From connected to resilient: protecting the hyperconnected airport ecosystem

Modern airports are hyperconnected ecosystems where IT, OT, IoT and AI continuously converge. This integration drives efficiency, but fundamentally transforms risk. The question is no longer whether individual systems are secure, but whether the airport can continue operating when one of the interconnected elements fails.

The expanding ecosystem

Airport digitalisation has accelerated the convergence of systems that previously operated partially or completely independently. Passenger processing, access control, video surveillance, baggage handling, energy management, cargo operations and predictive analytics increasingly depend on shared digital infrastructure. These systems are rarely developed or operated by a single organisation. Airports depend on airlines, ground handlers, retailers, technology providers, equipment manufacturers, regulators and third parties, each with different levels of technological maturity and approaches to cyber-security. The result is a domino-effect architecture, where every one is a piece aligned in sequence: the interconnection that gives the ecosystem its strength is also what makes it fragile. A vulnerability in one system triggers failures in others; a compromised IT credential propagates into operational technology systems; the weakness of a single provider brings down processes the airport believed were independent.

Cyber-security has thus become a matter of operational resilience. SITA reports that airport investment in technology reached 7.3% of revenues in 2025, while 71% of airports identify cyber-security as their top concern. The attack surface is expanding at the pace of digital transformation: IoT devices, sensors, smart cameras and connected operational systems are increasingly integrated into airport infrastructure. These technologies improve operational visibility, but introduce thousands of devices with different update cycles and security practices.

IT-OT convergence is particularly significant. Baggage handling, HVAC, boarding bridges, fuel distribution and building management systems are now connected through IP networks. This creates operational benefits, but reduces the separation that traditionally protected critical operational processes. The concept of a clearly defined technology perimeter is disappearing, as is the boundary between physical security and cyber-security. Access control and video surveillance systems depend on IP networks. A cyber incident can produce physical consequences, while a physical breach can become the first step toward a cyber incident. At an airport, the door protecting a telecommunications room and the firewall protecting the network behind it are part of the same security environment.

New capabilities, new exposures

As connectivity grows, so does the volume of data generated. Its value has increased because real-time integration and analysis of multiple sources are now possible. Data exchange among airports, airlines and air navigation service providers can help reduce delays and optimise resources through the use of artificial intelligence (AI), which is becoming a natural complement in these areas of efficient processing and decision-making. AI can analyse enormous amounts of information and recommend, or potentially initiate, actions with limited human intervention. But the more autonomous a system becomes, the more critical it is to control who can access it, what data it can use, what actions it can execute and how anomalous behaviour is detected. Each new capability must be assessed not only for what it enables, but also for the dependencies and vulnerabilities it creates.

The supply chain is where this risk ceases to be theoretical. In September 2025, a ransomware attack against operational platforms used for passenger processing at multiple European airports simultaneously disrupted check-in and boarding at several European airports. No airport was breached directly: a single common provider was enough to force them back to manual processes for days. Providers’ security practices are not always under the operator’s direct control, even though their systems are deeply integrated into operations. This is why vendor management must cease to be merely a contractual formality and become shared risk management. Cyber-security requirements must extend across the entire chain, from vendor selection through contract termination.

The consequences of a successful cyber-attack go far beyond data loss. When critical systems become unavailable, airports may be forced to return to manual processes, generating queues, delays and cancellations that can last for days. The economic impact includes recovery costs, business interruption, reputational damage and disruption to passengers. Availability has become an asset as critical as confidentiality and integrity. For an airport, keeping systems secure means keeping operations moving.

Building resilience through ‘zero trust’

If the airport no longer has a clearly defined digital perimeter, its security model must evolve. Zero trust architecture provides a framework for this transition, based on the principle of never trust, always verify. In airport operations, this involves several layers of implementation. OT network micro-segmentation ensures that critical systems (BHS, HVAC, boarding bridges, power plants, etc.) operate in isolated network segments with granular access policies, so that a breach in one system does not allow lateral movement into others. Privileged identity management requires access to critical systems to use multi-factor authentication, privileged access management and least-privilege principles, with every access request authenticated, authorised and logged regardless of its origin. Continuous verification means that, unlike the traditional perimeter model, sessions must be periodically re-validated and anomalous behaviour must generate automatic alerts. Finally, unified IT-OT visibility ensures that threat detection spans both environments through platforms that correlate events from networks, end-points and industrial systems, making it possible to identify attack patterns that cross domains. This approach is especially relevant where legacy systems coexist with modern technologies. Replacing all legacy systems is not always feasible, and resilience requires security architectures capable of operating within this technological diversity. For assets that cannot tolerate session re-authentication or monitoring agents, the compensating control is not continuous verification but strict segmentation and passive traffic monitoring.

Cyber resilience cannot be added after a technology has been selected and implemented. Security is decided at the time of purchase, alongside functionality, cost and operational performance, and is sustained through cyber-security governance, technology architecture, vendor risk management and incident response capabilities.

Lessons from Quito Airport

At Corporación Quiport, concessionaire in charge of administrating, operating and maintaining the Quito International Airport, experience has reinforced this approach. Quiport assesses its OT vendors through a structured risk methodology based on international standards, and the results have shown that OT represents a significant cyber risk because of the different levels of cyber-security maturity among its vendors compared with traditional IT providers; joint and co-ordinated action plans have been developed to mitigate these risks. Formal procedures have been established for the contract lifecycle, ensuring that cyber-security requirements are incorporated into vendor selection and management across IT, OT and IoT environments. In addition, Quiport is developing an internal corporate incident management framework and has worked to incorporate and co-ordinate cyber incidents within the Airport Emergency Plan, aligned with ICAO requirements, so that they form part of the airport’s overall emergency response framework rather than being treated as isolated technology events. Fundamentally, cyber-security has become part of the corporate culture because it has senior management support, dedicated resources, strategic positioning as a cross-cutting priority and periodic assessment by independent organisations.

Airport connectivity is no longer in question: that process is irreversible. What is in question is whether resilience can be sustained at the same pace at which systems are integrated. This requires four shifts: from protecting individual systems to protecting the entire ecosystem, from implicit trust to explicit verification, from contractual vendor management to joint risk management from the earliest stages, and from security as an after-the-fact control to security as a design criterion.

The destination is not simply the smart airport. It is the resilient airport: one where the pieces remain connected, because that interconnection is the source of its efficiency, but where the fall of one no longer brings down the others.