United Airlines Deploys Defensive AI as it Rolls Out Starlink Across Fleet, CISO Says

RESTON, Va. — United Airlines is deploying defensive artificial intelligence and operationalizing cybersecurity as it rolls out in-flight Wi-Fi connectivity across the fleet by the end of 2027, according to Deneen DeFiore, vice president and chief information security officer (CISO), at United.

Speaking Monday at the 10th annual CyberSat conference in Reston, Virginia, DeFiore described the “vulnerability apocalypse” in commercial aviation and space, where AI-enabled threat actors are discovering and exploiting weaknesses in critical systems faster than most organizations can respond.

“The bottleneck is quickly becoming the ability to remediate and protect those systems,” she said. “Vulnerability discovery … only really matters if the decision becomes faster and the ability to remediate becomes faster too.”

United is moving closer to the ability to pace AI-enabled cyber incidents, according to DeFiore, who said the airline has started to deploy AI “from a defensive perspective.” On the enterprise side, United is using frontier models to scan its code base. It is also looking at “continuous red-teaming capabilities” to ensure digital properties are secure.

The discussion of cybersecurity readiness comes as United accelerates the deployment of Starlink in-flight connectivity (IFC) across its fleet. Originally scheduled to take two to three years, DeFiore said the timeline had been reduced to 18 months.

As of Nov. 2, 671 aircraft, or half of United’s daily flights, are equipped with Starlink. The service is not yet enabled for the flight deck. However, United is engaged in “high visibility work,” including an aircraft interface device (AID) interface for the cockpit. The entire fleet is scheduled to have IFC by the end of 2027.

DeFiore also discussed the rise in GPS jamming and spoofing incidents impacting commercial aviation. The number of incidents has risen to tens of thousands of reported incidents per month, according to the International Air Transport Association (IATA), as well as a growing market for alternate PNT technologies. United largely relies on pilots to detect and respond to GPS jamming and spoofing incidents, and it turns to its government partners to assess the intelligence picture.

“It’s not a technology but a standard operating procedure,” DeFiore said of handling GPS degradation. In the future, United is looking forward to a modernized ecosystem that will assist with better telemetry and detection.

During the keynote discussion, DeFiore explained shared commonalities between commercial aviation and space that impact cybersecurity. Both need to manage safety-critical operations, complex dependencies, and technologies that are assessed by the customer based on reliability and availability.

“We operate systems that must be operational for a long time when the cybersecurity landscape changes,” she said. “I can’t wait for that perfect technology modernization program. I have to engineer controls around entitlements I have and the environment I operate in today.”

That translates practically into implementing access privileges, increased monitoring and exploring different ways to contain failures when they do occur. It has also led United to test options for restoring continuity of operations based on an understanding of the minimum capabilities needed to operate United’s core service, what technologies support those capabilities, and who has decision rights.

“Resilience … has to extend through multiple organizations or it just doesn’t work,” DeFiore said.