Understanding the Current Transit Investment in Cybersecurity

Cybersecurity attacks are increasing globally and across every sector of society. Transit is not immune. Cybersecurity ransom attacks were up over 25% year-over-year between 2021 and 2022 and the average cost and time to recover from a cybersecurity attack continues to skyrocket. As a result, the cybersecurity insurance market is changing rapidly to reflect this growth. Cybersecurity insurance used to be a low-cost add-on for transit agencies and their vendors. Today, many insurance companies are tightening underwriting guidelines related to cybersecurity. The transit industry is coming out of the most challenging period in its history after the COVID-19 pandemic. Most agencies are struggling to recover ridership and have had to cut services. Yet many are still facing a looming fiscal cliff. A successful cyberattack could push transit agencies into uncharted waters disproportionately impacting the essential workers that are key to a thriving and competitive economy. This study will assess whether transit agencies have made progress in hardening their cybersecurity systems to prevent an attack and put in place the necessary tools necessary to respond to the inevitable attack, thus minimizing its severity and impact on ridership. The researchers will survey the respondents who participated in the 2020 survey that was the base for the landmark Mineta Transportation Institute (MTI) study - Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendations to Enhance Surface Transit Cyber Preparedness, to update several of the key questions about agency preparedness. The researchers will also collect data from additional respondents to broaden the data set and ask a series of new questions on cybersecurity preparedness and investment. The results of the survey and interviews will be grouped in various ways to create peer benchmarks. The resulting analysis will provide the researchers, and ultimately transit agencies and regulators, with insights about investments in cybersecurity prevention across various segments of the industry. The researchers will use these insights to make policy recommendations for agencies, the federal government, and Congress.