Short answer: Sam Nadler says his demo rates risks by area; a critical alert on unexpected third-party API activity in crew scheduling triggers a directive to isolate the vendor subnet and rotate credentials, plus an AI captain briefing.
Watch this answer from Episode 28 (starts at 1:13) · Episode 28 notes and transcript
From Episode 28: Why You Can't Pen Test an Airplane — AI Cybersecurity for Aviation, starting at 1:13.
Sam Nadler [1:12]: And if you haven't already, please like and subscribe to Built This Week. This is our twenty eighth episode, I believe. We have new episodes out every week covering talking with great CEOs and founders all about AI and technology. So with that in mind, let's jump right in to what I built, Sagi. And, again, I don't I'm not too familiar with the product, but this is our flight ops cyber radar. So it's pulling in a bunch of data and helping us understand if there's any risks. Let's actually, scroll to the bottom where everything is a low risk. We have ground VHF interference. The signal spectrum integrity is confirmed. The fuel logistics portal looks okay. Upstream vendor reported credential leak. Maybe that's something we need to check into. Maybe that doesn't seem super high risk. Airport and infrastructure, we had latency spikes in RFID relay network. Okay. We may need to look into that, but -oh, core airline operations. We have a critical action here. Unexpected API activity from third party vendor. Let's jump into that. And as we do, it appears to be with crew scheduling, unexpected API activity, detected atypical geography.
Sam Nadler [2:45]: So this is the tactical directive. Isolate the tar target vendor subnet immediately, force credential rotation across all core service accounts, and trigger recursive audit of shared authentication dependencies. That's a mouthful. So we better look into that. That's our primary alert. Beep. And then we have this captain briefing, which will synthesizing right now, which will pretty much tell us, I think, something similar. Command briefing here, operational readiness degraded, flight safety status, none. The crew scheduling environment is logically and physically portioned from flight critical avionics and real time navigation systems. However, there's a vulnerability identified with crew scheduling assist threatening the integrity of personnel, logistics, and roster management. So, again, I built this with, assuming a little bit of how your company works. This may be totally off base. I thought it you know, the intent is just a little dashboard to analyze potential security threats. But with that in mind, what to hear would love to hear how off base I am, and then let's dive into what Cyviation actually does.
Sagi Waitzman [4:05]: So first of all, I like the intent. I must say I like the red alert. It's feel like something came from Star Trek. The captain briefing and everything. So because I am I like Star Trek, so it's really, like, came out from the TV series. Actually, I think I needed what you've done.
Sam Nadler [4:23]: I needed some audio coming from the ceiling about what was wrong. Exactly.
Sagi Waitzman [4:28]: So, yeah, I like the UI.
Sam Nadler [4:30]: And that's pretty much it.
