Digital Saboteurs: Unmasking Insider Cybersecurity Threats in Aviation and Aerospace

Keywords: aviation cybersecurity, aviation administration, cybersecurity risk management, insider cybersecurity threats, insider threat detection, organizational arsonists, organizational behavior, organizational culture

Abstract

Insider risks in aviation and aerospace are frequently underestimated, perceived as isolated technical glitches rather than intentional acts capable of crippling air traffic control and endangering passengers. Comparable to arsonists who wield fire to destroy, these internal adversaries leverage their trusted positions to inflict financial loss, disrupt operations, and undermine organizational cohesion. The financial impact is significant, with incidents contained within a month averaging $10.6 million, while prolonged breaches can exceed $18 million. Such events consistently divert cybersecurity resources from strategic initiatives to reactive crisis management, imposing substantial ongoing costs on aviation organizations. This commentary-style article reframes insider cybersecurity threats using the metaphor of organizational arsonists, offering a unique and powerful framework for comprehending these complex risks in the aviation sector. This research adopts a multidisciplinary perspective, blending cybersecurity, legal frameworks, and psychological analysis to offer an extensive strategy for countering insider threats beyond purely technical solutions. It emphasizes the necessity of human-centric strategies, ethical accountability, and legal compliance, calling for aviation organizations to adopt a holistic defense posture that addresses technological vulnerabilities and behavioral risks. The article's originality lies in bridging multiple disciplines and framing insider threats as technical challenges and full-scale organizational crises within the aviation and aerospace industries. Combining advanced technologies such as artificial intelligence with human behavior analysis provides actionable strategies for aviation organizations to combat their digital arsonists. This interdisciplinary approach encourages cybersecurity professionals, legal scholars, and organizational leaders in aviation to rethink insider threat management, creating a more resilient and secure organizational environment.

References

ABB. (2024). Coming full circle: Introducing ABB EcoSolutions. https://global.abb/group/en/sustainability/ecosolutions
Baran, G. (2024, May 13). Boeing confirms LockBit hackers demanded $200 million ransom after 2023 data breach. Cyber Security News: Ransomware. https://cybersecuritynews.com/boeing-confirms-lockbit-demanded/
Bovenizer, N. (2024, May 10). Boeing confirms 2023 $200m ransomware demand. Airport Technology. https://www.airport-technology.com/news/boeing-confirms-2023-hack-200m-ransomware/
Burrell, D. N., Lewis, E. J., & Richardson, K. (2023). Adaptive marketing, management strategy, and technology innovation in beverage and hospitality markets. International Journal of Innovation in the Digital Economy (IJIDE), 14(1), 1–10. https://doi.org/10.4018/IJIDE.330524
Burton, S. L. (2023). Cybersecurity risk: The business significance of ongoing tracking. In D. N. Burrell (Ed.), Transformational interventions for business, technology, and healthcare (pp. 245–268). IGI Global. https://doi.org/10.4018/979-8-3693-1634-4.ch015
Burton, S. L. (2022). Cybersecurity leadership from a telemedicine/telehealth knowledge and organizational development examination (Publication No. 29066056) [Doctoral dissertation, Northcentral University]. ProQuest Dissertations & Theses Global.
Butaka, G. (2021, November 17). Human error in cyberspace. ISACA. https://www.isaca.org
Cheraghi, R., Ebrahimi, H., Kheibar, N., & Sahebihagh, M. H. (2023). Reasons for resistance to change in nursing: An integrative review. BMC Nursing, 22, 310. https://doi.org/10.1186/s12912-023-01460-0
Cybersecurity & Infrastructure Security Agency. (n.d.). Defining insider threats. Author. https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats
Dave, G., Choudhary, G., Sihag, V., You, I., & Choo, K. K. R. (2022). Cyber security challenges in aviation communication, navigation, and surveillance. Computers & Security, 112, 102516. https://doi.org/10.1016/j.cose.2021.102516
Davies, N. (2025, June 9). Cybersecurity in aviation: Rising threats and modernization efforts. Secureworld. https://www.secureworld.io/industry-news/aviation-cybersecurity-threats
Eleimat, M., & Őszi, A. (2025). Cybersecurity in aviation: Exploring the significance, applications, and challenges of cybersecurity in the aviation sector. Periodica Polytechnica Transportation Engineering, 53(2), 169–183. https://doi.org/10.3311/PPtr.37153
Errida, A., & Lotfi, B. (2021). The determinants of organizational change management success: Literature review and case study. International Journal of Engineering Business Management, 13, 1–15. https://doi.org/10.1177/18479790211016273
FBI Seattle. (2018, November 9). FBI completes investigation into August 2018 unauthorized flight from Seattle-Tacoma Airport. https://www.fbi.gov/contact-us/field-offices/seattle/news/press-releases/fbi-completes-investigation-into-august-2018-unauthorized-flight-from-seattle-tacoma-airport
Federal Aviation Administration. (2024). NextGEN annual report 2024. https://www.faa.gov/nextgen/NextGen-Annual-Report-2024.pdf
Garcia-Blanco, B. (2022, May 16). Threathunt 2030: Future cybersecurity threats for aviation sector. European Union Aviation Safety Agency (EASA). https://www.easa.europa.eu/community/topics/threathunt-2030-future-cybersecurity-threats-aviation-sector
Garg, N., & Sharma, N. (2025). Does gratuitous behaviour promote workplace nonviolence? Exploring the mediating role of constructive deviance. International Journal of Emerging Markets, 20(4), 1686–1704. https://doi.org/10.1108/IJOEM-07-2022-1129
Gelles, M. G. (2021). Insider threat prevention, detection, and mitigation: Building an insider threat program. In J. R. Meloy & J. Hoffmann (Eds.), International handbook of threat assessment (2nd ed., pp. 669–693). Oxford University Press. https://doi.org/10.1093/med-psych/9780190940164.003.0037
Gheyas, I. A., & Abdallah, A. E. (2016). Detection and prediction of insider threats to cyber security: A systematic literature review and meta-analysis. Big Data Analytics, 1(1), 6. https://doi.org/10.1186/s41044-016-0006-0
Gimarelli, C. (2025). The hidden threats in the skies: Cybersecurity lessons from recent aviation crises. Cyentia Institute. https://www.cyentia.com/the-hidden-threats-in-the-skies-cybersecurity-lessons-from-recent-aviation-crises/
GlobeNewswire. (2024, March 5). 2024 data exposure report: Companies at risk of data loss driven by changing workforce, AI usage, and source code exfiltration. Author. https://www.globenewswire.com/news-release/2024/03/05/2840495/0/en/2024-Data-Exposure-Report-Companies-at-Risk-of-Data-Loss-Driven-by-Changing-Workforce-AI-Usage-and-Source-Code-Exfiltration.html
Industrial Cyber. (2024, January 30). Aviation industry faces rising cybersecurity risks as new technologies drive adoption, says Aviation ISAC survey. Author. https://industrialcyber.co/reports/aviation-industry-faces-rising-cybersecurity-risks-as-new-technologies-drive-adoption-says-aviation-isac-survey/
International Civil Aviation Organization. (2022). ICAO insider threat toolkit. https://www.icao.int/Security/securityculture/Documents/Insider%20threat%20toolkit.EN.pdf
Jones, L. A. (2024). Unveiling human factors: Aligning facets of cybersecurity leadership, insider threats, and arsonist attributes to reduce cyber risk. Security, 8(2), 44–63. https://doi.org/10.21511/sec.8(2).2024.04
Jones, L. A. (2020). Reputation risk and potential profitability: Best practices to predict and mitigate risk through amalgamated factors (Publication No. 28152966) [Doctoral dissertation, Northcentral University]. ProQuest Dissertations & Theses Global.
Kizilcan, S., & Mizrak, K. C. (2022). Cyber attacks in civil aviation and the concept of cyber security. International Journal of Disciplines Economics & Administrative Sciences Studies, 8(47), 745–748.
Klenka, M. (2021). Aviation cyber security: Legal aspects of cyber threats. Journal of Transportation Security, 14(3–4), 177–195. https://doi.org/10.1007/s12198-021-00232-8
Krull, K. E. (2016, August). The threat among us: Insiders intensify aviation terrorism (PNNL-25689). U.S. Department of Energy. https://www.pnnl.gov/main/publications/external/technical_reports/PNNL-25689.pdf
Kupiek, M. (2023). Revisiting organizational change management (OCM): A context-sensitive and dynamic approach of change. In M. Kupiek & R. A. Brandmeier (Eds.), The digital transformation of Georgia (pp. 91–106). Springer. https://doi.org/10.1007/978-3-031-26451-1_7
Labree, W., Nijman, H., van Marle, H., & Rassin, E. (2010). Backgrounds and characteristics of arsonists. International Journal of Law and Psychiatry, 33(3), 149–153. https://doi.org/10.1016/j.ijlp.2010.03.004
Lambert, K. (2025, September 18). Hackers demand $6 million for files stolen from Seattle airport operator in cyberattack. AP: The Seattle Times. https://apnews.com/article/seattle-airport-cyberattack-ransomware-rhysida-95cd980a9f45112f0fdce488233eec9c
Lauzier, J. G. (2025). Insurance design and arson-type risks. Annals of Actuarial Science, 19(1), 126–139. https://doi.org/10.1017/S1748499524000186
Lekota, P., & Coetzee, M. (2019). Cybersecurity incident response for the sub-Saharan African aviation industry. In 2019 International Conference on Advances in Big Data, Computing and Data Communication Systems (icABCD) (pp. 1–6). IEEE. https://doi.org/10.1109/ICABCD.2019.8851011
Leppard Law Firm. (2024, December 20). Evaluating insider threats under the Computer Fraud and Abuse Act and US federal law. Author. https://leppardlaw.com/federal/computer-crimes/evaluating-insider-threats-under-the-computer-fraud-and-abuse-act-and-us-federal-law/
Leppard Law Firm. (2021). Analyzing the role of cybersecurity negligence in damage cases under federal law. Author. https://leppardlaw.com/federal/computer-crimes/analyzing-the-role-of-cybersecurity-negligence-in-reckless-damage-cases-under-federal-law/
Lykou, G., Anagnostopoulou, A., & Gritzalis, D. (2018). Implementing cyber-security measures in airports to improve cyber-resilience. In 2018 Global Internet of Things Summit (GIoTS) (pp. 1–6). IEEE. https://doi.org/10.1109/GIOTS.2018.8534575
Mahdi, A. K., & Assim, M. I. S. A. (2025). Managing unprofessional behavior in the workplace: An organizational psychology perspective. International Journal of Science Academic Research, 6(1), 9023–9024.
Majzoub, M. S. (2025, June 27). Insider threats are the trojan horse of cybersecurity in the AI era. Forbes. https://www.forbes.com/councils/forbestechcouncil/2025/06/27/insider-threats-are-the-trojan-horse-of-cybersecurity-in-the-ai-era/
Malik, H. (2025, March 19). Why the aviation industry needs robust cybersecurity strategies. Access Intelligence. https://www.satellitetoday.com/cybersecurity/2025/03/19/why-the-aviation-industry-needs-robust-cybersecurity-strategies/
Mimecast. (2024). Annual data exposure report 2024. https://www.mimecast.com/resources/white-papers/annual-data-exposure-report-2024/
National Insider Threat Special Interest Group. (2021). Legal counsel support to insider threat program. Author. https://www.nationalinsiderthreatsig.org/itrmresources/Laws%20And%20Regulations%20Related%20To%20Insider%20Threats-Espionage-Fraud%2012-15-14.pdf
National Academies of Sciences, Engineering, and Medicine. (2025). Actions from federal government needed to alleviate air traffic controller staffing shortages at many facilities. https://www.nationalacademies.org/news/2025/06/actions-from-federal-government-needed-to-alleviate-air-traffic-controller-staffing-shortages-at-many-facilities-says-new-report
Nobles, C. (2022). Stress, burnout, and security fatigue in cybersecurity: A human factors problem. HOLISTICA: Journal of Business and Public Administration, 13(1), 49–72. https://doi.org/10.2478/hjbpa-2022-0003
Osborne, C., & Thompson, J. A. (2024). Shedding new light for nurses: Enhancing pressure injury prevention across skin tones with sub-epidermal moisture assessment technology. Journal of Advanced Nursing, 80(6), 2450–2460. https://doi.org/10.1111/jan.16040
Petkauhas, V. (2023, November 15). Boeing breach: LockBit leaks 50 GB of data. Cybernews. https://cybernews.com/news/boeing-data-leak-lockbit-ransomware/
Pincus, E. (2025, January 27). The ultimate guide to security awareness training. INFOSEC. https://www.infosecinstitute.com/resources/security-awareness/ultimate-guide/
Plachkinova, M., & Knapp, K. (2023). Least privilege across people, process, and technology: Endpoint security framework. Journal of Computer Information Systems, 63(5), 1153–1165. https://doi.org/10.1080/08874417.2022.2128937
Ponemon Institute & DTEX. (2025). Cost of insider risks global report.
Ponemon-Sullivan Report. (2023). Cost of insider risks global report – 2023. https://ponemonsullivanreport.com/2023/10/cost-of-insider-risks-global-report-2023/
Quinn, S., Waheduzzaman, W., & Djurkovic, N. (2025). Impact of organizational culture on bullying behavior in public sector organizations. Public Personnel Management, 54(2), 184–208. https://doi.org/10.1177/00910260241287619
Rafi, T. (2022, June 9). Why sustainability is crucial for corporate strategy. World Economic Forum. https://www.weforum.org/agenda/2022/06/why-sustainability-is-crucial-for-corporate-strategy/
Said, S. (2024). Emerging aviation security challenges: Preparing for 2025. LinkedIn. https://www.linkedin.com/pulse/emerging-aviation-security-challenges-preparing-2025-safieeldin-said-3wawf
Slauson, T., & FOX 13 Seattle Digital Team. (2024, September 13). Cyberattack that brought down Sea-Tac Airport systems was ransomware. FOX 13 Seattle. https://www.fox13seattle.com/news/sea-labor-day-cyberattack-ransomware
Smith, G. (2024, December 10). Insider threat statistics: (2025’s most shocking trends). StationX. https://www.stationx.net/insider-threat-statistics/
Ukwandu, E., Ben-Farah, M. A., Hindy, H., Bures, M., Atkinson, R., Tachtatzis, C., Andonovic, A., & Bellekens, X. (2022). Cyber-security challenges in aviation industry: A review of current and future trends. Information, 13(3), 146. https://doi.org/10.3390/info13030146
U.S. Equal Employment Opportunity Commission. (n.d.). Facts about retaliation. Author. https://www.eeoc.gov/facts-about-retaliation
United States Department of Justice. (2021). Justice manual: Computer Fraud and Abuse Act (CFAA). Author. https://www.justice.gov/jm/jm-9-48000-computer-fraud
Weber, L. (2025). Annex 17 and related aviation security measures. In J. R. Huang (Ed.), The Elgar companion to the law and practice of the International Civil Aviation Organization (pp. 456–470). Edward Elgar Publishing. https://doi.org/10.4337/9781035315987.00039
Published
2025-07-15
How to Cite
Burton, S. (2025, July 15). Digital Saboteurs: Unmasking Insider Cybersecurity Threats in Aviation and Aerospace. Law, Economics and Society, 1(2), p1. https://doi.org/https://doi.org/10.30560/les.v1n2p1
Section
Articles