5.05Critical infrastructure

Aviation & Airspace Cybersecurity

Security assessment and testing for airports, airlines, air navigation service providers, maintenance organisations and drone operators: independent verification for EASA Part-IS, airport operational technology on IEC 62443, and the supplier and navigation dependencies behind the 2024–2026 disruptions.

Book a consultation+371 2256 5353

EASA Part-IS applies to aerodrome operators since 16 October 2025 and to air carriers, air navigation service providers, maintenance and training organisations since 22 February 2026. It requires an information security management system covering every system that can affect safety, a risk assessment and proof that the treatment works. Our testing produces that proof and maps each finding to the Part-IS point it supports, alongside the National Cybersecurity Law and the cyber provisions of Regulation (EU) 2019/1583 on aviation security.

Airport operational technology is assessed as OT: baggage handling, access control, the airport operational database and flight information displays, common-use check-in and boarding platforms, instrument landing and navigation-aid networks, fuel and building management. The September 2025 ransomware attack on a shared check-in platform stopped several European airports at once, so supplier attack paths and shared platforms are in scope by default.

For air navigation and flight operations we review dependence on GNSS, ADS-B and electronic flight bags and the fallbacks that exist when signals are jammed or spoofed – which Latvian air navigation recorded 195 times in August 2025 alone. For drone operators and manufacturers we test command-and-control links, remote identification and geo-awareness data integrity against Regulation (EU) 2019/945. Two OffSeq specialists hold the NATO CCDCOE Critical Information Infrastructure Protection qualification.

Part-IS
aerodromes since 16 Oct 2025; operators, ANSPs and MROs since 22 Feb 2026
195
GNSS interference cases recorded by Latvian air navigation in August 2025
Source: LGS, reported by AIN, opens in a new tab

Where we work in the Purdue model

Airport systems map onto the same levels as any industrial site, so one picture covers the terminal, the airside and the suppliers connected to both.

  • Actively tested
  • Passive capture and configuration review
  • Spares, replica lab or bench only
  • Out of scope

Enterprise zone · IT

  1. 5

    Enterprise network

    Corporate IT, identity, email, cloud and internet access

    Actively tested

    Corporate IT, service desk and identity – the path of the 2025 airline intrusions.

  2. 4

    Site business systems

    ERP, scheduling, logistics and site IT

    Actively tested

    Common-use check-in and boarding platforms and the supplier connections behind them.

Industrial DMZ

  1. 3.5

    Industrial DMZ

    Jump hosts, remote-access gateways, patch servers, historian replicas

    Actively tested

    Supplier and vendor remote access into airport operational networks.

Industrial zone · OT

  1. 3

    Site operations

    Historians, MES, OT domain controllers, engineering workstations

    Actively tested

    AODB, FIDS and baggage, access-control and building-management servers at the agreed tier.

  2. 2

    Supervisory control

    SCADA servers, HMIs, alarm and operator stations

    Passive capture and configuration review

    Baggage-handling, access-control and navaid-monitoring HMIs.

  3. 1

    Basic control

    PLCs, RTUs and IEDs; safety systems sit in a zone of their own

    Spares, replica lab or bench only

    Baggage and access-control controllers, tested only on spares.

  4. 0

    Physical process

    Sensors, actuators, drives and valves

    Out of scope

    Never touched: conveyors, airfield lighting and navigation aids in operation.

How it works

  1. 01

    Scope & regulatory map

    Which Part-IS rule, NIS2 category and security programme applies to each system in scope.

  2. 02

    Assessment

    Zones and conduits across operational, passenger and supplier systems; exposure and remote access.

  3. 03

    Testing

    Tiered testing of conduits, platforms and supplier connections under airport-specific rules of engagement.

  4. 04

    Navigation review

    GNSS, surveillance and EFB dependencies and the fallback the operation relies on.

  5. 05

    Reporting

    Findings mapped to Part-IS points, National Cybersecurity Law requirements and the security programme, with a remediation plan.

Packages

Part-IS Verification
Technical testing and an evidence pack for one organisation’s Part-IS risk assessment.
Airport OT AssessmentPopular
Zone-and-conduit assessment and testing of airport operational systems.
Air Navigation & Operations
GNSS, surveillance and EFB dependency review with a tabletop exercise for ANSPs and airlines.

Supported by our own threat-intelligence platform

Supplier exposure is where the 2025 airport disruptions started; we keep watching it.

Experience this scenario interactively

A hands-on 3D simulation of this threat, followed by an explanation of how we test it in a real engagement.

Social engineering · VoiceIdentify a fraudulent support callA caller claims to be IT support and requests access or verification information. Assess the request and verify the caller before taking action.Open simulationRed team · PhishingIdentify a phishing emailInspect a suspicious email, including the sender, links and urgency cues, and decide whether to report it or proceed.Open simulation
All simulationsGet certified at training.offseq.com, opens in a new tab

Frequently asked questions

Part-IS does not name penetration testing. It requires a risk assessment of information security risks with a potential safety impact and proof that the treatment is effective. Independent testing is the most direct way to produce that proof, and our report maps each finding to the Part-IS point it supports.

Helpful tools

What clients say about working with us

SaaS
“Instead of slowing us down, they seamlessly integrate with our fast-moving engineering team, providing proactive, high-level insights that let us fortify our systems in real time as we grow.”

Karlis Broders

CTO · Trace.Space

Fintech
“Partnering with OffSeq on a red team engagement gave us a genuine adversarial perspective that went well beyond a traditional penetration test.”

Oskars Zīle

CISO · Eleving Group

E-commerce
“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”

Oskars Podziņš

Head of Information Security · Printful

All services

Scope a test

[email protected]+371 2256 5353

Direct access to a senior specialist · Reply within 24 hours · NDA available on request

Scope a testGet in touch