Airbus CSO on Supply Chain Blind Spots and AI Red-Teaming Limits

Pascal Andrei, CSO at Airbus, highlights the evolving threat environment in the aerospace and defense sector. Recent geopolitical realignments have changed the threat calculus for A&D organizations, with sub-tier suppliers becoming entry points for state-backed attackers.

Supply Chain Blind Spots

While prime contractors have hardened their perimeters, the most exploitable blind spots have migrated deep into the sub-tiers and the ‘digital threads’ connecting them. Threat actors target smaller firms as ‘jump points’ to disrupt global aerospace and defense delivery.

Cyber-Physical Attacks on Spacecraft

Cyber-physical attacks on spacecraft are still rare, but security teams should watch for early-stage signals that a threat actor is probing satellite command-and-control systems. Airbus has established a dedicated product security organization to protect satellites against threats throughout the entire product lifecycle.

Translating Compliance into Operational Security

DIB contractors struggle to translate compliance-centric frameworks into actual operational security outcomes. The most significant struggles are in sustaining basic cyber hygiene, defining the scope of controlled unclassified information, and treating compliance as a continuous process rather than a one-time project.

AI Red-Teaming Models

Defense organizations lack appropriate validation and red-teaming models for AI systems used in targeting, navigation, or threat detection. Current red teaming often focuses narrowly on the machine learning model in isolation, missing the broader system of systems context.

For example, a vulnerability in the sensors, data pipelines, or human operator interface could lead to systemic failure. Therefore, it is essential to develop standardized, systemic methodologies to test the entire operational architecture against sophisticated threats.

In conclusion, the aerospace and defense sector faces a rapidly evolving threat environment. To stay ahead, organizations must prioritize collaboration, intelligence-led approaches, and proactive security measures. By doing so, they can mitigate supply chain blind spots, protect against cyber-physical attacks, and ensure the safe and effective use of AI systems.

Meanwhile, security teams must remain vigilant and adapt to the changing threat landscape. Additionally, they should focus on sustaining basic cyber hygiene, defining the scope of controlled unclassified information, and treating compliance as a continuous process. Finally, they must develop and implement effective AI red-teaming models to ensure the safety and security of AI systems.