The world’s busiest and most complex airspace is preparing for its biggest technological leap in decades and cybersecurity concerns are now front and centre in the bidding process. US media reported recently that companies competing to supply the US Federal Aviation Administration a new core air traffic management software platform are actively defending their proposals against cyber risk scrutiny. The FAA’s long-running NextGen programme aims to replace legacy automation systems, some dating back to the 1980s HOST computers that still maintain the safe handling of roughly 45,000 daily flights across American skies.
This is not a routine IT upgrade. It is the backbone of the National Airspace System facing the realities of modern state-sponsored cyber threats.
### Legacy Systems Meet Modern Threats
When the legacy systems meet modern AI threats, we need to upgrade. Therefore, the FAA’s push for a Common Automation Platform is part of broader NextGen and recent modernisation efforts and seeks to consolidate fragmented systems into a more unified and resilient architecture. But as bids advance, lawmakers and evaluators are zeroing in on potential vulnerabilities particularly foreign supply-chain risks and the broader attack surface of highly connected aviation systems.
The concern is well-founded. Aviation infrastructure has already been a target. Russia has repeatedly engaged in GPS jamming and spoofing affecting civil aviation across Europe and beyond. China has been linked to sophisticated cyber espionage campaigns targeting aerospace and critical infrastructure. Iran has demonstrated willingness to conduct disruptive cyber operations in the region.
A successful compromise of core ATC software or supporting networks could have catastrophic consequences from widespread delays and economic damage to direct safety risks. The procurement process now treats cybersecurity as strategic and there is heightened awareness in Washington that America’s aviation modernisation cannot be separated from great-power competition.
The United States sets the gold standard for much of the world’s aviation technology and procedures. Delays, cost overruns or security shortcomings in the FAA’s core systems ripple far beyond US borders. Indian carriers operating transatlantic or transpacific routes, Southeast Asian airlines feeding into US gateways, and global manufacturers all have a stake in the reliability and security of American airspace management.
For Asia, the story is a cautionary tale. As countries like India accelerate their own ATC modernisation and digital sky initiatives under schemes such as GAGAN and broader NextGen-inspired upgrades, the FAA’s experience highlights the need to bake cybersecurity and supply-chain resilience into procurement from day one not as an afterthought.
The modernisation is overdue. Legacy systems have contributed to well-publicised stress on the US system. Replacing them with modern, secure platforms is essential. The challenge is doing so without introducing new vectors for disruption in an era where state actors view civilian infrastructure as fair game in hybrid conflict.
America’s air traffic control upgrade is a test of whether the world’s leading aviation nation can modernise faster than its adversaries can exploit the transition.