The real gap is not that someone can “hack a plane.” It is that aircraft keep trusting ground-fed data and radio commands that many security tools never see, so disruption can happen with no onboard login or obvious SIEM trail. The standard SOC model misses failures caused by spoofed GNSS, bad flight data, or unsigned control messages because the aircraft accepts the input through the expected channel.
The interview ties that blind spot to concrete aviation cases: GNSS interference that leaves no log, and a PX4 Autopilot issue involving unsigned command channels such as MAVLink, plus the broader data-loading chain behind electronic flight bags. The loss picture still sits on the ground in reservations, handling, MRO, crew scheduling, and airport ops, but the aircraft is the separate risk because it can be degraded or redirected through trusted inputs that look normal to the system.
For airlines, airport operators, MRO teams, and drone operators, the key change is where to look for failure. Monitoring the aircraft alone is not enough when the control link and upstream data sources can carry the problem.