The Inspector General for TSA issued a report in May about general aviation security and assessed the threat, if any, that GA poses. You can find the report (PDF) here.
[T]his report addresses the current general aviation security requirements, the threat environment, and the steps the Transportation Security Administration has taken in the past 3 years to strengthen general aviation security. It is based on interviews with employees and officials of relevant agencies and institutions, direct observations, and a review of applicable documents.
…We determined that general aviation presents only limited and mostly hypothetical threats to security. We also determined that the steps general aviation airport owners and managers have taken to enhance security are positive and effective. Transportation Security Administration guidelines, communication forums, and alert mechanisms, coupled with voluntary measures taken by the owners and operators of aircraft and facilities, provide baseline security for aircraft based at general aviation sites.
Houston in the Media
Following an investigative report aired by a Houston television station concerning security at three local airfields, Chairwoman Sheila Jackson Lee requested that we review general aviation security at these airfields, and also at others in several other metropolitan areas. We performed announced visits to the airports, interviewed owners, employees and stakeholders, and toured the facilities. In the investigative report “Is Houston a Sitting Duck for Terrorism?” reporters visited three GA airports near Houston, Texas: David Wayne Hooks Airport in Spring, Texas; Sugar Land Regional Airport in Sugar Land, Texas; and Lone Star Executive Airport in Conroe, Texas. The television reporters identified what they described as “security breaches” at all three airports. Specifically, the reporters were able to approach an airfield or aircraft without identifying themselves. At one airfield, the reporter noted that a fence enclosed only part of the airfield…
This review was initiated in part because of the television station’s allegations. We reviewed the allegations and determined that they were not compelling…
In each instance, the allegation of weak security was based on reporters gaining access to airfields or aircraft. However, the reporters were unaware of some passive security and monitoring measures. For example, the airports had instituted security procedures, including 24-hour video surveillance, locking or disabling grounded planes, and controlling fuel access, which the television reporters did not test.
Combined, these airports service more than 440,000 aircraft takeoffs and landings per year, and each routinely operates 24 hours a day, 7 days a week. The volume of legitimate activity would appear to limit opportunities for unobserved loading or movement of aircraft. Moreover, the issues identified by the television reporters were not violations of GA guidelines or any federal aviation regulations.
The current status of GA operations does not present a serious homeland security vulnerability requiring TSA to increase regulatory oversight of the industry. According to OI, there is no specific, credible information of ongoing plots to use GA in an attack in the near future. Other government agencies, including GAO and the Congressional Research Service, have examined catastrophic scenarios and have concluded that the GA industry does not represent a serious vulnerability (see appendix D)…
Congressional Research Service
In its December 2005 report and most recently updated January 2008 report on Securing General Aviation, the Congressional Research Service stated that “the limited capabilities of the typical GA aircraft to carry conventional explosives, noting that even the 1,300-pound device involved in the February 1993 World Trade Center bombing would be beyond the carrying capability of a light GA aircraft. Thus, at least with regard to being used as a platform for conventional explosives, the threat posed by light GA aircraft is relatively small compared to trucks which have significantly larger payload capacities…. Executing an attack that involves loading a GA aircraft with a large quantity of explosives may be difficult without raising some suspicion at the airport, at least domestically where airport operators and pilots have been instructed to be vigilant for unusual activities.”