Aviation came up on Built This Week through guests working where failure is not an option. Sagi Waitzman, CTO of Cyviation, uses AI to build a digital twin of an aircraft's onboard computers, so airlines can assess cyber risk without touching the plane. Ryan Aytay of Code Metal argues that AI can write code for aircraft and other critical systems, but it can't be trusted until it is verified. A third guest, Sohrab Haghighat, is an aerospace engineer who now builds AI for hardware design.
I think the most important thing that people need to understand that you can't do pen test to an airplane.
— Sagi Waitzman, Episode 28
How companies we talked to use AI in aviation
Cyviation: cyber risk assessments on a digital twin
Sagi said a modern airplane has "his own server room" on board. Cyviation maps those systems, checks versions and connections, and works out how an attacker could move from one system to another. Before AI, building that twin meant people reading more than 100 documents by hand. Now AI takes in more documents and versions and cross-checks systems faster. Physically testing a plane would ground it for about a year until recertification. (Episode 28, from 04:37)
Customers are airlines and private jet management companies, because regulators hold whoever manages the aircraft day to day responsible. Sagi said 2026 rules now treat cyber attacks as a safety issue. His examples were concrete: change a pilot tablet's route by one degree on an intercontinental flight and the plane may not have the fuel to land. Get the baggage weight data wrong and takeoff speed and runway length are off.
Code Metal: verified code for mission-critical systems
Code Metal translates legacy code to new languages and hardware, then verifies it with formal methods, testing and fuzzing so it behaves identically. Aerospace is one of its targets alongside defense, the grid, cars and medical devices. Ryan pointed to the CrowdStrike outage that took down air traffic control and many flights as an example of what one bad line of code can do. Code Metal's founder worked on F-35 simulation, and Ryan said the company is trusted by the Air Force. (Episode 48)
But the reality is, like, in a production world, AI generated code actually isn't quite safe enough and really never will be for what we'll call a mission critical system at the edge.
— Ryan Aytay, Episode 48
Hestus: AI for aerospace-grade hardware design
Sohrab ran a rocket launch company before co-founding Hestus, which adds autocomplete to CAD on top of Autodesk Fusion. Its users are mechanical engineers broadly, including aerospace and robotics engineers. He said every click saved is one less chance for a mistake in the design. (Episode 53)
What we built
Sam built a flight ops cyber radar for Episode 28. The dashboard lists risks across ground radio, fuel logistics, vendor credentials and airport RFID. It flagged a critical alert for unexpected vendor API activity in crew scheduling and generated an AI "captain briefing." Sagi liked the UI and the red alert, but corrected the premise: Sam's tool covers ground IT, which is what most people picture, while Cyviation assesses the airplane itself.
What's still hard
- You can't test the real system. Pen testing an aircraft is off the table, so assessments rely on documents and models.
- AI code is "mostly correct." Ryan said that isn't enough where failure is catastrophic. Translation is only part of the job; verification and optimization for the target hardware are the hard parts.
- Legacy code. Many critical systems run on old code bases that few engineers still know. Some migrations, like MATLAB to VHDL, are harder than C++ to Rust.
- Vibe coding stays internal. Sagi's team uses AI heavily and hires "managers" of AI agents rather than developers, but he said vibe coding is still for internal tools, not production.
Episodes on AI in aviation
- Episode 28: Why You Can't Pen Test an Airplane with Sagi Waitzman of Cyviation (January 2026).
- Episode 48: The Code Running Your Plane Was Written Decades Ago with Ryan Aytay of Code Metal (June 2026).
- Episode 53: He Ran a Rocket Launch Company with Sohrab Haghighat of Hestus (October 2026).
FAQ
How is AI used in aviation?
Cyviation, whose CTO Sagi Waitzman joined us in Episode 28, uses AI to read 100+ aircraft documents and build a digital twin of a plane's onboard computer systems, then runs cyber risk assessments on the twin instead of the aircraft.
Why can't you pen test an airplane?
Sagi said physically testing an airplane would keep it on the ground for about a year until it could be certified again, and no one wants to fly a plane a hacker probed the day before. A digital twin lets airlines assess risk without grounding the aircraft.
Is AI-generated code safe for aircraft software?
Code Metal president Ryan Aytay says no, not on its own: AI-generated code is mostly correct, but mission-critical systems need it to be provably correct, so Code Metal verifies translated code with formal methods, testing and fuzzing.
What aviation cybersecurity rules are changing?
Sagi said new regulations arriving in 2026 treat cyber attacks as a safety threat to the aircraft, and the party that manages the airplane day to day, such as an airline or private jet manager, is responsible for compliance.