TSA Has More Than 1,300 Aviation Inspectors. Its Cybersecurity Role Map Is Outdated.

More than 1,300 Transportation Security Administration inspectors are responsible for checking aviation-security compliance across a system that includes more than 440 airports. Their work has long covered airports, airlines, cargo operations and the security programs those regulated entities must follow.

Now that compliance mission has a cyber layer.

TSA required certain airport and aircraft operators to add cybersecurity measures to their security programs in March 2023. The requirements were designed to help critical systems continue operating through a cyber disruption. They arrived as the line between conventional security oversight and digital-system oversight was still being worked out across TSA, the Federal Aviation Administration and the aviation industry.

A July 2026 Government Accountability Office review found evidence of strong interagency cooperation. FAA and TSA fully met all eight of GAO's leading collaboration practices through the Aviation Cybersecurity Initiative. But GAO also found that TSA's 2018 Cybersecurity Roadmap was outdated, no longer aligned with the current Department of Homeland Security strategy and did not clearly identify the agency offices responsible for aviation cybersecurity. DHS agreed with GAO's recommendation to update the roadmap and communicate those roles.

FederalHiringData found a second reason to ask about capacity. The broad OPM occupation series that contains Transportation Security Inspector and related TSA compliance work fell from 7,519 employees in January 2025 to 6,735 in June 2026. That is a loss of 784, or 10.4%. The under-five-years cohort in the series fell from 829 to 415.

Those figures are not an aviation-inspector count. Series 1801 includes inspectors, specialists and other general inspection, investigation, enforcement and compliance work. It can show pressure in an adjacent workforce pool, but it cannot reveal how many aviation inspectors are trained for cyber oversight.

That distinction leads to the central finding. Public evidence shows that TSA has added cyber requirements, maintains cyber-designated inspector hiring authority and collaborates closely with FAA. It does not show how many aviation inspectors are cyber-qualified, whether their technical training matches the covered-operator workload or where remaining competency gaps sit. The inspector corps may be carrying the added mission successfully. The available public measures are not sufficient to prove it.

Inspectors are not checkpoint screeners

The familiar TSA workforce at airport checkpoints consists primarily of Transportation Security Officers, or TSOs, who screen passengers and baggage. Aviation Transportation Security Inspectors perform a different function. They assess whether regulated airports and aircraft operators comply with security regulations, approved security programs and other applicable requirements.

That work can include inspections, investigations, tests, incident response and outreach. It may involve airport access controls, aircraft-operator procedures, air cargo and other security-program elements. Inspectors document deficiencies and can support enforcement when an entity does not meet an applicable requirement.

GAO reported that TSA employed more than 1,300 aviation inspectors in 2026. In fiscal 2024, those inspectors found 91.8% of airlines operating from domestic airports compliant with required security standards. The percentage is a compliance result, not an inspector productivity score. It does not show how many checks occurred, how complex they were or how inspector time was divided among conventional and cyber requirements.

The organizational split matters, too. TSA oversees security programs for airports and aircraft operators. FAA is responsible for aviation safety, the National Airspace System, avionics certification and FAA-operated ground systems. The FAA Reauthorization Act of 2024 made FAA the exclusive federal authority for civil-aircraft cybersecurity. GAO said FAA and TSA agreed that TSA does not have a role in avionics or FAA-operated ground systems.

In practical terms, TSA's cyber oversight concerns systems within the security programs of covered airport and aircraft operators, while FAA handles aircraft airworthiness and its own operational systems. That boundary is more useful than calling both agencies aviation cyber regulators without qualification.

TSA has carried an inspector staffing question before

The capacity question predates cybersecurity. In 2009, GAO reviewed the Transportation Security Inspector workforce after TSA had spent several years building aviation and cargo inspection programs.

Onboard aviation inspectors increased from 601 in fiscal 2005 to 697 in fiscal 2008. Cargo inspectors increased from 160 to 475. The combined onboard total therefore rose from 761 to 1,172. Authorized positions rose from 1,082 to 1,313 over the same period.

Onboard staffing remained below authorized levels in every year GAO examined. At the two airports GAO visited, officials described difficulty meeting inspection goals because responsibilities had increased and inspector numbers were low. Airports sometimes shifted cargo inspectors to aviation work, used overtime or requested help from nearby locations.

The historical chart should not be connected directly to the current figure as though it were one continuous series. TSA's structure, terminology, reporting and responsibilities changed. The 2008 total includes separate aviation and cargo categories; GAO's 2026 statement refers to more than 1,300 aviation transportation security inspectors. The comparison establishes a long-running workforce-planning issue, not a precise 18-year growth rate.

GAO's 2009 conclusion was pointed: TSA did not have a reasonable basis for determining the inspector workforce needed to achieve inspection goals. The agency planned a staffing study that would examine workforce size, management, classification and placement. That finding is historical. It does not establish that TSA still lacks an inspector staffing model in 2026.

It does establish the relevant test for the cyber era. An agency can count inspectors and inspections without showing whether it has the right mix of specialized skills, in the right places, for a new layer of work.

The 2023 requirements changed the oversight surface

TSA's March 2023 emergency amendment required certain regulated airport and aircraft operators to maintain an approved plan describing cybersecurity measures. At a high level, the measures address network segmentation, access controls, monitoring and detection, and risk-based patching for covered critical systems.

This article does not reproduce sensitive implementation details, identify a covered operator's systems or describe vulnerabilities. The workforce issue is visible without doing so: inspectors and program offices must understand what the approved requirements cover, assess documentation and implementation, and distinguish TSA-regulated security systems from systems under FAA authority.

GAO found that FAA and TSA collaborated well through a formal interagency initiative. The agencies shared information, defined common outcomes, established compatible policies and used mechanisms to monitor progress. That is significant counterevidence to a narrative of institutional confusion everywhere.

The weakness was inside TSA's public role map. The 2018 roadmap did not identify which offices held aviation-cyber responsibilities. It also preceded the March 2023 amendment and no longer aligned with the current DHS cybersecurity strategy. GAO reported that three of 11 selected stakeholders said TSA's role was unclear. Three other selected stakeholders said the March 2023 amendment created confusion. Those interviews are illustrative and nongeneralizable; they should not be presented as an industrywide survey.

TSA issued a February 2024 clarification stating that systems internal or external to an aircraft that contribute to airworthiness were excluded from the amendment's scope. That clarification sharpened the TSA-FAA boundary. GAO still concluded in 2026 that TSA needed to update and communicate its aviation-cyber roles.

An outdated roadmap is not proof that field inspectors are untrained. It is evidence that regulated entities and the public cannot use the roadmap to see who owns which part of the mission, how specialized capacity is organized or how the agency evaluates whether that capacity is sufficient.

The whole TSA workforce fell below 60,000

OPM data provide context, not a direct answer. Covered TSA headcount was 60,194 in September 2003, two years after the agency was created. It fell to 55,992 in September 2006, rose above 65,000 in 2011 and reached 65,657 in September 2025. By June 2026, it was 59,977.

The June count was 4,456 below September 2024, a decline of 6.9%. It includes checkpoint officers, federal air marshals, human resources, information technology, intelligence, inspectors and other mission-support employees. A TSA-wide decline cannot be assigned to aviation compliance, but it shows that the cyber requirement did not arrive during an agencywide staffing expansion.

Series 1801 is a useful proxy with a hard limit

Transportation Security Inspector positions are classified in OPM occupational series 1801, General Inspection, Investigation, Enforcement and Compliance. TSA also uses that series for Transportation Security Specialists and other work. The series is therefore much broader than the more-than-1,300 aviation-inspector figure.

Series 1801 headcount at TSA was 8,085 in September 2015. It declined through 2021, recovered to 7,748 in September 2024 and then fell to 7,322 in September 2025 and 6,735 in June 2026.

The sharper comparison starts in January 2025, before the largest recorded 2025 outflow. From 7,519 employees, the series lost 784 through June 2026.

It would be incorrect to conclude that TSA lost 784 aviation inspectors. The public occupation code cannot distinguish an aviation inspector from a surface inspector, a cyber-policy specialist or another employee whose job fits the general series. It also cannot show whether an employee held cyber certifications or worked with a covered airport.

The proxy is still relevant because TSA's own career and direct-hire materials place inspector and cyber-inspector roles in series 1801. A contraction across the broad pool narrows one of the personnel reservoirs from which TSA can staff and support compliance work, even if the exact effect on aviation cannot be isolated.

The entry cohort thinned while the senior cohort persisted

The series 1801 age profile declined in every broad group from January 2025 to June 2026. Employees under 45 fell from 3,226 to 2,755. The 45-to-54 group fell from 2,515 to 2,350, and the 55-or-older group fell from 1,778 to 1,630.

Length of service moved differently. Employees with less than five years of federal service fell by 414, from 829 to 415, a reduction of 49.9%. The five-to-nine-year group fell from 960 to 725, and the 10-to-19-year group from 2,690 to 2,482. Employees with at least 20 years of service increased from 3,040 to 3,113.

The data do not identify a succession failure. An experienced employee can be exactly what a complex compliance program needs, and years of federal service do not equal technical skill. A new hire can arrive with extensive private-sector cyber or aviation experience.

The distribution does raise a planning question. An organization building a durable specialty usually needs both experienced leaders and a pipeline of newer employees who can acquire mode-specific knowledge. Public data show the experienced end remaining large while the under-five-years cohort contracted sharply.

OPM personnel-action records reinforce that signal. Series 1801 recorded 81 accession actions in calendar 2025, compared with 656 separation actions and 501 retirement actions. Through June 2026, it recorded two accessions, 185 separations and 146 retirements.

Personnel actions are not necessarily unique people, and 2026 is a partial year. The figures also cover the entire series, not aviation inspectors. They show why a current, mode-specific capacity measure would be more informative than assuming a broad occupation can absorb added work indefinitely.

Public hiring shows a cyber-inspector track, not its size

FederalHiringData's historical USAJOBS archive contains 1,096 TSA announcements opened from December 2017 through March 2025 with "Transportation Security Inspector" in the title. Annual counts reached 191 in 2023 and 158 in 2024 before falling to 36 in the 2025 archive cohort.

Nine of the 1,096 announcements explicitly included "cyber" in the inspector title: two in 2022, four in 2023 and three in 2024.

Announcements are not hires, vacancies or onboard staff. A single notice can support multiple selections or remain open for future needs. Internal movement and other hiring authorities do not appear as ordinary public announcements. Title matching also misses cyber work hidden behind a general title.

The nine notices nevertheless show that cyber was formalized as an inspector specialty. TSA's current direct-hire directive goes further. It lists Transportation Security Inspector (Cyber), series 1801, at SV G through J, and Supervisory Transportation Security Inspector (Cyber) at SV J through K. The authority is TSA-wide and indefinite.

A live August 2026 Transportation Security Inspector (Cyber) announcement provides a concrete example. It requires basic inspector and mode-specific training plus required cyber and pipeline training. The job is assigned to Surface Operations, not aviation. It proves a current cyber-inspector pathway and demonstrates that TSA can specify training conditions. It does not establish aviation-cyber staffing.

Historical inspector announcements were concentrated in several pay bands. The table reports the median advertised annual minimum and maximum for single-band notices. These are announcement ranges, not actual salaries or average employee pay.

Related research

Put this finding in context

All articles

Data investigations/August 23, 2026

FAA's Aviation-Weather Network Was Designed for 90 Meteorologists. Staffing Fell to 69.

The last verified federal count found 69 meteorologists in a 90-position aviation-weather design. Public records show recruiting in 2026, but not a verified recovery.

Data investigations/August 19, 2026

Social Security Has 85% More Beneficiaries per Worker Than in 2000

Social Security added 25 million beneficiaries while losing 9,600 full-time permanent workers. Recent service gains show what technology changed—and what a thinner workforce still risks.

Location data show the national reach. California appeared in 142 title-matched announcements, Texas in 78, Virginia in 73, New York in 72 and Florida in 71. The archive covered 49 states or territories with a usable code. Multi-location announcements can count in more than one state, so the state counts should not be added to produce a national total.

What the public evidence cannot answer

The strongest answer to the central question is also the narrowest: the available public data do not establish whether aviation-inspector staffing and technical training have kept pace with the cyber mission.

GAO's current count gives the size of the aviation inspector corps, but not a cyber-qualified subset. OPM gives occupation and workforce characteristics, but not assignments or competencies. USAJOBS shows recruiting language, not selections, completed training or workload. TSA's public roadmap is too old to map current aviation-cyber roles.

A useful public capacity assessment would connect at least four measures: the number of covered airport and aircraft-operator programs; the inspection and follow-up workload created by cyber requirements; the number and distribution of inspectors qualified for that work; and the training, experience and supervisory support needed to maintain proficiency. None needs to expose a vulnerability or identify a regulated operator's systems.

The public record also contains positive evidence. FAA and TSA collaborate through a mature interagency mechanism. TSA clarified that aircraft airworthiness systems fall outside its amendment. It has cyber-designated inspector positions and direct-hire authority. It can state mode-specific training requirements in job announcements. GAO did not report that aviation cyber requirements were going unenforced because of inspector shortages.

Those facts argue against declaring the system broken. The outdated roadmap and missing capacity measures argue against declaring the workforce demonstrably sufficient.

The management test for TSA

TSA's challenge is not simply to add more employees to series 1801. The agency needs to know which expertise belongs in aviation field offices, which can be centralized, which work can be shared with cyber specialists and how inspectors coordinate with FAA without crossing the statutory boundary around aircraft cybersecurity.

Training should also be measured as a capability, not only a completion event. A course roster can show attendance. It does not show whether inspectors can consistently interpret an approved program, assess implementation, recognize when an issue belongs with FAA or communicate findings across airport and aircraft-operator environments.

GAO's roadmap recommendation is a sensible first step because role clarity determines workforce design. Once TSA defines the offices and responsibilities, it can map competencies, staffing and workload to that structure. Without the map, a total headcount says little about whether the right people are available for the right assignments.

The broad indicators make that work more urgent. TSA's total covered workforce fell below 60,000. Series 1801 contracted by 10.4% from January 2025 through June 2026. Its newest service cohort was cut nearly in half. Cyber appeared in inspector hiring, but only a small subset of archived titles advertised the specialty explicitly.

None of those findings proves a shortfall in aviation cyber enforcement. Together, they establish why a transparent, current capacity assessment would be more credible than relying on the overall inspector count.

Methodology and limitations

FederalHiringData reviewed GAO-26-107693, released July 16, 2026, for current aviation-inspector staffing, airport scope, fiscal 2024 airline compliance, agency roles, collaboration findings, selected stakeholder comments and recommendation status. The analysis treats comments from GAO's selected stakeholders as nongeneralizable.

GAO-09-123R supplied authorized and onboard aviation and cargo inspector figures for fiscal years 2005 through 2008 and the historical workforce-planning findings. Those categories are not treated as directly comparable with GAO's 2026 aviation-inspector count.

The cyber-requirement review used TSA's March 7, 2023 public announcement and GAO's description of the amendment and February 2024 clarification. It stays at the program level and excludes operator-specific systems, vulnerabilities, inspection techniques and sensitive implementation details.

The workforce history combines OPM legacy FedScope September agency data for 2003 through 2014 with OPM Federal Workforce Data for September 2015 through 2025 and June 2026, using TSA subelement HSBC. Headcounts cover federal employees represented in the source, not full-time equivalents, contractors or available inspection hours.

Series 1801 is a broad occupational proxy. It includes inspector, specialist and other general inspection, investigation, enforcement and compliance work. It cannot identify aviation assignments or cyber proficiency. Age and length-of-service comparisons use January 2025 and June 2026 public OPM files. Accessions, separations and retirements are personnel actions, not necessarily unique people; 2026 covers January through June.

The USAJOBS analysis counts distinct TSA announcement control numbers with "Transportation Security Inspector" in the title. The cohort opened from December 2017 through March 2025. It is not a complete measure of hiring, selections, vacancies or employees. Pay figures are medians of advertised single-band annual ranges. Geography counts distinct announcements by location code, and one announcement can appear in multiple states.

The current cyber-inspector example was checked Aug. 24, 2026. It is a surface-operations job and is used only to document a current cyber-inspector track and explicit training conditions. It is not evidence about aviation staffing.

The hero is a still from official public-domain TSA b-roll recorded at Denver International Airport on June 5, 2025 by Austin Deryck-Linstruth and distributed through DVIDS. It depicts TSA inspectors performing aviation inspection duties.

Readers can browse current TSA openings, explore federal workforce statistics, compare agency profiles and read more FederalHiringData investigations.