Protecting the Future of Transit:
Why Cybersecurity matters
for fleet modernization
Damera Corporation is helping advance autonomous transit in North America through the Karsan eJEST, featured in Atlanta’s ATL Spoke pilot, as agencies explore new approaches to mobility and fleet modernization. Photo by Erin Sintos/Atlanta Beltline Inc
Transit agencies across the country are embracing new technologies to make public transportation more efficient and more responsive to the communities they serve. From connected vehicles and advanced fleet management systems to real-time bus tracking information and cloud-based operations platforms, technological innovation is improving how transit systems operate. And while these advancements present exciting opportunities for agencies looking to modernize their fleets and improve service, they also theoretically open the door to something scary: cybersecurity threats. As more vehicles, infrastructure, and operational systems become connected, digital security is becoming an increasingly important consideration.
We’re not just trying to frighten you because it’s seasonally appropriate; October also happens to be Cybersecurity Awareness Month, as good a time as any to recognize that connected transit systems require cybersecurity vigilance just like other connected networks. It’s about building the foundation for safe, reliable operations and ensuring agencies have the confidence and capabilities to embrace new technologies.
Why Cybersecurity Is Essential to Fleet Modernization
The systems supporting daily transit operations are becoming more interconnected. Modern transit vehicles can communicate with fleet management platforms, maintenance systems, charging infrastructure, and other digital tools that help agencies monitor performance and coordinate service. These capabilities offer major operational benefits, but they also introduce new safety and security considerations.
“As transit systems become more connected, agencies and industry partners are navigating a broader and more complex cybersecurity landscape,” said Emma Frantz, Lead Project Manager at Catalyst Mobility™. “The rapid adoption of software-defined and connected vehicles and infrastructure and cloud-dependent dispatch and operational tools creates more potential pathways that need to be secured and managed.”
Here are some of the challenges agencies face: ransomware attacks targeting administrative and operational networks, phishing attempts directed at employees, vulnerabilities associated with third-party vendors, and threats affecting onboard vehicle systems and other operational technologies.
Importantly, these risks are vehicle-agnostic and not limited to any one type or technology. They extend across the broader transportation ecosystem as connectivity becomes a more integral part of operations.
And the consequences can extend well beyond compromised data. Cybersecurity incidents have the potential to disrupt vehicle communications, charging and fueling infrastructure, computer-aided dispatch and automatic vehicle location systems, fare collection, and real-time passenger information. In some cases, disruptions could affect an agency’s ability to deliver reliable service to the communities that depend on it.
“Ultimately, cybersecurity is not just an IT issue,” Frantz said. “It is increasingly an important part of maintaining safe, reliable, and resilient operations.”
For transit agencies, this means cybersecurity should be considered alongside other operational priorities, from vehicle procurement and maintenance to infrastructure planning and workforce training. Right now, as transportation continues to modernize around the country, many agencies have an opportunity to integrate safeguards into their technology adoption strategies from the very beginning.
A Shared Challenge Calls for an Industry-Wide Approach
In terms of size, geography, fleet composition, and available resources, no two transit agencies are alike. But many currently face or will face similar cybersecurity challenges. A smaller agency introducing connected vehicles may encounter the same types of vulnerabilities as a larger transit system managing hundreds of buses. Vehicle manufacturers and technology providers must also account for cybersecurity across products and systems deployed in different operating environments.
When each organization tackles these challenges independently, the result can be duplicated efforts, inconsistent approaches, and unnecessary costs. An industry-wide approach offers a path forward. By sharing knowledge, identifying common vulnerabilities, and developing consistent testing methods and best practices, transit stakeholders can make cybersecurity protections more accessible and scalable. Collaboration also gives agencies a stronger voice in shaping the tools and resources being developed to meet their needs.
One example of this collaborative approach is the cybersecurity testing system being developed by the McCrary Institute in partnership with Catalyst Mobility. Demonstrated at APTAtech in August 2026, the system is purpose-built for connected vehicles and operational technology. Traditional IT cybersecurity testing approaches aren’t always appropriate for operational technology, particularly systems that support essential vehicle functions and day-to-day transit operations.
At APTAtech 2026, Catalyst Mobility partnered with Auburn University’s McCrary Institute for Cyber & Critical Infrastructure Security to demonstrate a cybersecurity testing system and advance industry dialogue on securing increasingly connected transit systems
“The McCrary Institute’s testing system is designed to address a challenge that is particularly important for transit: Operational technology environments cannot always be assessed in the same way as traditional IT systems,” Frantz explains.
To use this system, agencies aren’t required to transport vehicles or equipment to specialized testing facilities; instead, the field-deployable test kit is designed to bring cybersecurity assessment capabilities directly to transit maintenance yards and other operational settings. The system combines hardware interfaces, automated software tools, and standardized testing procedures to support repeatable evaluations of connected vehicles and operational systems.
Its capabilities include capturing and analyzing wireless signals, logging and decoding Controller Area Network bus communications, conducting replay testing, and performing automated wireless reconnaissance. These technical features can help agencies and qualified assessors better understand potential vulnerabilities and identify opportunities to strengthen security protections.
“The goal is to give agencies, technicians, and third-party assessors a practical way to better understand potential vulnerabilities within their operational environment and identify areas where cybersecurity protections can be strengthened,” Frantz said.
The truth is that many transit agencies lack the resources to develop robust in-house cybersecurity infrastructure, and that’s why tools designed with operational realities in mind could help make assessments more approachable and strengthen their ability to manage emerging risks.
Innovation Enhanced by Collaboration
The Transit Cybersecurity Working Group, an initiative led by Catalyst Mobility and Auburn University through the Federal Transit Administration’s Component Assessment Program, was formed to examine, stress-test, and improve the test kit. Bringing a variety of disparate stakeholders together for the first time, this group is helping to ensure that the test kit succeeds when applied in the real world.
Through the Working Group, the project team has connected with agencies interested in potentially demonstrating the test kit, creating opportunities to move beyond research and toward real-world application. The ultimate objective is to establish cybersecurity assessment methods that are consistent, repeatable, and adaptable to different transit operating environments.
“The Transit Cybersecurity Working Group has demonstrated the value of bringing transit agencies, researchers, and industry together early in the development process,” Frantz said.
Working Group participants have raised questions about user training, the possibility of certification for personnel operating the testing equipment, practical considerations surrounding deployment, and more. Feedback from industry partners is also helping Auburn’s McCrary Institute refine testing requirements and identify relevant threats and capabilities.
These exchanges are proof of the benefits collaboration brings. Researchers and technology developers bring technical expertise, while transit agencies contribute firsthand knowledge of operational demands, resource constraints, and implementation challenges. Together, they can help ensure that new solutions are both technically effective and practical to deploy.
Building Cybersecurity into the Future of Transit
While technologies like the McCrary Institute’s testing system offer promising ways to identify vulnerabilities, effective cybersecurity requires a broad approach. No single organization will come up with a magic bullet. Transit agencies must consider how cybersecurity is integrated throughout their unique organizations, from the systems they purchase to the processes they follow and the people responsible for operating and maintaining them. That includes conducting organizational cybersecurity assessments, evaluating supply-chain risks, establishing appropriate separation between onboard systems, and securing communications between vehicles and cloud-based platforms.
It also means recognizing that cybersecurity isn’t a one-time activity. As connected transportation technologies evolve, agencies will need to continually assess risks, update practices, and adapt to emerging threats.
Is Cybersecurity Awareness Month concurrent with spooky season? Maybe, but when it comes to clean transit, there’s nothing to be afraid of — especially if we continue working together, sharing knowledge, testing approaches, and laying the groundwork for a more resilient transportation future.
Interested in learning more about the Transit Cybersecurity Working Group? Contact Emma Frantz at efrantz@catalystmobility.org.