Aena S.M.E., S.A.

Spain · owned by Spanish Government (majority shareholder) (Spain) · aena.es · 35 vendors

Aena is Spain's main airport operator and one of the world's largest airport management companies. The company manages 46 airports and 2 heliports in Spain, as well as operating airports internationally in countries including the United Kingdom, Brazil, Colombia, and Mexico.

Resilience scores

Technology vendors

Insights

Last updated 2026-01-21 · revision 50

35 direct vendors, 274 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 2/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Migration readiness is low due to the specialized, safety-critical nature of the technology stack and strict regulatory hurdles. The key technologies identified (Air Traffic Management, Baggage Handling, SCADA, Security Screening) are deeply integrated with physical infrastructure and require low-latency, high-availability on-premise execution, making them poor candidates for standard cloud migration. Regulatory compliance (NIS2, GDPR, EASA) imposes rigid data residency and sovereignty requirements, severely limiting public cloud adoption options for core operational data. While the vendor landscape spans 11 countries, the specialized nature of aviation systems typically involves high vendor lock-in with proprietary hardware/software combinations. The complexity of migrating 221 distinct services while maintaining continuous airport operations presents a massive technical and operational challenge.

Compliance

7 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

Aena falls under NIS2 as an Essential Entity in the air transport infrastructure sector, operating critical infrastructure and exceeding size thresholds.

Aena clearly falls under NIS2 as an Essential Entity in the transport sector (air transport infrastructure). As a large enterprise operating critical transport infrastructure, NIS2 compliance is mandatory. Non-compliance risks include fines up to €10 million or 2% of annual turnover, operational restrictions, and potential service disruptions. The critical nature of airport infrastructure for national security and economic stability makes this a high-risk regulatory requirement with strict enforcement expected.

EU Airport Charges Directive — Assessment Required

The EU Airport Charges Directive applies to Aena's major airports (e.g., Madrid, Barcelona) due to their annual passenger movements exceeding 5 million.

EU Directive 2009/12/EC on airport charges applies to airports with more than 5 million passenger movements annually, which includes Aena's major airports. Non-compliance could result in regulatory action, disputes with airlines, and potential operational restrictions. Risk level is medium because while regulatory penalties exist, the primary impact is on commercial relationships and pricing structures rather than operational shutdowns.

SOC 2 (source) — Assessment Required

SOC2 is not mandatory but may be relevant if Aena provides digital or cloud-based services to airlines, passengers, or business partners, as it demonstrates security controls for service organizations.

While not mandatory, SOC2 may be relevant for Aena's digital services and technology operations, particularly if providing cloud-based services to airlines, passengers, or business partners. The risk level is medium because SOC2 is voluntary but increasingly expected by business partners for service providers handling sensitive data. Non-compliance could impact business relationships and competitive positioning rather than result in regulatory penalties.

Financials

Three-year financials

Financial Resilience Score: 8.5/10

Aena's financial resilience is strong, underpinned by its critical infrastructure role, dominant market position, and robust cash flow generation. Aena operates 46 airports in Spain, handling over 99% of the country's air traffic. This creates a significant barrier to entry and provides highly predictable, long-term revenue streams tied to economic and travel trends. The post-pandemic recovery has restored Aena's ability to generate substantial operating cash flow. In FY 2023, cash flow from operating activities was exceptionally strong, allowing the company to fund investments, pay dividends, and manage debt. While net financial debt increased during the pandemic to ensure liquidity (peaking over €7 billion), it is being effectively managed. As of year-end 2023, Net Financial Debt stood at approximately €6.24 billion. The Net Debt to EBITDA ratio has improved significantly, falling to 2.2x in 2023 from much higher levels during the crisis, which is a very healthy level for an infrastructure asset. The Spanish state, through ENAIRE, is the majority shareholder (51%). This provides an implicit level of stability and support, reducing counterparty risk and ensuring access to capital markets. A significant portion of Aena's revenue (aeronautical) is regulated through five-year plans (DORA in Spain). While this can cap upside potential, it also provides a floor and a high degree of revenue visibility and stability.

Key strengths: Market Leadership & Quasi-Monopoly, Strong Cash Flow Generation, Manageable Debt Profile, Government Backing, Regulated Revenue Base

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report