As Air Traffic Management (ATM) becomes more digital, interconnected, and data-driven, cybersecurity is no longer a technical side issue. It is fast becoming a core question of resilience, trust, and operational readiness in Malaysia’s aviation ecosystem.
Most people never see how air traffic is managed.
They see the terminal, the aircraft, the boarding gate, the runway or the people who fly the aircraft. They experience the journey, but not the invisible system that makes the journey possible. Behind every smooth departure and safe landing sits a dense web of communications, surveillance, procedures, systems, and human decision-making that keeps aircraft moving through the sky in an orderly, predictable way.
It is one of aviation’s quietest successes, per se, but it is also changing.
ATM is no longer confined to radios, radar display, and controller coordination in the traditional sense. It is becoming increasingly digital, data-rich, and interconnected. Legacy infrastructure now operates alongside modern platforms, satellite-based navigation, broader information exchange, and tighter integration between operational and support environments. That transformation promises better efficiency and smarter coordination. It also creates a much wider cyber-attack surface than the industry once had to manage.
That is the part that the owner of the Malaysian ATM should be paying very close attention to.
Yes, an ATM system may be isolated, “on paper”. But “isolated” is often treated like a magic word, as if disconnection from the internet automatically confers immunity. It does not. The Stuxnet attacks on Iranian nuclear facilities proved that operational technology can still be compromised even in air-gapped environments. Likewise, attacks on Ukrainian infrastructure showed how malware can move from enterprise IT systems into safety-related operational networks through interfaces, shared access points, update pathways, removable media, or trusted connections.
The issue, therefore, is not simply whether the system is disconnected from the Internet, but whether every pathway into that environment is governed, monitored, and secured. A disconnected system may look safe in architecture diagrams, in practice, it is only as secure as the weakest bridge into it.
The more digital the sky becomes, the closer cyber risk moves to operations.
Cybersecurity in aviation is often discussed as though it belongs mainly to IT teams or technical specialists. In reality, for ATM, cybersecurity is much closer to operations than many people assume.
When systems become more interconnected, risks no longer stay neatly inside one box. A weak endpoint, an exposed credential, poor network separation, insufficient monitoring, weak vendor controls, or a poorly governed remote connection can all create consequences that reach far beyond the screen of a single technician. In a safety-critical environment, even small control weaknesses can multiply quickly if they sit close enough to operational processes.
That is why the conversation has shifted.
The real question today is not whether Malaysian ATM are vulnerable to cyber threats. Of course it does. Every modern critical infrastructure environment does. The more important question is whether the control environment around those systems is evolving as quickly as the systems themselves. Digital modernization without disciplined security governance is not resilient. It is exposure.
The threat is no longer theoretical, the lesson is not purely technical.
Recent discussions across the aviation sector have made this increasingly clear. ATM now relies on a mix of older infrastructure, newer digital systems, large-scale information sharing, and expanding dependencies between technical and people. That makes the system stronger in some ways, but also more vulnerable in others. The emerging lesson is that cyber risk in ATM is not only about hackers “breaking in.” It is also about manipulated data, weak trust boundaries, human error, incomplete procedures, supplier dependencies, and institutional assumptions that have not been stress-tested enough.
Prof. Chris Johnson of Glasgow University via Invited Briefing Note Five on Defensive Measures to Improve the Cyber Security of European Air Traffic Management has exhorted that the pace of digital interconnection in aviation has eroded many of the protective separations that once helped isolate operational environments. It notes that ATM now depends heavily on integrated digital networks, commercial off-the-shelf technologies, and increasingly complex supply chains, all of which raise the stakes for cyber defence.
The message is straightforward.
ATM cybersecurity is no longer a matter of technical housekeeping. It is a matter of operational trust.
Why governance matters more than many organisations admit.
One of the clearest lessons emerging from recent assessments is that the greatest weaknesses in critical environments often do not stem solely from technology. They begin with governance.
Who owns the system?
Who approves the policy?
Who maintains the asset register?
Who assesses third-party risk?
Who decides whether an event is technical, operational, or cyber in nature?
Who has the authority to escalate?
Who validates recovery?
If those questions do not have clear answers, then the organisation may be more exposed than it realises.
This is where many institutions face their real cybersecurity test, not when an attack makes headlines, but in the quieter weaknesses embedded in day-to-day operations. In ATM, those are not minor administrative flaws. They are part of the threat picture.
Security by design is no longer optional.
The industry is moving toward a sobering reality that cyber resilience cannot be added later once operational systems are already entrenched.
It has to be designed in.
That means more than installing tools. It means building secure architecture from the outset, maintaining clear segmentation between environments, applying disciplined access control, hardening endpoints, improving visibility across Information and Communication Technology (ICT) and Operational Technology (OT) and ensuring that continuity and recovery are practiced rather than merely documented. It also means accepting that people remain central to cyber resilience, both as a potential weakness and as an essential defence.
The strongest ATM cybersecurity posture will not come from technology alone. It will come from aligning technology, governance, training, and leadership.
That is where many organizations still struggle.
The questions Malaysian ATM should be asking now.
For Malaysian ATM, the most useful discussion may not be “Are We Secure?”
That question is too broad, and too easy to answer with false confidence. The better questions are these:
Are critical systems clearly owned and mapped?
Are cyber risks being reviewed often enough to reflect operational reality?
Are suppliers and contractors governed with the same seriousness as internal teams?
Are resilience and recovery being exercised, not just documented?
Are any new projects embarking on Cybersecurity considerations?
And are leaders treating cybersecurity as an operational responsibility rather than a narrow technical function?
These are not abstract governance questions. They are practical tests of preparedness. Based on EUROCONTROL’s report, own defensive guidance for ATM environments echoes this logic by ensuring competent cyber leadership, maintaining current risk assessment, controlling the supply chain, exercising cyber resilience, and acting before weaknesses become incidents. That advice remains highly relevant well beyond Europe.
Malaysian’s ATM does not need alarmism. It needs seriousness.
There is no value in overstating the case. Malaysian ATM is not uniquely vulnerable, and digital exposure does not automatically mean digital failure. But there is also no value in pretending that cybersecurity risk remains distant from the operational core of air navigation services.
It does not.
As ATM become more dependent on digital infrastructure, cyber discipline must grow with them. That means stronger governance, better visibility, tighter supplier assurance, more robust monitoring, more mature endpoint management, and a deeper culture of accountability across operational, technical, and leadership layers. It also means recognising that resilience is not measured by whether disruption has happened yet, but by whether the system is ready when it does.
That is the real challenge.
Not whether the system works on a normal day. But whether it will still be trusted on a difficult one.
In aviation, safety may be visible in outcomes. But cybersecurity is often visible only when it has already been neglected.
The harder truth is that many organisations are still firefighting cybersecurity rather than governing it holistically. They react when a threat appears, install a firewall, buy a branded “cybersecurity solution,” and then blindly trust the provider as if procurement itself were a control. It is not.
Final approach.
So, is the Malaysian ATM truly free from threats? No critical digital infrastructure ever is.
Malaysia’s path to a resilient Air Traffic Management (ATM) ecosystem requires a sophisticated harmonization of the Cyber Security Act 2024 and National Critical Information Infrastructure (NCII) mandates with international ICAO standards. This integration transcends mere compliance. It demands a multidisciplinary “triad” in which ANSPs, IT specialists, regulators, and ATM engineers converge to address the operational and technical complexities of data integrity and system maintenance.
Ultimately, the credibility of Malaysian’s ATM cybersecurity governance hinges on replacing vague, siloed accountabilities with a unified framework that bridges the gap between operators and regulators, bolstering regional safety with clear, actionable duties rather than fragmented, cosmetic policies.
The smarter question is whether the operations sector is building the maturity, discipline, and resilience required to face those threats without waiting for a serious disruption to force the lesson home.
That is where the real work begins.
