How AI is Reshaping Travel Tech Security

My career path has taken me from securing Air Force networks to safeguarding some of the world’s largest travel platforms. Devon Bryan, SVP and Global CSO at Booking Holdings, explains how that journey shaped his understanding of a unique security challenge. The travel industry, he notes, operates on a fundamentally different model than finance or hospitality, which directly influences its security posture.

The core difference lies in data velocity and transaction complexity. In financial services, a single transaction involves a few, well-known parties. Travel, by contrast, can chain together dozens of vendors, airlines, hotels, and payment gateways across multiple jurisdictions. This creates an exceptionally broad attack surface. Bryan emphasizes that securing this ecosystem requires a shift from perimeter-based defenses to identity-centric and data-centric models. The real vulnerability isn’t a single system, but the trust relationships between them.

To manage this, Booking Holdings prioritizes a zero-trust architecture and continuous authentication. Unlike a simple login, a user’s session might need to be re-verified as they move from searching for a flight to booking a car rental. This dynamic trust model relies on behavioral analytics and device fingerprinting to detect anomalies in real-time, not just at the gate. The goal is to make security invisible to the legitimate user while making it incredibly difficult for an attacker to pivot across services.

Another critical area is supply chain security. With thousands of third-party integrations, a vulnerability in a small hotel booking widget can cascade into a major breach. Bryan’s team implements rigorous vendor assessments and code scanning, but the real innovation is in shared responsibility models. They work with partners to define clear security boundaries and incident response protocols, ensuring that a compromise in one area doesn’t become a free pass to the entire platform.

Looking ahead, AI is both the biggest threat and the most powerful defense. Attackers use AI to generate hyper-personalized phishing emails or automate credential-stuffing attacks at scale. In response, Booking Holdings deploys machine learning models to analyze traffic patterns and detect subtle, coordinated attacks that would overwhelm human analysts. Bryan stresses that the future of travel security lies in adversarial AI , using one AI to simulate attacks and another to defend against them, creating a constant, automated sparring match that hardens the system over time.

Ultimately, the travel tech industry’s security challenge is one of scale, speed, and trust. As Bryan puts it, the goal isn’t to build an impenetrable fortress, but a resilient, adaptive system that can serve millions of travelers without compromising their data. The path forward, he believes, is a relentless focus on identity, data governance, and the intelligent use of AI to stay ahead of a constantly evolving threat landscape.