A system, method, and computer readable media for detecting and mitigating the effects of a cyber event on an aircraft's network including an air-based security module and a ground-based security module that monitor the aircraft's networks and detect cyber events. A collaboration module facilitates communications between the air-based security module and the ground-based security module, and also switches the communications between the modules to an alternate, secure channel when a cyber event is detected. A simulation module that is independent from, but functionally substantially equivalent to, the air-based security module simulates network events that are detected on board the aircraft while the aircraft is in flight. A cyber agent module mitigates the effect of a cyber event on the aircraft's network while the aircraft is in flight based on information from the simulation module that is communicated by the ground-based security module to the air-based security via the collaboration module.