Transportation
Aircraft, ships and trains are networked, long-lived and safety-critical — and the airports, ports and control centres behind them cannot stop. We test the equipment, the onboard systems and the operations, without ever touching a vehicle in service.
Book a ConsultationAviation, maritime and rail: three modes, one problem
Modern aircraft, vessels and rolling stock carry onboard networks that link control, maintenance, crew and passenger systems, and equipment makers and operators connect to them remotely for support. Airports, ports and rail control centres run on operational technology that has to keep moving — so an outage is a safety and service problem, not just an IT one.
All three modes now have specific rules. In aviation, EASA’s Part-IS has applied to most regulated organisations since February 2026, with certain ground handling organisations to follow from March 2031, and the FAA has proposed cybersecurity requirements for new aircraft designs. In maritime, IACS rules require cyber resilience for ships and onboard equipment contracted since July 2024, and US Coast Guard cybersecurity plans are due by July 2027. In rail, TSA directives in the US and new EU telematics rules set requirements, and a dedicated international rail cybersecurity standard is in development.
Fleets stay in service for decades, so the keys that sign software loads, chart updates and train-control messages have to outlast today’s public-key algorithms. And AI is arriving in maintenance, traffic management and passenger services, with access to operational decisions.
Three services, tuned to each mode
Artificial Intelligence Security (AI-BOM)
AI in predictive maintenance, traffic and route optimisation, airport, port and station operations, and passenger services — and agents with a path to operational decisions. We test what the AI can change and who can steer it, not just what it says.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across software-load signing, onboard and shore PKI, remote-access VPNs, satellite and datalink connections, and train-control key management. The roadmap follows your fleet, dry-dock and renewal cycles, because that is when cryptography can actually change.
Learn more →Product Penetration Testing
Aviation: airline, airport and maintenance systems, software-load paths, and avionics and connectivity equipment on the bench. Maritime: bridge, machinery and connectivity systems, OEM remote access, and port and terminal OT. Rail: onboard train systems, signalling and control on test benches, and stations, ticketing and depots.
Learn more →Built for safety-critical fleets, not adapted from IT
Bench and yard first
Documentation, labs, simulators and test benches find most issues at the least risk. Work on a real aircraft, vessel or train happens only when it is grounded, alongside or under possession — and most engagements never need it.
Protocols are not findings
Many transport protocols are unauthenticated by design. That is a fact to design around, not a vulnerability to report — the finding is where an attacker can reach them from, and what depends on them.
Radio within the law
Transmitting on aeronautical, maritime or railway frequencies can endanger people and is tightly regulated. We assess radio by design review and receive-only observation, and transmit only in a licensed, shielded facility.
Fixes by delivery route
Remediation is sorted by how it ships — ground or shore configuration, software update, service bulletin, next port call or possession, dry dock or fleet overhaul — so you can plan it against your maintenance calendar.
Where the rules stand, mode by mode
All three modes now have specific cybersecurity requirements — some for operators, some for equipment makers. Current as of October 2026.
| Mode | Instrument | What it means for you |
|---|---|---|
| Aviation — EU | EASA Part-IS — Reg (EU) 2022/1645 and 2023/203 | Information security management for aviation organisations: production and design organisations and aerodromes since 16 October 2025; air operators, maintenance and airworthiness organisations, air navigation service providers and others since 22 February 2026. Certain ground handling organisations are added from 27 March 2031 (Delegated Reg (EU) 2025/22). |
| Aviation — US | FAA proposed rule (August 2024) AC 119-1A (2023) | Would add cybersecurity requirements to the design of transport-category aircraft, engines and propellers; still not final. Advisory Circular 119-1A (non-mandatory guidance) describes one acceptable way for operators of aircraft certified under network-security special conditions to obtain authorisation for an aircraft network security programme. |
| Aviation — US | TSA security programme amendments (March 2023) | Require certain TSA-regulated airports and airlines to implement cybersecurity measures and assess their effectiveness; upheld by the D.C. Circuit on 20 January 2026. |
| Aviation — standards | DO-326B / ED-202B AMC 20-42 | The industry’s airworthiness security process standard (voluntary; revised in 2024), and EASA’s non-mandatory acceptable means of compliance for airworthiness security, which still cites the earlier ED-202A/DO-326A edition. |
| Maritime | IACS UR E26 and UR E27 | Cyber resilience requirements for ships, and for onboard systems and equipment, contracted for construction from 1 July 2024 — so equipment makers need security evidence for class approval. |
| Maritime | IMO MSC.428(98) MSC-FAL.1/Circ.3/Rev.4 (May 2026) | IMO encourages flag administrations to ensure cyber risk is addressed in ships’ safety management systems, from 2021. Its guidelines were revised in May 2026, and a non-mandatory Maritime Cyber Code is being developed. |
| Maritime — US | US Coast Guard — 33 CFR Part 101, subpart F | In force since 16 July 2025 for US-flagged vessels and US port and offshore facilities (foreign-flagged vessels are excluded): cyber incident reporting, annual training since 12 January 2026, and a cybersecurity assessment and plan due by 16 July 2027, with penetration testing when the plan is renewed. |
| Rail — US | TSA SD 1580-21-01E, SD 1582-21-01E, SD 1580/82-2022-01E | Binding directives for freight rail, passenger rail and transit, reissued in 2026 — including cybersecurity mitigation actions and testing. A permanent rule proposed in November 2024 is not yet final. |
| Rail — EU | Telematics TSI — Implementing Reg (EU) 2026/253 CCS TSI — Implementing Reg (EU) 2023/1695 | Binding telematics rules with explicit cybersecurity requirements, in force since 2 March 2026: new telematics applications comply from the start, while existing ones follow milestones running mainly to December 2029, with security elements for ticket distribution due by 13 December 2026. For ETCS, the signalling TSI specifies off-line and on-line key management (SUBSET-038, SUBSET-114, SUBSET-137) and an end-to-end security layer (SUBSET-146). |
| Rail — standards | CLC/TS 50701 (2023) IEC 63452 | The European rail cybersecurity specification, and its international successor, which is still in development and not yet published. |
| European Union | NIS2 — Directive (EU) 2022/2555 | Binding through national law, which member states had to apply from 18 October 2024. Air carriers, airports and air traffic control; rail infrastructure managers and railway undertakings; and shipping companies (but not their individual vessels), port managing bodies and vessel traffic services are listed under transport, a sector of high criticality. |
| European Union | Cyber Resilience Act — Reg (EU) 2024/2847 | Covers transport products with digital elements sold in the EU, except aviation products certified under the EASA Basic Regulation and marine equipment under the Marine Equipment Directive. Rail products are not excluded. Reporting of actively exploited vulnerabilities and severe incidents since 11 September 2026, including for products already on the market; full application from 11 December 2027. |
| United Kingdom | NIS Regulations 2018 Cyber Security and Resilience Bill | Air, rail and maritime operators of essential services are overseen by the Department for Transport — jointly with the CAA for aviation, which assesses against its Cyber Assessment Framework for aviation and ASSURE audits. The Cyber Security and Resilience (Network and Information Systems) Bill, which would amend and extend the NIS Regulations, is in the House of Lords and not yet law. |
| AI and post-quantum | EU AI Act — Annex I, Section B | AI that is a safety component of products under the EU’s aviation security, marine equipment, rail interoperability or drone rules can be high-risk, but the AI Act’s requirements reach those products only as the sector rules are amended to take them into account — so there is no fixed AI Act compliance date for them yet. No transport regulator has issued post-quantum guidance; the general timelines on our PQC page are the reference points. |
What you get
- Consequence-ranked findings — rated on safety, service disruption, financial and privacy impact, each pinned to the system and software version tested, with a compensating control
- Equipment and operator evidence — test results structured for the scheme you answer to, from class societies and aviation authorities to rail and transport regulators
- Remediation by delivery route — what can change now, at the next maintenance window, and only at overhaul or renewal
- Cryptographic bill of materials — onboard, shore and signalling cryptography in CycloneDX format, with a post-quantum roadmap tied to fleet cycles
- AI bill of materials — the models, data and tools behind your operational AI, delivered as a CycloneDX ML-BOM
- Two briefings — one for engineering and operations, one for security and leadership
Keep the fleet moving — and out of an attacker’s hands.
A transportation engagement starts with your mode, your fleet or infrastructure, and the regulator or class society you answer to.
Get in Touch