AI, Automation, and Security in Business Aviation

AI can help business aviation move faster, but the go/no-go decision, and the security of the data behind it, still rest with people. That was my message on a recent conference panel, where I joined operators, safety specialists, and security leaders to talk about where AI, automation, and cybersecurity meet in flight operations. Here is what I shared, and what I took away from my fellow panelists.

Automation And AI Are Not The Same Thing

We often use these words interchangeably, but they describe different things. Automation carries out tasks with less human involvement. AI can analyze information, generate content, and make recommendations. The two can work together: an automated workflow may use AI to help complete a task.

Traditional automation follows predefined steps. When a trigger occurs, for example, sending a reminder before a deadline. AI can help with tasks such as summarizing a report or identifying patterns in data. Neither approach is risk-free. The risk depends on the task, the data, and how much authority we give the system.

My shorthand: automation carries out tasks; AI can help interpret information, draft content, and recommend actions. Human oversight is a deliberate choice about how we use these tools. In flight operations, our approach is to keep people responsible for the go/no-go decision.

Where Each Tool Belongs In The Trip Lifecycle

I walked the audience through the stages of a trip to show where technology helps at each one, and where it should stop.

• Sales and requests: Technology, like Portside’s new Roger AI Quote Assistant (Beta), can flag a hot opportunity with a high likelihood of close and tell you to quote it quickly. A principal on your Part 91 flight can also submit a request through Portside’s Owner Portal, and it can schedule directly into your solution.
• Scheduling sync: This is automation, and it matters a lot. Data gets handed to other systems such as FuelerLinx and MedAire. Everybody needs the same data, in the same format, and it has to be correct. In our experience, mistakes happen when you rekey data or hand things off. The sync gets the right data to the right people at the right time. (Yes, I told the story of the trip that was supposed to go to Santa Ana and went to San Diego. It haunts me to this day.)
• Dispatch and flight planning: This is where agents come in. Not sponsored, and not validated by me, but ForeFlight just announced agents that automate handoffs and trip feasibility. An agent working alongside a human makes this stage more efficient.
• Fuel optimization: We rely heavily on integrations with partners like FuelerLinx. Passing data through correctly and keeping it correct determines whether your team can act on it.
• Flight risk analysis: Products like Portside RiskAssist automatically scores each flight and gives you early indicators of risks and mitigations. When we built AI into our tech stack, we were deliberate about where it went and what it could decide. We chose not to have AI do the automated scoring. That is automation, because it is rules-based and you, the operator, decide the rules that drive the risk scores. We are not having AI make decisions or recommendations on risks and mitigations.
• Operational execution: This stage is human-led for a reason. The people in the room have experience and the ability to think critically, and those decisions should stay with them. Automation helps you move faster and follow rules, and AI creates content and makes recommendations. Safety and efficiency are the top directives for all of us keeping people safe in the air.

We can use AI and algorithms to pull in a rule set built from lessons your flight department learned the hard way, but the go/no-go call has to rest with a human. Risk can change multiple times a day, and someone has to know what the operation is willing to accept.

A Pretty Interface Is Not A Secure System

Our moderator asked a pointed question: what if an operator told an AI tool to recreate its flight management software and skip the subscription? My answer was that software is not just the UI. It is not about the pretty interface. It is about the infrastructure underneath and the rigorous testing behind it:

• Servers and data that are secure
• Each tenant segmented, so client data cannot co-mingle with another client’s data
• Third-party audits, with systems tested by outside people as well as your own team

I want to know that if somebody tries to hack into one of our products, we have the right mechanisms in place to keep our data secure.

There is a service risk too. You can absolutely vibe code software. But when a system of record carrying sensitive data breaks, and software will break, who can fix it?

I see the same issue from the integration side. Someone in the flight department with too much time on their hands builds a really cool platform and asks us to plug into it. Everyone that participated on the panel does annual security audits and long questionnaires to keep our systems locked in. Once you connect something unvetted, you have no idea where your information is going or what line of defense you have.

My framing: data security is the primary directive. The secondary one is the layer your AI is built on. If you build AI on weak data, or on open data where you do not control what comes in and out, it cannot do anything helpful for you.

Practical Steps For Vetting Vendors

• If your company has no CISO or CTO, look into a fractional security or technical officer. Ask them to help you build a vendor risk management questionnaire you would feel comfortable applying to any technology. Something is better than nothing.
• Make sure someone on your team knows what they are reading in the contract and the data protection agreement before you agree to anything.
• If you are vibe coding, please test it rigorously.

Keep People In Control

When I think about adopting AI and other technology, I like to apply what I call the new hire test. A good AI tool should let you train new hires faster and give them access to the data they need sooner. They then make judgment calls they feel are well informed, because the right process and the right technology have set them up, and the people stay in control of the decisions. If a tool does not pass that test, it is probably adding noise rather than value.

That fits the people, process, and technology view my fellow panelist Kelly Roby, CAM shared. She described it as a three-legged stool, and technology is only one leg. You need good people, enough of them, and well-resourced. They need good judgment and the skills to make sound decisions. And you need well-defined processes to guide those decisions. With retirements, job changes, and the pilot and maintenance shortages we all know about, many flight departments are backfilling positions constantly. When that happens, solid processes are what let new people come in and understand the codified rules and knowledge your team has built over time. Technology can make that handoff more seamless, but it cannot replace the other two legs.

This is also why the goal of AI is not to replace your people. It is meant to free up your time so you can use your skills to better your company. Automating the mundane work, like rekeying data or chasing handoffs, gives your team room for higher-value work and better judgment. 

My closing reminder on this theme: as you adopt these tools, do not outsource your thinking to AI.  Question its output, apply your judgment, and take responsibility for the decisions you make.

Takeaways For Flight Departments

• Know the difference between automation and AI, and decide deliberately where each one goes in your tech stack.
• Keep humans in the loop for risk decisions and operational execution.
• Treat data security as the first priority, and vet every integration.
• Do not skimp on back-end work, testing, and vendor risk review, even when the front end looks finished.
• Use AI to free your team from mundane tasks so they can spend time on the work that requires their expertise and judgement.

I’m excited about what this technology can do for our industry. Embrace it, keep your own judgment at the center, and test everything rigorously.ns people make every day. Good recurrent training just helps make sure those are the right ones.

Back to Insights