Does the Transit Industry Understand the Risks of Cybersecurity and are the Risks Being Appropriately Prioritized?

Abstract:

The intent of this study is to assess the readiness, resourcing, and capabilities of public transit agencies to detect, identify, be protected from, respond to, and recover from cybersecurity vulnerabilities and threats. This study is an update of the 2020 Mineta Transportation Institute (MTI) study, “Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendations to Enhance Surface Transit Cyber Preparedness.” In the previous study, the authors found that the transit industry was ill-prepared for cybersecurity attacks. Unfortunately, after four years and the development of new, and often free, resources, the situation has not markedly improved. In fact, this survey, which included a larger number of small rural transit agencies, shows that they lag far behind their larger peers. The increasing sophistication of cybercriminals, in combination with a greater reliance on technology within the transit industry, puts the industry at greater risk than in 2020. This study reviews and updates the state of best cybersecurity practices in public surface transit; outlines U.S. public surface transit operators’ cybersecurity operations and the resources available to them; reviews U.S. policy on cybersecurity in public surface transportation; and provides policy recommendations that address gaps or identify issues for Congress, the Executive Branch, public surface transit agencies, and their associations and other supporting organizations. Research methods include an online survey and oral interviews with public surface transit agencies in the United States as well as oral interviews with members of the Executive Branch (e.g., the U.S. Department of Transportation, the U.S. Department of Homeland Security), as well as research of literature published in periodicals. There is an exponentially expanding gap between the cybersecurity preparedness that should exist and the growing threats from increased reliance on technology and the opportunities by malicious actors. This research provides information that can be used to help close that gap.

Publications:

Does the Transit Industry Understand the Risks of Cybersecurity and are the Risks Being Appropriately Prioritized? (Full Report)

Research Brief

Additional Resources:

“Supplemental Materials/Dataset (zip file)”

Authors:

Scott Belcher, JD, MPP
Scott Belcher is the President and CEO of SFB Consulting, LLC, where he specializes in transportation, transportation technology, the internet of things, smart cities, the environment, and cybersecurity. Prior to founding SFB Consulting, Mr. Belcher served as the CEO of the Telecommunications Industry Association for two years and the President and CEO of the Intelligent Transportation Society of America (ITS America) for seven years. Mr. Belcher is a Mineta Transportation Institute (MTI) Research Associate and has a written a several white papers and two MTI studies on cybersecurity in transportation. Mr. Belcher has more than 35 years of private and public sector experience in Washington, D.C. Before ITS America, Mr. Belcher held senior management positions at a number of prominent trade associations, worked in private practice at the law firm Beveridge & Diamond PC, and worked at the U.S. Environmental Protection Agency. Mr. Belcher serves on a number of public and private advisory boards. He holds a JD from the University of Virginia, a Masters of Public Policy degree from Georgetown University, and a Bachelor of Arts degree from the University of Redlands.

Terri Belcher
Terri Belcher is a writer and analyst who has worked in Washington, D.C. for the past 35 years. Ms. Belcher has 25 years of experience working for the federal government, federal contractors, and a number of non-profits. Ms. Belcher earned a Bachelor of Arts degree from the University of Redlands.

James Grimes
James Grimes was a research associate for SFB Consulting, LLC and Cybrbase from 2022–2024. Mr. Grimes has experience with data science and statistical analysis and completed several statistical research projects during his undergraduate studies at the University of Virginia (UVA). Mr. Grimes received his Bachelor of Arts from UVA in Economics and Statistics and graduated with Honors in 2024.

Lusa Holmstrom
Lusa Holmstrom is a dual degree student at Fordham University pursuing a Bachelor of Arts in English and Spanish and an MA in Education and will receive her undergraduate degree in May 2025. She is a writer and Assistant Opinion Editor at the Fordham Ram newspaper, works as a Maintenance Coordinator at Fordham University’s Department of Transportation, and has three years of experience in the field.

Andy Souders
Andy Souders is a technology executive with over 35 years of experience in digital innovation and organizational transformation across industries such as Cloud, Cybersecurity, and Smart Cities. As a three-time CEO and four-time CTO/CIO/CISO, Mr. Souders has led both startups and global enterprises, leveraging strategic planning, product development, and operational excellence with P&L responsibilities over $500M. Currently, Mr. Souders is the CEO, CTO, and Co- Founder of Cybrbase, a cybersecurity assessment platform that enables organizations to measure, optimize, and communicate the maturity of their cybersecurity programs. He is also the Founder and CTO of Think Next Technologies, offering advisory services in emerging tech, and cybersecurity. Additionally, Mr. Souders has held executive roles at All Traffic Solutions, Savi Technology, Clarity Solution Group, and AOL, consistently pioneering advancements in IoT, big data, artificial intelligence, and cybersecurity. A published author and patent holder, Mr. Souders co-founded Pedal It Out, a non-profit supporting cancer awareness and fundraising. Mr. Souders earned his Bachelor of Science degree from Frostburg State University.

Published:

May 2025

Keywords:

Cybersecurity

Enterprise Risk Management

Policy

Security

Transit