A cyber security system having a layered goal-oriented architecture for dealing with cyber attacks comprising: a reactive layer that monitors and tracks cybersecurity data for forensic analysis and that is configured to allow loss of data during a cyber attack, the reactive layer comprising company's ground infrastructure, service logs, and detected cyber event in internet and aviation including viruses, malware, DNS, DOS attacks, IP addresses and domains the reactive layer being configured to perform correlation analysis of interconnected modules, including correlation of cyber events within the company, ecosystem cyber events, and global news, the reactive layer being further configured to perform machine learning using Principal Component Analysis for identifying the most significant combinations of aviation ecosystem features; an anticipatory layer that monitors, tracks, and measures cybersecurity data across a plurality of cyber environments and that is configured to anticipate and prepare for the cyber attack, the anticipatory layer comprising events and news about aviation related companies, capabilities and relations, the anticipatory layer being configured to perform contextual analytics of the commercial aviation supply chain in the cyber event space; a resilient layer that is configured to resist the cyber attack, the resilient layer comprising events and news about global goals, motivators behaviors, and political and structural macro trends, the resilient layer being configured to perform agent based modeling algorithms for Complex Adaptive Systems, to identify the most probable developing threat regions based on recent histories of different ecosystem partners in the aviation ecosystem; a CAS algorithm that is configured to model, measure and predict probability of actions within the system and that is further configured to intervene if the probability of an action is outside a predetermined threshold; wherein the reactive layer, the anticipatory layer and the resilient layer exchange cybersecurity data via a bi-directional connection module and the exchanged cybersecurity data is correlated. a reactive layer that monitors and tracks cybersecurity data for forensic analysis and that is configured to allow loss of data during a cyber attack, the reactive layer comprising company's ground infrastructure, service logs, and detected cyber event in internet and aviation including viruses, malware, DNS, DOS attacks, IP addresses and domains the reactive layer being configured to perform correlation analysis of interconnected modules, including correlation of cyber events within the company, ecosystem cyber events, and global news, the reactive layer being further configured to perform machine learning using Principal Component Analysis for identifying the most significant combinations of aviation ecosystem features; an anticipatory layer that monitors, tracks, and measures cybersecurity data across a plurality of cyber environments and that is configured to anticipate and prepare for the cyber attack, the anticipatory layer comprising events and news about aviation related companies, capabilities and relations, the anticipatory layer being configured to perform contextual analytics of the commercial aviation supply chain in the cyber event space; a resilient layer that is configured to resist the cyber attack, the resilient layer comprising events and news about global goals, motivators behaviors, and political and structural macro trends, the resilient layer being configured to perform agent based modeling algorithms for Complex Adaptive Systems, to identify the most probable developing threat regions based on recent histories of different ecosystem partners in the aviation ecosystem; a CAS algorithm that is configured to model, measure and predict probability of actions within the system and that is further configured to intervene if the probability of an action is outside a predetermined threshold; wherein the reactive layer, the anticipatory layer and the resilient layer exchange cybersecurity data via a bi-directional connection module and the exchanged cybersecurity data is correlated.