Loading story…
A Government Accountability Office audit found significant weaknesses in how the Federal Aviation Administration and Transportation Security Administration manage aviation cybersecurity, raising concerns about the resilience of U.S. aviation systems. The FAA had fully implemented only three of seven cybersecurity strategy objectives, with gaps in cyber monitoring, incident response, privileged access controls, standards compliance, zero-trust migration planning, and complete reporting of cybersecurity spending. GAO warned that weaknesses such as poor patching and unsupported operating systems could disrupt communications and alter flight data, even though no successful cyberattacks on aircraft avionics have been reported.
The audit also found that the TSA is still relying on an outdated 2018 Cybersecurity Roadmap that does not clearly assign responsibility for securing airlines and airports or align with current Department of Homeland Security strategy, contributing to confusion and weak accountability across the sector. GAO issued five recommendations calling on TSA to update and clarify its roadmap and on FAA to improve budget reporting, zero-trust planning, and monitoring of its revised strategy; the review noted that FAA and TSA have cooperated effectively through the Aviation Cyber Initiative and that FAA certification and National Airspace System authorization processes generally addressed identified avionics cybersecurity practices.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
The audit recommended that TSA update and clarify its cybersecurity strategy and responsibilities, and that FAA improve implementation tracking, monitoring, zero-trust planning, and cybersecurity budget reporting. GAO issued five recommendations in total across the two agencies.
A Government Accountability Office audit found significant weaknesses in how the FAA and TSA govern and implement aviation cybersecurity. The audit said FAA had fully implemented only three of seven cybersecurity objectives, while TSA was still relying on an outdated 2018 roadmap that did not clearly assign oversight responsibility.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Government Accountability Office report to Congress found that federal cybersecurity reporting requirements are heavily fragmented and often duplicative, with **80 of 117 regulations** issued by **37 agencies** overlapping across nine critical infrastructure sectors. GAO said those rules contain at least **125 reporting requirements**, many of which impose the same written reporting obligations on regulated entities or create potentially conflicting demands across sector-specific and cross-sector regimes. The report said harmonization efforts have made only limited progress despite federal directives assigning the Office of the National Cyber Director a lead role in reducing overlap and compliance burdens. GAO highlighted the impact on critical infrastructure and financial services organizations, which can face multiple incident-reporting and disclosure obligations from different regulators, including possible overlap involving Department of Homeland Security incident-reporting rules, Securities and Exchange Commission cybersecurity disclosure requirements, and pending Cyber Incident Reporting for Critical Infrastructure Act implementation.
Jul 28, 2026The U.S. Department of Health and Human Services (HHS) has not implemented 82 high-risk cybersecurity and IT management recommendations from the Government Accountability Office (GAO). These include critical issues such as event logging, digitized record handling, and IoT device inventory. The lack of action increases risks to sensitive health data and national security, according to the GAO report released on September 12, 2025.
Jun 29, 2026
A Department of Homeland Security inspector general found that 88 of 102 Federal Civilian Executive Branch agencies failed to fully implement CISA's mandatory Secure Cloud Business Applications (SCuBA) policies by the June 2025 deadline under Binding Operational Directive 25-01. As of February 2026, 78 agencies remained noncompliant, leaving required cloud-security baselines only partially deployed. The missing measures include blocking legacy authentication methods, enforcing multifactor authentication, and safeguarding sensitive and personally identifiable information. The inspector general warned that the gaps leave federal cloud environments vulnerable to preventable attacks and concluded that CISA lacks sufficient authority to compel agencies to implement Binding Operational Directives completely and on time.
Sep 25, 2026