A study by Cicada8 reveals that 46% of Russian aviation companies have high or critical IT vulnerabilities within their external digital perimeter. The analysis covered over 300 organizations, noting that even companies with a limited number of public assets, typically five to seven domains and 12 web applications, remain exposed to known CVEs.
The aviation sector's average security rating is 7 out of 10, which aligns with the general Russian market average of 7.07. However, only 52% of aviation companies score 7 or higher, compared to 65% across the broader market. Common weaknesses include poor IP address reputation, unpatched vulnerabilities, and inadequate web resource protection.
Experts highlight that relying on formal compliance is insufficient, as many firms continue to operate outdated services and misconfigured systems. The risk is compounded by the use of shared IT contractors, where a single breach at a service provider could impact multiple airlines and airports simultaneously.
Following a July 2025 cyberattack on Aeroflot that resulted in the cancellation of nearly 50 flights at Sheremetyevo Airport, the Ministry of Transport and Rosaviatsiya issued security recommendations to the industry. Cicada8 advises firms to prioritize rapid vulnerability remediation and strict control over third-party access.