The Aviation Cyber Security Market in 2026: Size, Scope and Who Holds Share

Ask six research publishers how big aviation cyber security is and you get six different answers. For 2025, IMARC Group and Research and Markets put the market near $5.1 billion. The Business Research Company lands at $5.28 billion. At the other end, Global Market Insights says $11.3 billion, Stratview Research $10.88 billion and MarketsandMarkets $10.8 billion. Coherent Market Insights sits in the middle at $10.07 billion in 2025 and projects $15.77 billion by 2032.

The spread is a scoping problem, not a disagreement about demand. The lower figures count mostly dedicated security software and services sold to airlines and airports. The higher figures also count hardware, avionics-embedded protection and defence-adjacent spend. For your plan, the useful discipline is to pick the slice you will actually sell into and say so in one sentence. A consultancy selling Part-IS gap assessments is not competing for avionics hardware dollars, and a lender reading your plan will trust you more for saying that.

Who holds share today

Global Market Insights reports that in 2024 the top five suppliers (Thales, Raytheon Technologies, Honeywell, Cisco and IBM) held 38.9% of the market between them. Thales alone had more than 18.9% and Honeywell about 7%. That leaves over 60% of spend with a long tail of integrators, boutiques and regional specialists, which is where a new firm can operate. The big five sell platforms and long programmes. They are rarely the right supplier for a 90-person maintenance organisation in Dublin, Wichita or Aberdeen that needs an information security management system by Friday's audit.

Thales has also positioned itself as IATA's cyber strategic partner, and in January 2025 it announced a platform called CyberShield Aero covering avionics, ground communications and air traffic management. Honeywell Aerospace followed in June 2025 with an intrusion detection and prevention system for onboard networks. These launches tell you where the large vendors are putting product effort: onboard networks and air traffic systems. They tell you where they are not: the compliance paperwork, evidence packs and ISMS operations that every smaller regulated entity now has to produce.

The 2025 incidents that moved budgets

Demand for aviation security work is event-driven, so your plan should name the events. On the evening of 19 September 2025, ransomware hit the MUSE check-in and boarding platform operated by Collins Aerospace, a unit of RTX. Heathrow, Brussels and Berlin Brandenburg fell back to manual check-in and boarding. The EU's cyber agency ENISA confirmed ransomware within days, and the Everest group claimed the attack, although attribution was unconfirmed when coverage was published. RTX issued MUSE version 7.4.2 afterwards. The lesson for a founder is that one shared supplier sat underneath several airports, and every airport then asked the same question: what else do we depend on that we have never assessed?

Earlier that summer, carriers were hit through data extortion. WestJet disclosed a breach affecting 1.2 million customers after a 13 June incident, Hawaiian Airlines reported an IT disruption in late June, and Qantas confirmed exposure of about 5.7 million customer records via a third-party contact-centre platform. Coverage tied the pattern to Scattered Spider tradecraft, which targets help desks and outsourced support rather than aircraft. Notice what that means commercially: the attack surface that is actually being hit is ordinary enterprise IT and supplier access, which a small consultancy can assess without ever touching an aircraft.

None of this requires you to be an avionics expert on day one. It does require you to be honest in your plan about which of three layers you serve: enterprise IT (airline and airport back offices), operational technology (baggage, fuel, access control, air traffic and airfield systems) or airborne systems (avionics, connectivity, electronic flight bags). Margins and entry barriers rise as you move down that list. Most successful new firms start in the first two and add the third through a partnership or a hired specialist.

What Buyers and Founders Ask First

These are the questions that appear most often when people search this topic. Each answer is short on purpose; your plan's market section should carry the longer version with your own evidence.

What is aviation cyber security?

It is the practice of protecting the information and operational systems that keep civil aviation running: reservation and departure-control systems, airfield and baggage operations, air traffic management, maintenance records and the avionics and connectivity on the aircraft itself. ICAO frames the goal as a sector that is resilient to attack, safe and secure, and still able to innovate. For a business plan, the practical definition is narrower: security work that a regulator, insurer or airline customer requires or strongly expects.

Who regulates cyber security in aviation?

There is no single regulator, and that is the commercial opportunity. ICAO sets global standards through Annex 17 and guidance such as Doc 10213. In the EU, EASA enforces Part-IS. In the UK, the Civil Aviation Authority runs the CAP1753 oversight process. In the US, the FAA and TSA divide the territory, with CISA as the incident-reporting counterpart. Each body speaks a slightly different dialect, and buyers pay for someone who can translate between them.

What is EASA Part-IS?

Part-IS is the EU's information security rule for aviation. It requires regulated organisations to run an information security management system proportionate to their size and risk, integrated with the safety management system they already have. It became applicable to aerodromes, design and production organisations and apron management providers on 16 October 2025, and to maintenance, continuing airworthiness, air operators, training organisations, air navigation providers and competent authorities on 22 February 2026. The full detail is in the regulation section below.

How much do aviation cyber security professionals earn?

ZipRecruiter listings in 2026 put the average for remote aviation cyber security roles in the US at about $132,962, with entry-level near $93,170 and most pay between $78,500 and $112,000. Indeed's self-reported figure for an FAA cyber security specialist is about $109,658. These numbers matter to a founder for two reasons. They set the cost of your first hire, and they define the salary you are giving up by starting a firm. A plan that cannot beat a $130,000 employment offer in year two is a plan to rethink.

Which standard covers aircraft cyber security certification?

DO-326A (Europe: ED-202A), titled Airworthiness Security Process Specification, defines a seven-stage process from planning through continuing airworthiness. Companion documents are DO-356A/ED-203A for methods and DO-355/ED-204 for continuing airworthiness guidance. Since 2019 this set has been the sole acceptable means of compliance for FAA and EASA cyber certification, according to Tripwire's summary of the standards. Suppliers who build or modify airborne equipment pay specialists for this work.

Launch Budget and Where the Money Goes

Published startup figures for cyber consultancies are low, and they come from generic firms. FinancialModel.net estimates $10,000 to $50,000 for a small cyber security consulting firm, $5,000 to $15,000 for a home-based operation and $30,000 to $75,000 for a firm with a small office and two hires. Aviation sits above those bands for three reasons: insurers price aviation professional liability higher, clients ask for named certifications before they will sign, and sales cycles run six to nine months, so working capital has to be larger.

The table below shows two launch shapes. The solo column is one senior specialist working from home with a small lab. The team column is four people (two senior, two junior), a shared office near an airport cluster and enough accreditation to bid on regulated work. These are Avvale planning estimates built from the anchors above and typical quotes; replace them with your own quotes before you show a lender.

Why insurance deserves its own line

Aviation customers write security obligations into master services agreements, and those agreements ask for professional indemnity and cyber liability limits that a typical IT consultancy does not carry. Brokers quote on turnover, scope and whether you touch operational systems. Do not wait for the first contract to ask. Get two broker quotes before you finalise your pricing, because the premium sits inside your day rate. A firm that discovers a $14,000 annual premium after underpricing every proposal starts with a hole in its margin.

Certifications that change who will talk to you

Security leads at airports and airlines screen suppliers by credentials before they read proposals. ISO 27001 Lead Implementer is the most common requirement for Part-IS work because the regulation expects an ISMS. CISSP signals general seniority. GICSP (Global Industrial Cyber Security Professional) signals operational technology competence, which matters for baggage, fuel and airfield systems. For airborne work, formal DO-326A training from a recognised provider is the credential that buyers actually ask about. Budget these in the first quarter, because each one shortens the sales cycle on contracts worth many times their cost.

If you plan to sell in the UK, find out early whether your clients fall under CAP1753. Organisations in scope must partner with an accredited ASSURE audit provider, and ASSURE was built with CREST. Firms such as Dionach and LRQA already offer ASSURE audits, so a new firm usually starts as the preparation partner that gets clients ready for the audit, not as the auditor.

Funding Routes: SBA 7(a) and UK Start Up Loans

A cyber consultancy has almost no hard assets, so lenders underwrite the founder and the contracts, not the equipment. That shapes which routes fit.

United States: SBA 7(a)

The SBA 7(a) programme caps loans at $5 million, and start-ups generally need to show a 10% equity injection. One lender-side summary puts typical amounts for ventures of this kind at $25,000 to $100,000, which is consistent with the solo and small-team budgets above. Your firm will most likely be classified under NAICS 541512 (Computer Systems Design Services), the code most widely used for cyber security consulting and security architecture work. Some aviation-specific engineering and assessment work may sit better under a different professional-services code; ask your lender which one they use for their own reporting, because it affects how they benchmark your projections.

What lenders want to see in an aviation security plan is different from what they want from a retail business. They look for: a named anchor prospect or letter of intent, a credible explanation of why regulation forces the buyer to spend (the Part-IS and TSA material below does that job), the founder's sector credentials, and a utilisation assumption that does not exceed 65% in year one. A projection with 85% utilisation from month two tells an underwriter you have not run a consultancy before.

United Kingdom: Start Up Loans

UK Start Up Loans cover £500 to £25,000 over one to five years. According to a provider's service update, the fixed rate rose from 6% to 7.5% and eligibility widened to businesses trading for up to five years from 6 April 2026, so older guides that quote 6% are out of date. Business partners can each apply, to a combined £100,000 for one business. For a firm that needs £27,000 to £189,000 to launch, a Start Up Loan typically covers the certification, insurance and tooling lines, while working capital comes from savings, an angel round or a bank facility.

The last row is the one first-time founders skip. A fixed-fee gap assessment of $14,000 with 40% paid on signature puts $5,600 in your account before you bill a single hour. Two of those a quarter cover a month of overhead for a solo practice. Build prepayment terms into the pricing section of the plan so a lender sees the cash cycle, not just the annual revenue.

If you are choosing between routes, the free template's funding section walks through each in order. If you need the numbers built for you, the Research + Content package covers the lender-facing market and funding narrative.

Pricing, Utilisation and Break-Even

Aviation security firms make money in one of three ways, and the plan has to choose the primary one. Each model has a different cash profile, a different hiring pattern and a different exit story.

Offer ladder with prices

The following ladder reflects how a regulation-driven practice typically packages work. Prices are Avvale planning assumptions for a US or UK mid-market client, not published rate cards.

• Part-IS or CAP1753 gap assessment: fixed fee of $9,500 to $18,000 (£7,500 to £14,500), 8 to 12 consultant-days, delivered as a gap register mapped to each regulatory requirement.
• ISMS build: $1,250 to $1,800 per consultant-day (£950 to £1,400), typically 25 to 45 days for a 100-person maintenance or CAMO organisation.
• Managed ISMS retainer: $3,000 to $6,500 per month (£2,400 to £5,000) covering risk register upkeep, internal audit, supplier reviews and two tabletop exercises a year.
• Audit readiness (ASSURE or competent-authority audit): $7,000 to $14,000 (£5,500 to £11,000) per audit cycle.
• Airborne evidence packs (DO-326A): priced per certification programme, often $40,000 and upward; this is specialist work and usually needs a partner or a hire with certification history.

Worked example: one ISMS engagement

A continuing airworthiness management organisation with 120 staff needs an ISMS before its Part-IS audit. You scope 38 consultant-days: 10 for gap analysis and risk assessment, 18 for policy, procedure and evidence build, 6 for training and drills, and 4 for audit support. At $1,450 per day that is $55,100. If a delivery associate does 20 of those days at a loaded cost of $620 per day and you do the other 18 at an internal cost of $900 per day, direct cost is $12,400 plus $16,200, or $28,600. The engagement yields $26,500 in gross profit, a 48% margin. If the whole engagement is delivered by the senior person at $900 per internal day, direct cost is $34,200 and the margin falls to 38%. This is why plans for aviation firms need a junior-to-senior ratio, not a single blended rate.

The recurring side is simpler. Six retainer clients at an average of $4,500 per month produce $27,000 a month, or $324,000 a year, before the cost of the 1.5 people needed to service them. Retainers are the number lenders and investors care about because they survive a quiet quarter.

Break-even in billed days

Suppose a two-consultant practice carries $21,400 of monthly overhead: two salaries, insurance, tooling, accountancy, travel and a small office allowance. With a $1,450 day rate and a 62% contribution margin after variable costs such as travel, subcontractors and tool licences (salaries sit inside the overhead figure), each billed day contributes about $899. Break-even is $21,400 divided by $899, roughly 23.8 billed days a month. Two consultants have about 42 working days between them, so break-even utilisation is near 57%. That is achievable in year one only if the sales pipeline is already warm. If sales cycles run six to nine months and you start with nothing booked, you will spend months one to four below break-even, which is the reason the working-capital line in the budget is the largest one.

Compare that with the salary data above. A senior aviation cyber specialist can command about $133,000 as an employee. To beat that after tax, risk and unpaid business-development time, you need to bill roughly 110 to 130 days a year at the rate above, which is about 50% to 60% of working days. This is the sanity check to put in your plan's founder-economics paragraph.

Margins by layer

Enterprise IT work for airlines and airports (assessments, third-party risk reviews, incident response planning) tends to carry gross margins around 55% to 62% because the work is repeatable and juniors can do much of it. Operational technology work (baggage systems, airfield lighting, access control, fuel systems) carries 60% to 68% because specialists are scarce, but requires more lab time. Airborne certification support is the highest-value and slowest to start. These bands are Avvale planning estimates for modelling; they are not statistics from a published survey, and your plan should say so.

Regulation: Part-IS, CAP1753, FAA and ICAO

You do not need a licence to sell cyber security advice in most jurisdictions. Your customers, however, are licensed and audited entities, and the rules they answer to define what they will pay for. Your plan's regulatory section should be a demand map: each rule, who it binds, when, and what service it creates.

European Union: EASA Part-IS

Part-IS rests on two acts adopted under the EASA Basic Regulation (EU) 2018/1139: Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203. It applies in two waves:

• 16 October 2025: aerodrome operators, design and production organisations, and apron management service providers.
• 22 February 2026: maintenance organisations, continuing airworthiness management organisations, commercial and non-commercial air operators, approved training organisations and flight simulation training device operators, air navigation service providers, air traffic controller training centres and the competent authorities.

Organisations in scope must establish, implement and maintain an information security management system proportionate to size and risk, integrated with their existing safety management system. As of October 2026, the first wave is already past its applicability date and the second is months in, so the buying pattern has shifted from awareness to audits. Competent authorities now carry oversight deadlines of their own, which creates a second customer group: national authorities that need their own ISMS and inspector training.

Practical consequence for a founder: the buyer has an existing safety management system, so you will be integrating, not building from scratch. People who understand both safety and security cultures are scarce. Safety engineers distrust anything that slows a release; security people distrust anything undocumented. A consultant who can speak to both earns the engagement.

United Kingdom: CAA CAP1753 and ASSURE

The CAA's CAP1753 Cyber Security Oversight Process is a six-step process built on the Cyber Assessment Framework, reformatted as the CAF for Aviation. It assesses four objectives: A, managing security risk; B, protecting against cyber attack; C, detecting cyber security incidents; and D, minimising the impact of incidents. Organisations in scope must engage an accredited ASSURE provider to audit them. ASSURE was developed by the CAA with CREST and released in 2020. In scope are airports, airlines, air navigation service providers, ground handlers, aviation infrastructure operators and critical service providers. The CAA's Cyber Security Oversight Strategy 2024 to 2026 sets the current direction.

UK organisations that also hold EU approvals or serve EU-regulated customers may have to show evidence against both Part-IS and CAP1753. Check each client's approvals before you quote, because dual mapping is a repeatable service line: one gap register, two regulators.

United States: FAA, TSA and CISA

The US has no single equivalent of Part-IS, but three strands matter. First, TSA cyber requirements for covered commercial passenger airports took effect in 2022: designate a cybersecurity coordinator, complete a vulnerability assessment, develop an incident response plan and report incidents to CISA within 24 hours, mirroring TSA's earlier moves on pipelines. Second, the FAA Reauthorization Act of 2024 gives the FAA exclusive authority to set minimum cybersecurity standards for aircraft, engines, propellers and appliances, including unmanned aircraft systems, and requires air carriers' dispatch and flight following centres to have physical and cyber protections. Third, FAA and TSA work has been under scrutiny: GAO has published reports on collaboration shortfalls between the two agencies, which is a signal that more formal requirements are likely to follow.

For airborne systems, DO-326A (the US designation also appears as DO-326B in some texts) with its companion documents has been the sole acceptable means of compliance for FAA and EASA cyber certification since 2019; see the FAA design approval holder cybersecurity page for the agency's own guidance.

Global: ICAO

ICAO's Annex 17 includes Standard 4.9.1 and Recommended Practice 4.9.2 on cyber risk, and Doc 10213, Global Cyber Risk Considerations, supplies a methodology for folding cyber risk into safety and security risk management. The Aviation Cybersecurity Strategy has seven pillars: international cooperation, governance, effective legislation and regulations, cybersecurity policy, information sharing, incident management and emergency planning, and capacity building, training and culture. If you plan to sell outside the US, UK and EU, ICAO is the document that Gulf, Asian, African and Latin American civil aviation authorities cite when they write national rules. A plan that notes this earns credibility with an international investor.

Turning the rules into a sales calendar

Map each regulation to a trigger, a buyer and a service so your pipeline assumptions are traceable:

Seven Ways New Aviation Security Firms Stall

Most of the stalled firms we see did not fail on technical skill. They failed on positioning, pricing or sequencing. These are the patterns to design out of your plan.

• Selling generic penetration tests. An airline security lead has a dozen firms offering the same test. A buyer who must answer to Part-IS or CAP1753 pays for evidence mapped to a named requirement, not for a list of vulnerabilities. Lead with the regulation, then offer the test as one input.
• Ignoring the safety culture. Aviation runs on safety management systems, change control and certification. Recommendations that cannot be traced into an existing change process get shelved. Learn how your client logs a modification before you write a single control.
• Underpricing against insurance. A day rate below roughly $900 (£700) usually cannot carry aviation-grade professional indemnity, tooling and a sales cycle of six to nine months. Cheap proposals win work that loses money.
• Treating Part-IS as someone else's problem. Founders in the US sometimes dismiss it as European. US companies that hold EASA approvals, supply EU operators or sell parts into EU-regulated maintenance chains still get pulled in through their customers' supplier questionnaires.
• Skipping the airborne partner. Pitching DO-326A work without certification history costs credibility. Either hire someone who has been through a certification programme or sub-contract the airborne piece and say so openly.
• No reference customer before raising money. A lender or angel reading a plan for an aviation security firm will ask who has already paid. One paid pilot with a regional MRO or small airport beats a page of market statistics.
• Building a product too early. Monitoring software looks attractive on a slide, but it competes with roadmaps at Thales and Honeywell, and with OT specialists such as Claroty, Nozomi Networks and Dragos on the industrial side. Fund the product from services revenue; do not start there.

Each mistake maps to a section in your plan. Positioning belongs in the market section, pricing in the financials, the reference customer in the traction section and the airborne partner in the team section. If your draft does not address all seven, a reader will notice the gap.

Glossary of Terms Your Plan Must Use Correctly

Aviation readers are precise about vocabulary. Getting these terms wrong in a business plan signals that you have not worked in the sector.

• Part-IS: EASA's information security regulation for aviation organisations, applicable from 16 October 2025 and 22 February 2026 depending on organisation type.
• ISMS (information security management system): the documented policies, risk process and controls an organisation runs to meet Part-IS. It must connect to the safety management system.
• SMS (safety management system): the existing aviation framework for identifying and controlling safety risk, which Part-IS expects security to plug into.
• CAP1753: the UK CAA's cyber security oversight process, built around the CAF for Aviation.
• ASSURE: the CAA and CREST scheme under which accredited firms audit in-scope UK aviation organisations.
• CAF (Cyber Assessment Framework): the framework behind CAP1753, organised into four objectives from managing risk to minimising impact.
• DO-326A / ED-202A: the airworthiness security process specification for airborne systems, with DO-356A/ED-203A and DO-355/ED-204 as companions.
• OT (operational technology): systems that control physical processes, such as baggage handling, fuel farms, airfield lighting and access control, as opposed to office IT.
• CAMO: continuing airworthiness management organisation, one of the Part-IS wave-two entity types.
• Tabletop exercise: a facilitated discussion in which an organisation walks through a simulated incident, commonly sold as part of retainers.

Case Study: A Wichita DO-326A Specialist

Sample Plan Extract: A UK Part-IS Practice

The extract below shows how the financial section reads when it is built from regulation-driven offers. The business is a fictional composite, Halyard Aero Security Ltd, based near Bristol to sit close to the aerospace cluster there.

Notice what a lender can check in that extract: the offers add up (£116K + £144K + £49K + £105K = £414K), the funding ask is smaller than the annual revenue, and the break-even month is stated. The template gives you every table in this format with the arithmetic already linked, so changing one price updates the whole page.

What Is in the Template

The aviation cyber security template follows the structure a lender or investor expects, with prompts written for a security consultancy rather than a shop or restaurant.

• Executive Summary: the regulation that creates demand, your offer and your funding request on one page
• Company Overview: legal structure, founder credentials, accreditations and insurance cover
• Market and Regulation: demand map by rule, buyer type and layer (IT, OT, airborne)
• Customer Analysis: airports, MROs, CAMOs, airlines, equipment suppliers and why each buys
• Competitor Analysis: large integrators, ASSURE auditors, boutiques and in-house teams
• Marketing and Sales Plan: conferences, regulator-led events, referral partners and sales cycle assumptions
• Operations Plan: delivery method, utilisation targets, tools, subcontractors and quality control
• Management Team: founder bios, advisory board and planned hires with salary assumptions

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with income statement, cash flow, balance sheet, break-even analysis, and startup capital requirements. If you are comparing related plans, see the aviation MRO software, airports information systems and Africa cyber security templates, or the broader business plan writer service and client case studies.

Frequently Asked Questions

Useful Links & Resources

• Facebook
• Instagram
• LinkedIn
• YouTube