Complacency, Cybersecurity Threats, and New Rules: What 2026 Will Demand of European Pilots

Europe continues to be one of the safest regions in the world to fly. The latest EASA Annual Safety Review for 2025 shows very low numbers of fatal accidents involving European commercial air transport, even with traffic growing to over 7.7 million flights.

It’s a success story – but one that comes with a warning. At the 2025 EASA Annual Security Conference in Copenhagen, regulators and industry leaders identified complacency as one of the biggest emerging threats: after years of strong performance, there is a risk that organizations and individuals will assume that security is “sorted out” and underestimate new risks.

At the same time, the digitalization of aviation is accelerating. Ransomware attacks and other cyber incidents have disrupted airport operations across Europe , exposing critical dependencies on supplier systems and connected infrastructure.

For European pilots in 2026, the message is clear: technical flight skills remain essential, but they are no longer sufficient .

Understanding cybersecurity, information security rules, data-driven decision making, and AI is now part of the job.

This article summarizes the main changes that pilots should expect – and how to stay ahead of them.

Why Europe is Safe – and Why It Can Be Dangerous

EASA’s 2025 Annual Safety Review confirms a decade-long trend: commercial air transport in Europe has maintained a very strong safety record , with only a handful of fatal accidents and low accident rates relative to traffic volume.

Globally, however, the picture is more mixed. The ICAO’s 2025 State of Global Aviation Safety report records an increase in the number of accidents and fatalities compared to the previous year, reminding the industry that progress is not linear.

At the EASA 2025 conference, speakers warned that this contrast – strong regional performance versus global volatility – could lead to complacency .

The rules are perceived as stable and mature…
Security management becomes a “checklist exercise”…
…And the training focuses on minimum regulatory requirements, rather than emerging risks.

For pilots, complacency can manifest itself in subtle ways: accepting degraded safety margins, normalizing circumventing practices, or relying on automated systems without fully understanding their limitations.

The challenge for 2026 is to maintain a restless security culture: treating each new technology, regulation, and incident as an opportunity to update skills – not to relax them.

The New Threat Landscape: Cyberattacks on European Aviation

While the traditional causes of accidents (loss of control, CFIT, trackside events) remain under constant scrutiny, a different risk category has risen to the forefront: cybersecurity.

In recent years:

Ransomware incidents have disrupted airport and airline operations worldwide, with one analysis estimating that ransomware attacks on airlines and airports increased by more than 600% in 2025 alone.
A third-party ransomware incident affecting a major aerospace supplier led to widespread disruptions at several European airports, highlighting the vulnerability of critical supplier systems.
ENISA’s 2025 Threat Landscape report highlighted that the EU is facing cyber threats from hacktivists and state-aligned actors, with transport infrastructure among the main targets.

From the cockpit’s point of view, these threats can manifest as:

Loss of access to flight planning or briefing systems.
Disruptions to airport operational databases and NOTAM delivery.
Ground communications or dispatch tools compromised.
Data integrity risks in EFB applications and connected avionics.

EASA’s dedicated cybersecurity domain explicitly recognizes civil aviation as a high-value target and calls for security to be integrated “by design” into aircraft, systems, and operations – and not treated as a secondary IT issue.

For pilots, this means that cyber literacy is now part of security literacy.

EASA Part-IS and AI: The Regulatory Change Pilots Must Be Aware Of

Two regulatory developments are particularly important as we move towards 2026:

EASA Part-IS – Information Security Comes of Age

The EASA Part-IS (Information Security) introduces harmonized requirements for how aviation organizations manage information security risks, from governance and risk assessment to incident reporting.

National authorities such as Switzerland’s FOCA have confirmed that Part-IS began to be applied from October 16, 2025 to airport operators, ramp control services, and aircraft manufacturing and development organizations, with a phased extension to other entities in the ecosystem.

Although Part-IS is primarily an organizational obligation, it has concrete implications for pilots:

Stricter policies on access control , password management, and tokens.
A more structured report of information security incidents (e.g., compromised devices, suspicious access).
Greater emphasis on training and awareness-raising for all personnel who handle operational or security-related information.

In other words, pilots are expected not only to follow procedures, but also to understand why those procedures exist and how their behavior can introduce—or mitigate—cyber risk.

AI in Aviation – Regulation Keeps Up with Technology

EASA has also published its first regulatory proposal on Artificial Intelligence for aviation , which is now open for consultation.

At the same time, pilot associations in Europe have been vocal: a Eurocockpit position paper by the ECA underlines that AI should support, not replace, human pilots , and that any implementation should keep humans in command, with clear accountability and robust oversight.

For pilots, the emerging reality is:

AI tools (from predictive maintenance to trajectory forecasting and decision support) will increasingly influence operations.
Understanding how these tools work , what data they use, and where their limitations lie will be essential for exercising leadership judgment.
Training that combines technical knowledge, threat and error management, and ethical decision-making will be in high demand.

The Skills European Pilots Will Need in 2026

In addition to type qualifications and recurring checks, three groups of competencies stand out:

1. Cybersecurity Awareness and Information Discipline

Recognizing attempts at social engineering directed at the crew.
Protect login credentials and tokens on EFBs and company portals.
Handling sensitive operational information (flight plans, crew schedules, incident reports) in accordance with Part-IS expectations.
Knowing how and when to escalate cybersecurity-related anomalies.

This transforms “user” pilots into active advocates for their organization’s information environment.

2. Data-Driven Decision Making

Interpreting data from AI-based decision support tools without excessive reliance on them.
Verify automated recommendations against operational reality.
Understanding how bias and data quality can affect results.

These skills build resilience when systems fail or provide conflicting guidance.

3. Safety Culture 2.0: Combating Complacency

Maintain a questioning attitude even when the metrics seem excellent.
Using safety reports, debriefs, and LOSA-style observations as learning tools.
Participate in safety and cybersecurity campaigns as credible messengers for younger pilots.

This is exactly the type of behavior that EASA wants to encourage in response to its concerns about complacency.

How IITA Cybersecurity Certification Helps Pilots Stay Ahead

In this context, dedicated training becomes a strategic differentiator. The IITA Aviation Cybersecurity for Pilots certification is designed to give pilots and aspiring pilots a structured foundation in:

The fundamentals of cybersecurity in aviation and the main types of threats.
Security principles and access control concepts
Business continuity, disaster recovery and incident response
Network security and security operations
Specific case studies from aviation, ranging from flight planning disruptions to airport system failures.

Because the program is 100% online and tailored to pilots , it adapts to scalability constraints while speaking the operational language of airline flights—not generic IT jargon.

For pilots who grew up in a highly automated environment but never had formal cybersecurity training, this type of certification can be the difference between reacting to new rules and leading the conversation at their airline or operator.

A 2026 Readiness Checklist for Pilots

In conclusion, here is a practical checklist that European pilots can use to assess their readiness for 2026:

I can explain, in simple terms, what EASA Part-IS is and how it affects my organization.

I am familiar with my company’s process for reporting information security incidents and near-incidents.

I understand the fundamentals of ransomware and third-party cyber risk, and how they could impact my daily operations.

I have received role-specific training on aviation cybersecurity over the past 12–18 months.

I am familiar with the principles behind the AI-based decision support tools used in my operation, and I am aware of their limitations.

I regularly engage with security communications – I don’t just read the bare minimum.

If several boxes remain unchecked, 2026 is the ideal time to invest in structured skills upgrading.

IITA’s focus on technical and vocational aviation education and specialized certifications was built precisely for this moment: to help pilots and aspiring professionals go beyond compliance and become active guardians of safety in the skies of Europe.