Safety in Public Transportation: Detect Issues Before Operations Come to a Halt

In the past, a train would be canceled if a rail tie broke. Today, all it often takes is an encrypted ticketing system, a control center operating in emergency mode, or passenger information that simply goes silent. . Networked control centers, digital ticketing, and automated depots are fundamentally transforming local public transit: What used to be controlled by separate, isolated systems is now interconnected, and every new interface simultaneously increases the attack surface. For operations and management, this shifts the critical question to: It’s not a question of whether an attack will occur, but how quickly it will be detected while operations continue.

Real-life incidents show that it is by no means limited to major cities
When a German public transit operator was targeted by a cyberattack in 2023, online ticket sales were disrupted for days. An IT service provider serving more than 70 municipalities was also the target of a ransomware attack: For weeks, key administrative services were unavailable—a disruption that highlights just how vulnerable interconnected, service-provider-dependent municipal IT environments are overall. In both cases, it was not large corporations that were affected, but rather municipal infrastructure—the kind found in many public transit systems. With the KRITIS umbrella law, which has been in effect since March 2026 and covers the transportation sector, including public transit, as well as the NIS 2 requirements, cyber resilience in local transit is now also mandated by law.

Three Questions Every Solution Must Be Measured Against

Three criteria are crucial here: First, detection must occur early enough—during the reconnaissance and movement phases of an attack—and not only after systems have already been encrypted. Second, a solution must not interfere with ongoing operations cause disruptions, because control systems and passenger information systems cannot tolerate testing during actual operations. Third, data and operations must remain under German control, especially when it comes to infrastructure that millions of people use every day.

Two levels, one goal: Detect attackers early

Cybersense addresses precisely these criteria with two complementary components. Cybersense Deception involves placing inconspicuous decoys and digital motion detectors placed at strategic points in the network—so realistic they are indistinguishable from productive systems. As soon as an attacker interacts with them, the solution triggers an alarm, regardless of the tool used. The second element remains intentionally simple: Instead of a complex platform with an endless array of features, Cybersense Core SIEM provides a deliberately streamlined analysis and prioritized security-related alerts from Windows and Linux systems, managed by the SOC. Dortmund. Both modules are running on- premises and agentlessly on the production systems, without interfering with existing control and ticketing systems.

Come meet Cybersense at InnoTrans 2026

We’d be happy to show you in person exactly what such an early-warning system looks like for public transit operators and how it performs in an emergency: September 22–25, 2026, at InnoTrans in Berlin. Sign up for a meeting with our team.