Advancing Transit Cybersecurity, System Assurance, and Artificial Intelligence Governance

ETHAN S. LEE
Business Operations & Development Analyst
Max Cybersecurity LLC

2027 Cybersecurity Challenges and Beyond

A public transit system can be run as expected and still not be trustworthy. As artificial intelligence (AI) enters maintenance, operations, and vendor-supplied technologies, transit leaders face a consequential question: what evidence shows that the systems supporting safe, reliable service are operating as intended?

That question is reshaping the cybersecurity agenda alongside longstanding challenges involving operational technology, aging infrastructure, and increasingly connected systems. Transit agencies must now keep critical systems secure, identify and mitigate cyber threats, and ensure that systems are safe to use in the face of emerging AI cyber challenges. These challenges are not limited to digital systems. Cyber disruption can affect vehicles, signals, traction power, communications, maintenance, dispatch, and ultimately an agency’s ability to provide safe and reliable service.

These challenges were at the center of APTA’s Transit Cybersecurity Working Group (TCSWG) annual meeting, held September 28–29 at APTA headquarters in Washington, DC. Bringing together transit agencies, federal partners, cybersecurity professionals, and industry experts, the meeting built on TCSWG’s ongoing work to translate industry experience into recommended practices, maturity guidance, and actionable priorities, not simply to exchange observations.

From Compliance to Operational Resilience

One of the themes from the meeting was that compliance alone is no longer enough. Transit agencies operate complex environments where information technology, operational technology, communications, vehicles, cloud services, remote maintenance, and third-party systems are increasingly connected. Many Operational Technology (OT) environments also include legacy equipment that cannot simply be patched, scanned, or isolated using the same approaches commonly used in traditional IT environments.

This creates a larger question for transit leaders: Can critical services continue operating safely when part of the environment is disrupted or cannot be fully trusted?

The discussions emphasized the need for agencies to understand which systems support critical functions, how those systems depend on one another, and what compensating controls may be necessary when traditional cybersecurity controls cannot be applied. That practical focus reflects the working group’s broader contribution: helping agencies turn technical requirements into guidance they can implement in complex transit environments.

AI Creates a New Cybersecurity Frontier

Artificial intelligence adds another layer to this challenge. The technology is not only arriving through projects that agencies intentionally identify as “AI.” It can also be embedded within products, software updates, analytics platforms, maintenance systems, and other technologies already being used throughout an organization. An agency may therefore be using AI without having complete visibility into where it exists or how it influences operational decisions.

At the same time, AI can expand the capabilities available to cyber threat actors, increasing the need for agencies to reevaluate detection and response. The meeting also underscored a distinct challenge: AI embedded in vendor products may influence maintenance priorities, alerts, or operational judgments without appearing on an agency’s formal inventory of AI projects.

For transit, this makes AI governance an operational issue as well as a technology issue. Agencies need to know where AI is being used, what data it depends on, what decisions it can influence, who is accountable for those decisions, and when meaningful human authority must be maintained.

The TCSWG discussions pointed toward a risk-based approach to AI governance that includes discovery, procurement, authorization, continuing oversight, and the ability to disable AI functionality when necessary.

Advancing System Assurance

These challenges also led participants to examine an emerging TCSWG discussion area: System Assurance. Rather than announcing an adopted standard, the working group is exploring how transit agencies can establish evidence-based confidence in the systems on which service depends.

System Assurance is the ability to establish and maintain confidence, through evidence, that critical transit systems and their dependencies operate safely, securely, reliably, and as intended.

The idea addresses an important gap. A system can still be running while its integrity remains uncertain. During a cyber incident, leadership may have to decide whether to continue service, restrict operations, isolate a system, or begin restoration before every technical question has been answered.

System Assurance focuses on having enough current and relevant evidence to make those decisions. That evidence can include system configurations, dependencies, access privileges, operational testing, vendor information, recovery capabilities, and known-good baselines. The goal is not to eliminate uncertainty. It is to give decisionmakers a stronger basis for determining what can be trusted, what remains uncertain, and what actions can safely be taken.

Turning Collaboration into Action

The purpose of the September meeting was not simply to identify cybersecurity challenges. It was to move the working group toward practical products that transit agencies can use. APTA also wanted to connect the experience of agencies, federal partners, and industry specialists with the association’s standards-development mission.

The discussions identified potential 2027 work in three immediate areas: selecting five priority OT cybersecurity procurement requirements from North American Transit Cybersecurity Agreement (NATCA) material; developing OT assessment and analysis recommended-practice guidance; and exploring transit-specific AI governance and System Assurance. Additional themes included operational decision guidance, measures of effectiveness, and third-party assurance. These are proposed workstreams for further working group review, not adopted requirements.

As transit technology continues to evolve, the industry will have to address cybersecurity, physical infrastructure, operational technology, artificial intelligence, and system safety as connected to challenges rather than separate issues.

For 2027 and beyond, the question is not simply whether public transit agencies are compliant or their systems remain online. It is whether the industry can produce the evidence, practical guidance, and operational confidence needed to keep public transportation safe and reliable when critical systems are challenged. Through collaborative, transit-specific work products, TCSWG has an opportunity to help agencies answer that question.