Securing the Skies – Protecting Aviation from Cyber Threats
When people hear the words ‘cyber security’, they often imagine someone sitting in a dark room surrounded by screens. Chris Gorton smiles at that idea. His role at the UK Civil Aviation Authority (CAA) is a world away from that stereotype. As Cyber Security Certification Lead, he works with aircraft manufacturers, airlines, drone operators and even rocket companies to keep aviation systems safe.
‘Aviation relies on technology more than ever’
Chris explains why his job matters: ‘Since the dawn of the jet age, technology has become instrumental to the way the aviation ecosystem works. Because the world is so connected, there’s always the potential that someone could disrupt that and have a huge impact. That’s why our job is to protect the technology and make sure aviation remains the safest way to travel.’
His team covers an incredibly broad range of work. ‘One day we could be looking at a new business jet coming into service. The next day it might be modifications to a wide‑bodied aircraft, or the latest drones for delivery services. We also work internationally – only last week I was in the United States as part of a global working group with the FAA and other regulators.’
A role that’s far more than screens and code
When asked whether his job involves sitting in front of a computer all day, Chris laughs: ‘We do have brilliant people who do that in our internal IT security team, but the oversight team I’m in is very industry‑focused. A lot of our work is about understanding organisations, meeting people, seeing how systems work and helping them manage risks.’
His week usually involves a mix of face‑to‑face visits and virtual meetings. ‘It’s important for us to understand how each business operates, and you get that best by being there in person. But we do plenty of online follow‑ups so we’re not travelling constantly.’
Chris also works a flexible week so he can care for his toddler son on Mondays. ‘I work a four‑day week, but longer hours on those days. It gives me the flexibility to manage my diary, which is something I really value.’
Building a resilient, skilled team
Chris leads a team with a wide range of specialisms. ‘At first we thought about having each person own one area, but that doesn’t build resilience. If someone’s off sick, the work stops. So now we have two or three people who can cover each area. It means people can also grow their skills and choose what they want to specialise in.’
The skills you really need
Problem‑solving is at the heart of cyber security. ‘There’s such a diverse range of systems and threat actors. No two organisations will deal with risks in the same way, so you need to come up with solutions that fit them.’
Good communication is just as important. ‘A lot of the problems are technical, but the people you’re explaining them to might not be technical at all. You need to turn complicated information into something everyone can understand.’
And despite the tech focus, Chris doesn’t think you need to be the most qualified person in the room. ‘When I interview people, I’m not looking for someone with the most certifications. I’m looking for someone who can work well in a team, manage their time and write clear reports. We can teach the technical stuff.’
A career shaped by passion
Chris didn’t come through a traditional cyber route. ‘I finished high school with average GCSEs. I wasn’t a standout student. I did A‑levels, then joined the RAF at 19 as a policeman. I specialised early on in security and spent 13 years in the military.’
Later he moved into private defence, working on mission‑planning systems for fast jet and helicopter crews. ‘It was fascinating learning how crews used the systems and how they needed to be secured.’
He joined the CAA three and a half years ago and now leads the cyber oversight team.
What’s kept him going is simple: ‘I’ve always loved aviation. And I’ve always loved computers. Being able to combine those two passions is what brings me to work every day.’
The stressful moments – and how he handles them
Chris is honest about the pressure: ‘Cyber attacks can be stressful. A couple of years ago there was quite a widespread incident, and suddenly everyone – organisations and government ministers – wanted information. You just take a step back, decide what’s urgent and work as a team.’
And the secret to staying calm? ‘Generally have a cup of tea.’
Do something you love
Chris’s message to young people is clear: ‘Find a job you’re passionate about. Don’t chase money. If you love what you do, you’ll flourish, and the rest will come. Choose something that excites you, and find a job in that area.’