Why You Can't Pen Test an Airplane — AI Cybersecurity for Aviation

Sagi Waitzman: You can't do pen test to an airplane. Like, you don't want to fly an airplane. The the day before, some hacker tried to see what he can do.Narrator: Built this week, breaking it down. Built this week, we show you how. A fresh idea, a clever tweak you locked in. Built this week.Sam Nadler: Hi, everyone, and welcome to built this week, the podcast where we share what we're building, how we're building it, and what it means for the world of AI and startups. I'm Sam Nadler, cofounder here at Ryz Labs. And each and every week, I'm joined by my friend, my business partner, my cohost, Jordan Metzner. Hey, Jordan. How are doing?Jordan Metzner: Hey, Sam. Happy to be back.Sam Nadler: Happy to have you. And this week, we have a very special guest, the CTO of Cybiation Aero. Cybhi, welcome to the show.Sagi Waitzman: Hello. Hi. Thank you for inviting me.Sam Nadler: Great to have you. So just to give you a high level agenda, we're gonna jump into a quick demo we made with Sciviation in mind. We're also gonna dive into the product of Sciviation. It's a space that, personally, I'm not too familiar with, but is incredibly interesting. And then we're gonna cover the latest and greatest AI news.And if you haven't already, please like and subscribe to Built This Week. This is our twenty eighth episode, I believe. We have new episodes out every week covering talking with great CEOs and founders all about AI and technology. So with that in mind, let's jump right in to what I built, Sagi. And, again, I don't I'm not too familiar with the product, but this is our flight ops cyber radar.So it's pulling in a bunch of data and helping us understand if there's any risks. Let's actually, you know, scroll to the bottom where where everything is a low risk. We have ground VHF interference. The signal spectrum integrity is confirmed. The fuel logistics portal looks okay.Upstream vendor reported credential leak. Maybe that's something we need to check into. Maybe that doesn't seem super high risk. Airport and infrastructure, we had latency spikes in RFID relay network. Okay.We may need to look into that, but, uh-oh, core airline operations. We have a critical action here. Unexpected API activity from third party vendor. Let's jump into that. And as we do, it appears to be with crew scheduling, unexpected API activity, detected atypical geography.So this is the tactical directive. Isolate the tar target vendor subnet immediately, force credential rotation across all core service accounts, and trigger recursive audit of shared authentication dependencies. That's a mouthful. So we better look into that. That's our primary alert.Beep beep beep beep. And then we have this captain briefing, which will synthesizing right now, which will pretty much tell us, I think, something similar. Command briefing here, operational readiness degraded, flight safety status, none. The crew scheduling environment is logically and physically portioned from flight critical avionics and real time navigation systems. However, there's a vulnerability identified with crew scheduling assist threatening the integrity of personnel, logistics, and roster management.So, again, I built this with, you know, assuming a little bit of how your company works. This may be totally off base. I thought it you know, the intent is just a little dashboard to analyze potential security threats. But with that in mind, what to hear would love to hear how off base I am, and then let's dive into what Cydiation actually does.Sagi Waitzman: So first of all, I like the intent. I must say I like the red alert. It's feel like something came from startup. You know, they kept them briefing and everything. So because I am I like Static, so it's really, like like, came out from the TV series.Actually, I think I needed what you've done.Sam Nadler: I needed some audio coming from the ceiling about what was wrong. Exactly.Sagi Waitzman: So, yeah, I like the UI.Sam Nadler: And that's pretty much it.Jordan Metzner: So, Sagi, tell us a little bit about the company and what you guys do.Sagi Waitzman: So actually, what you've done, I think, is what most people think about is cybersecurity for the airlines because they check what is on the ground, and that's exactly what you showed. What we do is we check the airplane itself. Today, the airplane has so many computers. You know? He's got his own server room inside the airplane, and Sabad need to make a risk assessment for it, and this is what we do.We have our technology in order to map all the the different elements, you can say it, okay, in the airplane or different computer systems. And then we have our logic. We analyze them. We check the version. We check the connection.We check everything we can get from the documents and all the information we collect from the MRO, from all other inputs we can get, and then we say what is the risk. If there is a risk, what is the risk? What is the effect? Because there can be a channel effect. Somebody can enter from x and get to y.Okay? Something that other company can do today. I think the most important thing that people need to understand that you can't do pen test to an airplane. Like, you don't want to fly an airplane. The the the day before, some hacker tried to see what he can do.Like, so testing physically an airplane mean that you will be on the ground for about a year until it can be certified again. So this is where we come. We do with our technology. We can have a risk assessment. We have a a straight process how to do a risk assessment, and then the airlines can be compliant to a new regulation that are coming this year.So this is actually the gap we want to fill, to help the airlines to be compliant in the new regulation.Jordan Metzner: Okay. Got it. And obviously this is an incredibly fast moving space with historically a lot of bureaucracy and now in the new world, obviously AI and all this new type of technology. So maybe you can just talk a little bit about how AI has maybe allowed you guys to implement some of your technology that maybe wasn't available before AI existed.Sagi Waitzman: Yeah. So first of all, we AI first company, I think, from the development point of view. Like, we don't believe you need to be big to be successful. You can see it in all the startups today. I think a lot of people wants more people because of ego ego, and they think that if you have more people, it's mean you will more succeed.So what we are doing today, like, when we collect all the information, we enter it into an AI, okay, to make a what we call a digital twin of the plane. And before it before the AI, it was done manually. They go on more than 100 documents manually and then draw the digital twin. And now using AI, we can get more documents. We can get more version, more accurate, and we can do the cross with other system faster.This is just getting the data. Besides of it, of course, all the development is a force. We're using AI tools. Every person we add to the company with the the interview is not how he's program, how he's talking to the AI and convince him to program. Like, in our point of view, we don't hire developers, we hire only managers, okay, and every manager has its own AI agent that you need to make sure that he's doing the best job he can do.Jordan Metzner: Wow, that's incredible. Yeah, I mean I was talking to one of my development teams this morning just you know, how how, you know, nobody's writing code anymore and just the management of of your agents. But, yeah, I just I'm sure you guys are using Cloud Code and and and Cursor and some of the other tools, but how has it changed the developer's job, like leveraging AI? They're all running multiple agents. Is everybody I mean, is the marketing team leveraging agents?Are you using Claude CoWork? Can you talk about, like, some of the features and tools you guys are using lately?Sagi Waitzman: So it depends on the job, okay, because I think every agent has its own. Personally, we use Windsurf for the development for if you need specific fixes, like Windsurf is like Cursor. If we want specific fixes, we're doing this. We use antigravity and CloD code for feature from from zero, okay, because we understand they this is what they do the best. But if you want to fix something, it's harder to do it with with this.We use CloD for research team, CloadCode for research team. It's the best one that we found. Of course, the marketing, the I think like everybody else, you know, since AI, everybody writing LinkedIn posts. We use Gemini. I think for this is the best.I think it's the advantage is also because we use Google Workspace. So it's come with the package. In person, I like it. For the images and the text, I like it.Sam Nadler: Sorry. You mentioned new regulations that are on the horizon. I think you mentioned in 2026. What's changing that is is, you know, a, important for airlines to adopt and, you know, is critical for you to help them adopt it?Sagi Waitzman: I think that what changes, it's that people now understand that cyber can affect the safety of the plane. Okay? At the end, when something is talking about safety, until now they saw that the plan, you know, if you have a malfunction, you have fire, something on the plane, some scrawlers, I don't know. This is safety. And if the computer works, then everything is okay.But now they said that cyber cyber attack, it's something that it's safe for the plane. And besides safety, it I think that I don't know if cyber will get a plane down from the air. Okay? But think about the the effect from the media if some if some airplane won't fly because there was some movie of explosion in the entertainment system. Like, there are so many things that can affect how the people see the company, the airline, and can affect the money of the of the so the the money of the airline.And if you think about it, even if somebody you know, the the pilots have a tablet that in the tablet, they got all the the pilot have all the route of the plane. So if somebody just change by one degree, okay, the route, a single word when you fly between a continent and the what is one degree? So it can even mean that the plane won't have enough fuel to land when it's in it where it needs to land. It can cost a lot of money to the airline. And once we enter this, once I entered personally to the aviation industry, understand that everything is about money, the weight of the airplane.Like, a thing that people don't understand, even if the weight that the system have inside, let's say the baggage. You remember you put all your baggage and then they take it to the plane, and the pilot have the all the all the weight of the baggage and where it's located on the plane. This affect the long how long the runway is need to be to take off, what is the speed. Think about it that the weight isn't calculated right. It can affect the the way the plane will take off.It will affect the fuel that it needs to have. It affects so many things that people just don't understand. It's can it can be safety. It costs money. It mean it cost time.I mean, the plane might not get to its destination. So I think now the the industry understand that cyber can affect all of this information that is collected from many system and not only the IT that is on the ground, like the ticketing system and stuff like this.Jordan Metzner: That's incredible. Yeah. I think And, I mean, obviously, as these systems get better and better, then it presumes that there's optimizations that can be had in all of these places to your point. Incredible product. And can you just give us a little more information, like, just tell how people can find out about the company before we move on?Just, like, tell us about the website and how people can find out more. And then I guess also one question before I finish there was, are your are your customers airlines? Are your customers the the airplane manufacturers? Are they both? Are they airports?Sagi Waitzman: So our customer are many airlines, but, you know, the big one, but there are so many airlines, you know, of private jet. Like, I don't know if if you call it an airline, but our companies that manage private jets, also our customers, everybody that manage airplanes because the regulator said that the the one that's responsible is the one that manage the airplane because it went out from the airplane manufacturer, then the airline or the owner of the plane is the one that's for the day to day maintenance. So this is a this is a customer. You set out they can see us, so we have our site, like you see it in the screen, salvation.ero. They can look at us.We're trying to be in as much convention convention as we can. And it just took us in the site, in LinkedIn, and we'll be happy to talk. Okay. Awesome. Alright.Jordan Metzner: Let's jump into the news, Sam.Sam Nadler: Yeah. Let's kick it off. So, you know, I think this popped up in in conversations over the past twenty four hours, but Google and Anthropic reject ads in their AI chatbot platforms unlike what OpenAI seems to be doing. At a high level, you know, Google has tons of cash. Anthropic from a, like, maybe company stage perspective is probably more similar to OpenAI than it is Google, yet it's also rejecting the concept of ads.What's what do you think about, you know, the use of ads in in our day to day drivers of these chatbot platforms.Jordan Metzner: Yeah. I mean, ads has been a popular way for the Internet to to grow, and that's what Google's done and Facebook's done. OpenAI is exploring it. I mean, Amazon also has a giant ads business. I also think that it just kind of puts more focus on Anthropic on just providing high quality enterprise solutions and not being distracted by advertising.So honestly, the thing for me that it did is solidify that, you know, if I'm gonna invest my company's time on a platform, I wanna spend more time with Anthropic since they feel like, you know, looks like the company has more allegiance to to enterprise customers paying for their services rather than, you know, OpenAI, which could be, you know, basically being like a a large open marketplace. I don't know. What about what about you, Sagi? What do you think?Sagi Waitzman: So I think all the companies already sell our data, but, like, doing it openly with ads, like, you it's making me run away from them because we're already afraid from all the data our data that's out there. Like, come on. Google sell our data, maybe not in the chat, but in other systems. But putting it in the chat when you want relevant information, So it's like it's turned me off from from OpenAI, and they're good good replacement. So I think that it's a way just to it's not it's not a good way where are they going now.Sam Nadler: So I think it signals maybe the the different p and l realities of each country of each company. Sorry. OpenAI, obviously, you know, has raised a ton of cash, but they're also burning a ton of cash. Anthropic has raised a considerable amount of money, but I think they're burned significantly less. And Google is just sitting on a ton of cash.So I think their the their OpenAI's need to reduce burn and generate other streams of revenue is just in a different position today than than both Anthropic and Google.Jordan Metzner: Alright. Let's let's move on. I think we got one more story to wrap up this episode. Ex Amazon executive basically kinda replaced their company. You know, he left Amazon, and he replaced the company's CRM in a weekend by vibe coding it.And I think, you know, I the whole story is just about the fact that, like, his current CRM was hard to edit and hard to make changes to, and so he just built a new one from scratch, he says, like, in seventy two hours. So, yeah, like, think Sam said, it resonates with us since we do this all the time with a bunch of internal tools. But are you guys building internal tools? Are you replacing kind of third party software tools and CRM tools with your own in house tools? And are you kinda feel the same way as him?Sagi Waitzman: So I feel the same way as him, like building internal tools, but only internal because at the end, vibe coding is not yet yet production. Like, you need to to know how to build production product, but for internal tools, we surely use. I think it can save a lot of money. It's nice nice to have, and I agree with what they wrote in the last paragraph, I think in this article, that it's still the the entry barrier for developer is long time ago, it's not a development language, whereas easy to develop. It depends on these good ideas.It's a good and the good ideas and the execution of the good idea. So you don't see now thousands of power caps out there. So still, it's nice to have, but it's not replacement for a good idea and good execution.Jordan Metzner: Yeah. Totally true. And I think, I mean, it'll just have a you know, as you said, you know, these LLMs are not good enough for high quality production code yet. But, you know, over the next months, weeks, years, I mean, it's just gonna get better and better. And to your point, kind of everyone becomes a manager and orchestrator.Right? Asagi, I wanted to say thanks so much for joining us today. Thanks for talking about your company. It was really interesting to learn how kind of AI and cyber has a huge impact on our day to day lives and just taking on flying in on an airplane and whatnot. I think we got a a good call out.It was awesome to see your tool, Sam, and your red alerts. And, yeah, interesting to talk about OpenAI and Anthropic and just kind of vibe coding in general across, like, all executives. So thanks again, Sagi, for this awesome time, and thanks, Sam. Thanks for joining us.Sagi Waitzman: Thank you, guys.Sam Nadler: Thanks, Sagi. Don't forget to like and subscribe. It was a pleasure to meet you. Bye, everyone.