A system of systems
Dozens of operational systems, many run by tenants and contractors, share networks and dependencies that nobody sees in one place.
Airports ยท Aviation systems
Airport cybersecurity that connects passengers, airside operations, and suppliers.
CYNAPSE brings passenger processing, baggage handling, airside systems, building automation, security systems, and vendor interfaces into one assurance picture that operations and security teams share.
The challenge
What sets Airports apart.
Passenger, baggage, airside, and building systems mapped as one system of systems, with every supplier connection accounted for.
Supplier access everywhere
Baggage, BMS, and passenger systems are supported remotely by vendors. Each connection is a path into operations.
Minutes of disruption are visible
Outages ripple into delays, missed connections, and public headlines. Risk must be ranked by operational impact, not CVSS alone.
In scope
The systems you can model.
Each system becomes assets, zones, and interfaces in one project, so risk, exposure, and evidence stay connected to what actually runs.
- Passenger processing and CUTE/CUPPS
- Baggage handling (BHS)
- Airfield ground lighting
- Building management (BMS)
- Access control and CCTV
- AODB and flight information
- Fuel and utilities
- Airline and vendor networks
How CYNAPSE helps
Govern airport cyber risk without losing operational context.
RABUILD GRC carries the risk, controls, and security case. Exposure Engine ranks vulnerabilities by what the asset does. Navai Assistant guides each step.
Map airport dependencies
Connect terminal, airside, landside, data centre, communications, facilities, and shared infrastructure dependencies.
Control complex interfaces
Review vendor connections, remote support, protocol use, segregation, data flows, and the safeguards protecting operational handoffs.
Prioritize continuity
Evaluate risk through passenger impact, operational disruption, safety, regulatory exposure, and time-critical recovery.
Prove readiness
Turn requirements, controls, evidence, testing, treatment, and acceptance decisions into an auditable record.
Standards
The standards your assessors will ask about.
Built in: control libraries ship with RABUILD GRC. Traced: captured as project requirements and linked to the same controls, evidence, and reports.
ISO/IEC 27001Information security managementBuilt in
IEC 62443Security for BHS, BMS, and other OTBuilt in
NIST CSF 2.0Cyber risk outcomes for leadershipBuilt in
ICAO Annex 17Aviation security, including cyber threatsTraced
EASA Part-ISInformation security for aviation organisations (EU)Traced
NIS2 and national rulesOperator obligations for air transportTraced
Example
Vendor remote access to baggage handling
An illustrative engagement showing how the work flows through CYNAPSE.
The situation
The BHS vendor connects remotely for support. Security wants to know what that connection can reach and whether one compromise could stop baggage flow.
- In CYNAPSE
- 1Model the BHS zone, the vendor conduit, and the shared services it depends on.
- 2Rank exposure on BHS assets by operational impact and reachability from the vendor path.
- 3Record treatments such as brokered access and session recording, with owners and deadlines.
What you get
An exposure and treatment report the operations director can read, showing what was reachable, what changed, and what risk is accepted.
See report typesFurther reading
Practical guidance from the Knowledge Center.
Field notes and playbooks written for teams that run critical systems.
Case Study
Governing Third-Party Remote Access on a Discrete Manufacturing Plant Floor
A manufacturer replaced standing vendor VPN access to production line PLCs with time-boxed, logged, per-ticket access after a near-miss...
Read Knowledge ArticleVendor Remote Access: A Practical Risk Checklist
The specific questions to ask before granting any vendor or integrator remote access to an OT environment.
Read Methodology NoteBoard-Level Cyber Reporting for Critical Infrastructure Operators
What leadership actually needs from a cyber risk report, and why CVE counts are the wrong altitude of information.
Read
Other industries
See CYNAPSE on a scenario like yours.
We walk through your systems, standards, and reporting needs, using the example above as a starting point.