Inside United Airlines: How a global airline is rethinking cyber defense

Thank you all again for coming. Just to introduce myself, I am part of Cloudflare's security team. I lead security strategy. I'm also the chief of staff for security here at Cloudflare. I am very pleased to be joined by Sean Mason. Sean is part of United Airlines and he leads their cyber defense team at United. So I'm super excited to be here. One of the things for me as an outsider observing the aviation industry is that it's a very clean machine where you enter an airport on one side and it throws you out the other at your destination. And there's so many moving pieces in between that in the machine there for you to be able to go from one door to the other. And it's complex, it's complicated, and I'm sure the security around it is complicated too. So that's the part that I'm excited to get into. In terms of just complexity, I wanted to set the stage about United Airlines. 1,500 aircraft across the globe, 113,000 employees, more, and more than half a million passengers every single day that they take from one place to the other. So it's a really, really complex environment. And then there's like a big plethora of partners as well, I'm sure. Yeah, I remember I actually came in during the height of COVID, so I've been there about six years. And I remember we were flying maybe 200,000 passengers a day or something like that. And now we're like 500,000 is a slow day for us. And we're coming into the holiday season, we'll be well over 600, 650. We'll see if we hit 700,000. It's a lot of folks. That is amazing. I know, like, just thinking about your world, Sean, and this is my simplistic view. I think there's four groups that you guys are protecting. There's obviously the passengers and all of the customers and their information. There's operations and your employees. There's aircraft and all of the hardware associated with the operation. And then there's the partner ecosystem and the regional airlines that are catering, your baggage handlers. Tell us a little bit about which of those four is probably the most complicated or the complex to secure? That's a difficult question to answer. First and foremost, if it's a partner of ours, I'm famous for saying, I can't defend what I can't see, right? So we work with our partners routinely. In fact, I'm actually having a handful of them up to Willis Tower here in a couple weeks to chat about cyber and see how we can continue to collaborate and work together. You think about our customers and our mileage plus program, right? You know, hundreds of millions of folks in there, right? That is a lot of data to manage. And it's a huge weight, I'll say, from a security standpoint. And then aircrafts, and I'm sure there's a lot of avgeeks out here, aviation folks. Those are tricking in and of themselves. And we have great partners at Boeing and Airbus to help us with that. But I always go back and like people, Sean, what keeps you up at night? And not kidding, right before I stepped on stage, like my phone is blowing up, right? Because there's something happening in the world. And frankly, it's AI driven, I'm sure. And the reality is the operations, like trying to keep a 24 by 7 operation that's global, just running constantly, is just an enormous weight and enormous pressure, right? And there's a reason we are critical infrastructure. And I'm sure folks have seen, unfortunately, when we've had some downtime, right, for one reason or another, the impact it has on, you know, the US and not just individuals' plans, but also we fly a ton of cargo all over the world as well, right? So it's quite a bit to deal with. Absolutely. And like you're on the security side of the world, right? And there's like a whole universe of operations folks that are keeping the airline up and running. What is your collaboration like with that team? And you spoke about, you know, potential outages. From a resiliency standpoint, how do you look at that play out between security and then the rest of the operations? Yeah, good question. So for those who don't know, we actually have what we call a network operations center that sits in Chicago. And I'll say at any given point, there's like 1000 men and women that are sitting there in this, it's massive, this massive, I'll say, warehouse with, I don't know how many thousands of screens sitting in there, right? And they're running like every aspect of the operation. It's actually really cool to do. We actually, actually like auction off tours. And stuff, if you want to use your miles to go check it out, it's pretty, pretty interesting. And we work with them continually, right? So like when I came in about six years ago, I wouldn't say there wasn't really that creative a partnership, but we've done drills that frankly, we talk about the whole network operations center when something turns into a crisis, maybe a cyber crisis, or maybe something else. The network operations center turns into, as I say, the emergency operations center, right? So we drill that routinely, consistently, constantly, we try to learn from those. I'll say there's those trainings. And then unfortunately, right, we do have actual issues that come up every so often. And I think like, hopefully any good organization, we take those learnings, we take them to heart, we have tons of review meetings out of them. And we just continue to kind of iterate on how we ideally won't have those issues in the future. Right? Yeah. And it's a great partnership. I'll just say that. That's amazing. And if there's somebody coming in from the outside, into your industry, you've been United for a long time now, you're part of aviation ISAC. What would surprise an outsider coming into the aviation industry, especially from a security standpoint? What's a unique thing about your industry that you don't think other people realize? You know, I was kind of talking about that this morning, maybe in a meeting I had. And, you know, I think maybe what makes us a little bit special people always, and I'm a former General Electric individual, and I was very worried about intellectual property. And when I came here, it was a lot more the operations, and then also, you know, mobile and commas, as we call it lovingly, right, very trafficked properties that we have to defend and keep up and running. And even though it's not, I'll say 99% of the time, it's not a security issue. I still have my security team on the calls with the business with our IT partners, looking through everything, trying to figure out what's going on. Because again, the last thing I want to have happen is an impact to the operations. So I think at United, we take it very seriously. And it's never, that's not my problem. I'm not going to go help out. It's like, you know what, I might have that little nugget of information. That could actually help folks understand what's actually going on, maybe avert a bigger issue. So to me, I think that's probably the more interesting thing. It's just the dedication that our teams have to the operation and making sure we keep people and cargo flying safely. That's amazing. And we, through the course of the day today, we've heard different talks about how AI and agents are going to change the workforce. We spoke about 113,000 employees, if not more. The future may have a million or billion agents that are working on things. How do you see your team changing? How do you see an airline like United changing? And how does your job change with that? Good gosh, that's a lot. That's a lot. And I think this is being recorded, so hopefully my folks will watch this. So first and foremost, I just got off vacation. I actually burned through all my tokens. I actually ran out of tokens because I was building stuff for myself. I was building an orchestration agent. I was building a bunch of sub-agents. And I say that because I'm all in on AI. It truly is the future, and we need to embrace it. And it's fantastic what you can do with it. So just from, I'll say, a cybersecurity lens, I'm all in. We've been deploying bits and pieces of the agentic SOC, building on a lot of the great work that we've done with SOAR, which is very deterministic, and now doing some non-deterministic work. We are also talking about things like Red Team. I think you and I were chatting about that earlier. So we built some stuff internally, some different harnesses, and then we're also partnering with some great folks like Arvidin, if you've heard of them. And then I think everybody knows vulnerability hunting and all that good stuff. It's with Methos and the Methos moment from a while ago. So I say that because if you can't hear the excitement and the stuff I'm talking about, we are all in on it. And that's just a piece of it. So that's, I'll say, cybersecurity. But there's also the, I'll say, the IT, the digital technology piece. We're all in on that as well. And then we've also looked at it through a couple other lenses. One, we're calling it everyday AI, and I swear I have a meeting on this every day. But it's just how do we empower our workforce to leverage AI? And I'll just, you know, quick nugget there is I have learned and appreciated so much more of the concept of data protection when you're rolling out AI just across the board. So if you don't have your data protection team in place, if you don't have that set up straight, you're going to be in for a world of hurt. So that's a huge piece for us. And then lastly, the two other pieces I would talk about, I mentioned mobile and calm, right? So I think about our commercial aspects, right? So how can we better enable our customers, maybe give you some cool ideas on where you want to fly, where you want to go. And then lastly, you know, we've been talking about the operation a good bit. But how do we use AI to help augment the work those thousand plus folks that are doing, they're doing up in Chicago, how do we augment that work? And instead of them making like the hundred decisions that they're just used to doing, and they've learned the playbooks, and they know all the rules of engagement, so to speak, that we have, how can we help them make those decisions quicker, like kind of keep that human in the loop and go, you know what, that looks right, approve. And then ideally, when we're in what we call IR ops, or regular operations, which is when maybe there's weather, or maybe there's a computer issue, whatever might happen, how do we get from IR ops that is maybe impacting us? How can we like, soften that blow and make things a lot easier, right? Because there's a lot of repercussions to a lot of decisions. We don't need to get into that to another conversation. But yeah. And what's interesting, when we compare our organization at Cloudflare, 100% of the company uses AI, everybody's building, everybody has the tools available to them. On United's front, is it a central team that is building out RISM processes for the rest of the company to use? How is that progressing? Or are there multiple teams, like in some companies? Yeah, it's, um, it's kind of a mix, right? So we, I think we rightfully did, I'll say a couple years ago, like we started with like a responsible AI governance body, right? And there was a, it's a cross-functional collaborative group, right? So we get together, we really kind of manage how we want to roll out and manage AI across the board. So when things like DeepSeek come out, we actually had the vehicle already where we said, hey, emergency meeting, we're going to get, you know, you 20 people in a room, we're going to explain the issue, and then we're going to make a, an executive decision, essentially, right? Are we going to allow, you know, say, Chinese models to be in our environment or not? So we had that structure in place. And then if we move forward, especially this year, I feel like, I feel like I woke up in January, and it was like, yeah, AI is cool. And then like, February, March, like, if I go back and look at my calendar, it's just completely changed, right? And I swear, every meeting I have is AI based. So there are, I'll just say different groups that are focused on the different aspects that I kind of talked about. But there's not necessarily, while there might be a governing body, so to speak, it's not necessarily one group that's just doing all the work. It's really how do we empower all our employees, and give literally thousands of people access to things like Microsoft CoPilot, Microsoft CoPilot CoWork, Microsoft Studio, Cloud, CLI, etc, etc. Like, there's just, it's, it's a lot, right, to manage and look at. You and I were talking about you doing a trip to Singapore for vacation. A friend of mine, who's a big United frequent flyer, took the flight from San Francisco to Singapore, and... On our new plane, by the way. On the new plane, on the new 7A. And they have Starlink. Yeah. And are there any recent United converts here because of in-flight Wi-Fi? Yeah. So in -flight Wi-Fi obviously was a big topic on Twitter recently. United landed on the good side of it. Tell us more about how you look at Starlink from a security standpoint, because from my simple perspective, there's three groups essentially that are using in-flight Wi -Fi. There's the passengers, there's crew, attendants, pilots, there's ops, I'm assuming. So there's all of these like crazy stories that you read on the Internet about the hacking of planes. Tell us more about that from a security standpoint. Oh my gosh. I mean, you kind of just, you kind of summed up a little bit. So first off, anybody use Starlink yet? I saw a couple hands like on the plane. It's amazing, isn't it? Right? Yeah, I still, like the flight that I do a lot didn't have Starlink for the longest time. And everybody's like, oh, that's a mistake. I finally got it. And like, oh my gosh, this is like game changing. Now I have like a whole setup going. And I don't know if anybody saw there was like one gentleman who had like five screens watching like college football one day. This is pretty cool. It's game changing. So for us, when it comes to a security standpoint, one, I will say, you know, we have a vulnerability disclosure program. The planes are off limits. So if you are sending us stuff, it's like you're not supposed to be doing that. Like you're committing crimes. So I say that lovingly because we do get reports. And trust me, we're working on stuff behind the scenes. We're working with our vendors and our partners to make sure that we're not doing that. And then, yeah, we actually, I would also say there's also that sense, I think people are like, hey, I got a Linux prompt here. So that means I can hack into the plane and fly it. I'm like, that's not how it works, right? You know, these networks are segmented, right? They're built properly by Boeing and everything. They have these massive spec sheets, like safety is the number one priority, right, when it comes to aviation. So it's not how it works. And then, yeah, when you actually get into the nuts and bolts of it, right, there are, you know, our customers, right, who want to use Starlink, they want to play video games. I also hear the folks say, yeah, I joined a Teams meeting. And I'm like, you are not supposed to join Teams meetings, right? That's the other thing. You should not be doing, taking meetings from, you know, 36 ,000 feet. But the other side of the coin is, you know, how do we also make sure our, you know, our crew are taken care of and they can, because we have so much technology that's on the plane. If you've ever seen them walking around with like the little handheld devices are called links or maps, right, depending which one they're using, those are connected in through Starlink, right? So we have essentially segmented networks. That way we're not like cross-talking or having challenges. And then we're actually using you guys to do some, and we had to learn this ourselves, but like to essentially do like DNS filtering, right? It sounds old school, but that's how it works, right? To actually figure out like who can do what and who can go to where, right? And for people trying to get onto Teams calls and trying to do WhatsApp calls, if you're blocked, that's because of Cloudflare. So don't sort of throw hate at us, but just wanted to let you know. We have just a few more minutes left. So let me ask you one last question. Knowing what you know about security and airlines, what makes you feel secure when you fly? And considering all of the chaos that is happening in the world today about agent swarms and everything else, what makes you feel secure to get on a plane? First off, agent swarms is a whole other conversation. We're all in. We all have work to do. I'll just put it that way. And that's why we stay in business, right? And that's why we're at conferences like this so we can learn from each other. But I digress a little bit on buying time. I think the reality is, you know, I mentioned a little earlier around the Network Operations Center. And if there is some crisis that happens, it turns into the Emergency Operations Center. And that is an all hands on deck. And I was joking with the lady back there. I'm like, I have to turn my phone off because I'm like the department lead. I own the chair for cybersecurity. And my phone has the worst alarm because it can be two in the morning, three in the morning. It does not matter. I have to get up. I have to be on that call instantly. And what I've learned on those calls over, you know, six years, unfortunately, we don't have as many as probably folks think. But no matter what's going on in our corporate network or corporate environment or, you know, back to kind of the Starlink and like the segmentation of the networks, the reality is like the planes, they'll be all right, right? We can land those things safely. The pilots are very well trained, right? They know what they're doing. And I think we were joking a little bit about like, you know, hitting the button on a Tesla and kind of auto drives, which is great. And I'm sure a lot of us just think, oh, it's autopilot in the plane. It's like, no, something truly happened. There's so many redundancies built into the aviation sector and the business and operations and how we do things. That resiliency, redundancy, failover and safety, I can't stress safety enough, is really the most, it's like the North Star. It's the guiding thing that we have out there. So, again, even if there is some, and I hope it never happens, some major cyber attack, no, we're still gonna be able to land our plane safely and get people, you know, on the ground. Let me end with this. I know you guys are all at Aviation ISAC in Vancouver about a week or two months ago. Two weeks ago, something like that. And what's the biggest topic that you heard about at Aviation ISAC? What is the thing that aviation as an industry is worried about or thinking about? Yeah. I mean, I helped curate the whole thing, so I kind of know what the theme was, but it was AI, right? You just saw my face. We were talking about swarms of AI agents. And heck, I think there's been, gosh, when I was actually in Asia, I think it was, what, Korea? And I think Japan's, they're getting hit pretty hard and pretty badly over there. And then I think, I know there's, I'll just say, I'm very privy to some calls happening this week to talk about AI hitting a lot of different sectors and companies, right? So, to me, especially being critical infrastructure providers, there is a huge weight to make sure that we can keep, you know, people in Cardo flying safely. And AI is really, it's been a huge paradigm shift. And, you know, it's very unfortunate. I think some people looked at it, you know, when it was coming out and even earlier this year, and they're like, nah, it's not a big deal. Methos, nah, don't worry about it. It's like, you know, even if it's not Methos, like some of these frontier models, some of these open weight models, they are extremely capable. And, you know, I mentioned Armitain for a minute, I'll plug them, a great group of folks over there. They're not using Methos, they just have engineered their way into, frankly, a very nice, I'll say, organization, a way of looking at things. So, if they can do it, and they're fantastic people, they're the good guys, trust me, the bad guys can do this as well, right? That's what's keeping me up at night. And I think from an AVH perspective, that's what we need to really focus on right now. That's a good note to end on. Thank you so much, Sean. Appreciate it. Thank you.