Cyviation CTO Sagi Waitzman on why you can't pen test an airplane, how AI builds a digital twin of its computers, and the new cyber rules airlines face.
You can't pen test an airplane, because no airline wants to fly a plane that a hacker was trying to break into the day before, and physical testing could ground it for about a year. Sagi Waitzman, CTO of Cyviation, explained on Episode 28 of Built This Week how his company assesses cyber risk on board an aircraft instead: it maps the plane's computer systems into an AI-built digital twin and runs a risk assessment from documents and maintenance data.
Sam opened the episode with a demo he built with Cyviation in mind, a Flight Ops Cyber Radar dashboard that rated risks by area and raised a red alert on unexpected third-party API activity in crew scheduling. Sagi liked the red alert, which he said felt like something out of Star Trek. But he pointed out that it showed what most people think aviation cybersecurity is: checking the systems on the ground.
Cyviation checks the airplane itself. Sagi says a modern plane has so many computers that it has its own server room inside, and someone has to make a risk assessment for it. Cyviation's technology maps the different computer systems in the aircraft. Then its logic analyzes them: it checks versions and connections, using everything it can get from documents and from the information it collects from the MRO (maintenance, repair and overhaul) and other inputs.
The output answers three questions: is there a risk, what is it, and what is the effect. Sagi stressed the chain effect, where someone can enter through one system and reach another.
Watch Sagi Waitzman on why you can't pen test an airplane in Episode 28 (starts at 5:40) · Episode 28 notes and transcript
In most industries, the way to find security holes is a penetration test: hire someone to attack the system and see what breaks. Sagi says that simply does not work for aircraft.
I think the most important thing that people need to understand that you can't do pen test to an airplane.
— Sagi Waitzman, Episode 28
Nobody wants to board a plane a hacker was probing the day before. And testing an airplane physically, he says, means it would be on the ground for about a year until it can be certified again. That is the gap Cyviation fills: a structured risk assessment process that does not touch the plane, so airlines can comply with the new regulations coming this year.
We covered a related problem, proving that decades-old aircraft software still works, in Episode 48. Our AI in aviation page collects both conversations.
Jordan asked what AI made possible that wasn't before. Sagi's answer starts with the data. Cyviation feeds everything it collects into an AI to build what it calls a digital twin of the plane. Before AI, he says, this was done by hand: people went through more than 100 documents and then drew the digital twin. With AI, Cyviation can take in more documents and more versions, get a more accurate result, and cross-check against other systems faster.
Sagi calls Cyviation an AI-first company on the development side too. He doesn't believe you need to be big to succeed, and thinks many companies want more people out of ego. When Cyviation interviews someone, the question is not how they program but how they talk to the AI and get it to program.
Like, in our point of view, we don't hire developers, we hire only managers, okay, and every manager has its own AI agent that you need to make sure that he's doing the best job he can do.
— Sagi Waitzman, Episode 28
Jordan agreed. He said he had told one of his development teams that morning that nobody's writing code anymore, and that the job is now managing your agents. That is his view of where development is heading, not a measured fact.
Sagi says it depends on the job. For specific fixes, the team uses Windsurf, which he compares to Cursor. For building a feature from zero, they use Google Antigravity and Claude Code, because that is what those tools do best, while fixing existing code is harder with them. The research team uses Claude Code too, which Sagi calls the best one they found. For marketing, mostly LinkedIn posts with images and text, they use Gemini, partly because Cyviation runs on Google Workspace, so it comes with the package.
Sam asked what is changing. Sagi says regulators now understand that cyber can affect the safety of the plane. Until now, safety meant a malfunction or a fire on board, and as long as the computers worked, everything was considered fine. Now a cyber attack counts as a safety issue.
Sagi says he doesn't know if a cyber attack would bring a plane down. His examples are quieter, and he says everything in aviation comes back to money. Pilots carry a tablet with the plane's route. If someone changes that route by one degree on an intercontinental flight, the plane might not have enough fuel to land where it needs to. Baggage weight is another: the pilot gets the weight of the bags and where they sit on the plane, and that affects how long the runway needs to be, the takeoff speed and the fuel load. If the weight isn't calculated right, it costs money and time, and it can become a safety problem.
He also pointed to reputation. A video of an explosion playing on the entertainment system could keep a plane on the ground and hurt how people see the airline. The industry now accepts that cyber risk reaches all the data collected from many systems, not only the ground IT like ticketing.
Jordan asked whether Cyviation sells to airlines, manufacturers or airports. Sagi says the customers are airlines, including big ones, and companies that manage private jets. The reason is the regulation itself: once an aircraft leaves the manufacturer, the regulator makes whoever manages it day to day responsible, meaning the airline or the owner of the plane. Sagi says people can find Cyviation through its website and LinkedIn, and the team tries to be at as many conventions as it can. You can read more about him on our Sagi Waitzman guest page.
In the news segment, we talked about Google and Anthropic rejecting ads in their AI chatbots while OpenAI explores them. Jordan said it keeps Anthropic focused on high-quality enterprise solutions. For him, it settled a question: if he is going to invest his company's time in a platform, he wants to spend more of it with Anthropic, because it looks more committed to enterprise customers who pay for its services.
Sagi's reaction was stronger. He thinks the big companies already sell user data, but putting ads into a chat where you want relevant information turns him off OpenAI. Sam read it as a difference in finances: OpenAI has raised a lot but is burning a lot, Anthropic burns significantly less in his view, and Google is sitting on a ton of cash.
The last story was about an ex-Amazon executive who replaced his company's CRM in 72 hours by vibe coding a new one, because the old one was hard to edit. We do the same with internal tools all the time, so Jordan asked Sagi if Cyviation does too.
Sagi does, but only for internal tools. In his view vibe coding is not production ready yet, and you still need to know how to build a production product. He agreed with the article that the barrier to building is no longer the programming language. What matters is the idea and how well it is executed.
So still, it's nice to have, but it's not replacement for a good idea and good execution.
— Sagi Waitzman, Episode 28
Jordan agreed that LLMs are not yet good enough for high-quality production code, but expects them to keep improving until everyone becomes a manager and orchestrator of agents.
Sam's red-alert dashboard demo, Sagi's walkthrough of on-board risk assessment and the full news discussion are all on camera. Watch Episode 28 of Built This Week, where the full transcript is also on the page.
