IoT Risk Identification, Prioritization, & Reduction

□ Can communicate OT/IoT risk in business terms to the board

□ Investments are prioritized based on quantified risk reduction

Regulatory & Standards Compliance Reporting & Tracking

□ Produce auditor‑ready reports for site‑level and enterprise‑level controls

□ Can map detections and dashboards to specific controls

□ Maintain customizable, multi‑level risk scoring by asset, zone, site

Policy & Rule Management

□ OT security policies exist but are not actively implemented or audited

□ Audit evidence is difficult to collect

Proactive OT/IoT Incident Response

□ Automated remediation □ AI-assisted incident response □ SOC integrated IR playbooks □ Detect and respond to wireless threats □ Threat intel is presented via threat actor

profiles with recommended mitigations

Intel-driven OT/IoT SecOps

□ OT/IoT specific threat intel integrated into SOC workflows

□ Have deployed OT/IoT detections

□ Have operational baselining of our environment

Fragmented OT/IoT Threat Response

□ Rely on IT scanners that lack OT/IoT context

□ Response playbooks are informal or inconsistent

13 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

TH IR

D -P

A R

TY IN

TE G

R A

TI O

N S

POWERED BY AI

Asset Management

Incident Response

Risk Reduction

VANTAGE

SENSORS:

+OT IoT

Endpoint Embedded Remote DatabasesWirelessWired

A Complete Platform for OT/IoT Cyber Resilience

Unparalleled visibility - the

foundation for operational and

cyber resilience

Prevent incidents from

becoming outages with OT/IoT-

specific threat intel, detections

and proactive response

Quantify, improve and

communicate OT/IoT risk for

continued cyber resilience

The only hybrid & resilient

architecture that scales with your

business and an evolving threat

landscape

Powered by purpose-built AI that

transforms OT/IoT telemetry into

actionable intelligence

The Nozomi platform gives airports and airlines the context, control and confidence to

withstand cyber threats — without disrupting safety or reliability.

14 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

Find out how Nozomi Networks can help you gain

context, control and confidence to withstand cyber

threats — without impacting reliability and safety.

EBOOK

View Platform Request a Demo

12K+ Worldwide Installations in all Industries

Top airports rely on Nozomi Networks

Next Steps

115M+

125+ Airports

30+ Secure Facilities Devices Monitored Across Converged Cyber Physical Systems

Covering Airport, Airline and Third-Party Operations

Across Government and Military Projects

https://www.nozominetworks.com/platform https://www.nozominetworks.com/demo/

15 EBOOK

Airports: Cybersecurity for Operational Continuity & Compliance

NN-OT-AIRPOIRT-EBOOK-002

nozominetworks.com

Cybersecurity for OT, IoT and Critical Infrastructure Nozomi Networks protects the world’s critical infrastructure from

cyber threats. Our platform uniquely combines network and endpoint

visibility, threat detection, and AI-powered analysis for faster, more

effective incident response. Customers rely on us to minimize risk and

complexity while maximizing operational resilience.

© 2026 Nozomi Networks, Inc. | All Rights Reserved.