Mandatory two-factor authentication, dedicated customer databases and updated authorisation protocols are among the security measures highlighted by Leon Software as October’s Cybersecurity Awareness Month draws to a close.

“Cybersecurity cannot be a once-a-year conversation. It has to be built into the way software is designed, developed and used every day,” says Paweł Kruk, CEO of Leon Software. “That’s why we make it a point to continuously strengthen the security in Leon Software: we’re not simply responding to new threats, but anticipating them.”

This year, the aviation software company has begun requiring two-factor authentication (2FA) for all users, adding a second layer of verification beyond a password and reducing the risk associated with compromised credentials.

It is also developing passkeys as an additional authentication measure. Users will be able to log in using a passkey as the second authenticating factor, designed to provide strong, phishing-resistant authentication while simplifying access.

“The strongest security measures are the ones that become part of the normal user experience, rather than an obstacle to it,” adds Kruk. “Mandatory 2FA are examples of how we can raise the security standard while keeping access to Leon Software convenient.”

Leon has implemented dedicated databases for each customer. The architecture provides greater separation and isolation of operators’ data within the platform, as well as strengthening its isolation, adding another layer of protection.

While integrations with third-party software providers have long relied on both API keys and OAuth, the company has begun transferring integrations to OAuth. Leon says this gives operators better visibility into connected entities and the permissions granted to external systems, alongside auditable authorisation and re-authorisation.

The company has also completed an annual certification review for ISO 27001 and ISO 27018. Annual reviews help ensure that security practices remain aligned with the organisation’s evolving technology, processes and risk environment.

Leon Software is also developed with the requirements of the EU Cyber Resilience Act (CRA) in mind. The regulation establishes cybersecurity requirements for products with digital elements, covering secure development and vulnerability handling throughout a product’s lifecycle. While the regulation’s main provisions will apply from December 2027, some requirements, including reporting obligations, are already coming into effect.

“Regulations are an important baseline, but our ambition is not simply to meet the minimum required by law,” says Kruk. “We want security to be a competitive advantage for our customers and a defining characteristic of Leon Software. That means continuously improving our systems and the way we think about risk.”

Cybersecurity Awareness Month, coordinated at EU level by ENISA and supported by the European Commission and EU member states, serves as an annual reminder that cybersecurity requires incessant attention, from organisations and individuals alike.

“October is a good moment to talk about cybersecurity, but for us, security doesn't have a season. It is an ongoing commitment,” concludes Kruk.