ZenithJet's Iain Houseman Outlines Cybercrime Defences for Business Aircraft Operations

Iain Houseman, president of ZenithJet, wrote as a CJI Expert that a modern business aircraft is part aircraft, part office and part connected data environment. Sensitive information moves between the aircraft, crew, flight department, company systems and outside providers during a single trip.

Houseman says the answer is not to turn every pilot, engineer or dispatcher into a cybersecurity specialist. Instead, he argues, people should be given clear rules, reliable tools and the confidence to pause when something looks wrong, supported by strong access controls, secure aircraft connectivity and careful supplier oversight.

He cites NBAA reporting that business aircraft carry unusually valuable information such as passenger lists, executive schedules and confidential cabin conversations, and that smaller flight departments may have less dedicated security support than airlines. NBAA's July and August 2026 Business Aviation Insider article describes AI-assisted phishing and deepfake executive impersonation as growing threats. An NBAA Security Council member estimated that attacks affecting business aviation were doubling each year; the article treats this as a practitioner's estimate, not a complete industry figure.

The article maps attack routes across the organisation: executives face deepfake calls and stolen credentials, finance faces altered invoices and urgent transfer requests, flight operations and dispatch face phishing and supplier compromise, and crew face public or FBO Wi-Fi and weak passwords. Maintenance faces legacy laptops, removable media and remote access, while IT and suppliers face credential theft and ransomware.

In Rob Hodgetts' H1 2026 Corporate Jet Investor report, Wheeler recounts a malware-infected maintenance laptop connecting to an aircraft's Wi-Fi, recording keystrokes and attempting to transmit data externally.

The recommended controls begin with governance: naming an accountable executive and an operational owner, and keeping an inventory of aircraft-connected systems, devices, privileged accounts and critical suppliers. The article points to the six functions of NIST Cybersecurity Framework 2.0 — Govern, Identify, Protect, Detect, Respond and Recover — as the organising structure.

On access, it calls for multi-factor authentication on email, cloud, VPN, scheduling, maintenance and administrator accounts, citing CISA's recommendation of phishing-resistant MFA for high-risk and critical services. It also calls for unique accounts with prompt removal of access and restricted administrator rights.

The framing treats the aircraft as one node in a chain that includes the cabin, the flight department, the finance office and every outside provider. In that model an attacker does not need to reach the aircraft itself; a convincing invoice, a spoofed executive call or a compromised supplier account can do the damage from the ground.

That matters most for smaller flight departments, which the NBAA reporting says may have less dedicated security support than airlines. The approach Houseman describes leans on ownership, inventories and clear rules rather than specialist headcount, which is a model a small department can adopt without a dedicated security team.

The doubling-each-year estimate is a practitioner's view, not a measured industry statistic, so the useful test is how well each department can show who owns its cyber risk, what connected systems it has and which suppliers can touch them.