Airlines & travel cybersecurity

Applicable regulations

• PCI DSS for booking/payment flows
• DPDP Act 2023 for passenger (PNR) data
• CERT-In empanelled testing
• Partner/GDS & card-network requirements

Common cyber risks

• Payment and loyalty-programme fraud
• PNR/passenger-data exposure across GDS and partners
• High-traffic availability and DDoS risk
• Sprawling web/mobile/API attack surface

Audit findings we typically see

• Booking/payment pages in PCI scope
• Excess passenger-data retention
• API abuse across partner integrations
• No recurring testing across frequent releases

Services required

• PCI DSS assessment
• DPDP privacy programme
• VAPT (web/API/mobile)
• Web application security testing
• API penetration testing

Our engagement approach

• Scope. Map booking, payment and PNR flows across web, mobile and partners.
• Assess. PCI and DPDP gap testing plus recurring VAPT.
• Remediate. Scope minimisation, data-retention controls, closure evidence.
• Sustain. Quarterly testing programme for release velocity.

Expected evidence

• Booking/payment scope diagram
• Passenger-data retention records
• VAPT reports with closure
• Availability/resilience review

Deliverables

• PCI DSS readiness
• DPDP passenger-data programme
• Recurring VAPT reports
• Resilience review