Threat‐Responsive Prioritization of Cybersecurity in Aviation: A Fuzzy Decision Framework Integrating AHP , CFA , and K‐Means Clustering

Abstract

This study proposes a Threat‐Responsive Cybersecurity Prioritization Framework tailored for the aviation sector and applies it to Istanbul Airport, one of the busiest and most technologically advanced airports in the world. Recognizing the limitations of static cybersecurity models in rapidly evolving threat environments, the framework integrates Fuzzy Analytic Hierarchy Process (AHP), Criterion Factor Analysis (CFA), and K‐Means Clustering to enable adaptive, data‐informed prioritization of cyber risks. Expert input is combined with external regulatory and technological factors to assess and weight cybersecurity criteria, while clustering techniques are used to dynamically classify threat priorities. The findings identify Supply Chain Security and Data Privacy as top‐priority areas, reflecting the critical impact of third‐party vulnerabilities and regulatory compliance challenges, especially under GDPR. Network Security and Air Traffic Control (ATC) Resilience are ranked as medium priorities, requiring continuous system monitoring and mitigation of interconnected vulnerabilities. The framework was validated using scenario simulations, including ransomware and regulatory escalation, to demonstrate its real‐time adaptability. The study also discusses practical implementation challenges such as expert subjectivity, data access limitations, and resistance to change, while proposing strategies like phased deployment, integration with existing monitoring systems, and expert consensus methods to enhance usability. By addressing both strategic and operational cybersecurity needs, the model contributes a scalable, empirically grounded decision‐support tool for enhancing resilience in airport cybersecurity systems and offers a replicable methodology for application across diverse aviation contexts globally.