It used to be enough to just keep the lights on; now we have to do that securely.

Cybersecurity is not why most of us became transportation professionals. We entered the industry to improve

mobility, enhance safety, and help communities move more efficiently. But with the great power of moving millions of people every day, comes the responsibility of protecting the systems they rely on. And whether we like it or not, cybercriminals are quickly becoming one of the most terrifying villains in transportation.

Modern transportation systems are no longer isolated pieces of hardware and software. Traffic signals, variable message signs, video cameras, and countless other roadside devices are connected via networks and joined in to large central ATMS systems to form a broad digital ecosystem.

That connectivity creates incredible opportunities to enhance traffic operations but also introduces new vulnerabilities. A compromised device is not just a maintenance issue; it can become a risk to system operations, public trust, and critical infrastructure.

One challenge is that many of the standards and technologies still in use across transportation — developed to increase interoperability, which is a good thing — are based on legacy, insecure and unencrypted protocols. Legacy protocols, like SNMP v1, are a bit like leaving your front door unlocked because your suburban neighborhood was safe in 1985. The world has changed. While technology has kept up, our industry hasn’t; the transportation industry is stuck in the 80s and when it talks about advancing it has its eyes set on the early 2000s. Meanwhile, cyberattacks continue to increase in sophistication and frequency, with cybercriminals advancing their capabilities at the speed of today, which includes AI assistance for vulnerability detection and exploitation.

There’s a reason Hollywood loves to feature villains taking over traffic systems. Turning all lights green for a daring bank heist is very dramatic, even if it is technically unlikely. A hacker launching a ransomware attack against a US municipal transportation system from their couch in Eastern Europe is dull, but much more likely to occur, and could be as lucrative as a heist.

The cost of a cyber-attack is not always measured in ransom payments. The larger cost includes system downtime, IT recovery efforts, loss of mobility, and erosion of public confidence. This operational burden is placed on already over-extended agency staff.

And, unfortunately, the consequences paid for insecure systems can go beyond dollars spent and hours wasted. A disrupted transportation system could delay emergency response, complicate evacuations, and generally create chaos in the moments communities need these systems most.

The good news is that better tools already exist. Industries such as banking and healthcare have spent decades strengthening their cybersecurity practices. Transportation does not need to reinvent the wheel; it needs to accelerate adoption of proven cybersecurity technology. That includes moving away from SNMP v1 and beyond SNMP v3, to adopting modern architectures built on encrypted communications, stronger authentication, and secure APIs. Just as important are foundational practices such as centralized user management, signed software updates, and multi-factor authentication—all common IT best practices but still emerging across the transportation space.

Cybersecurity extends beyond the field device and the network itself. Security frameworks, like SOC 2, help validate that an organization has the right internal processes and procedures to safeguard user data and system operations.

At Q-Free, we believe cybersecurity should be built into products from the beginning, not bolted on afterward. That means considering security at every design stage, following a security framework, using automated vulnerability scanning, implementing rigorous testing processes, and deploying modern architecture that supports security by default.

As traffic professionals, we have always been concerned with safety. Increasingly, we must recognize that cybersecurity is part of that mission. Keeping people moving safely no longer stops at timing plans and detector calls. It means making the bad guys’ lives harder, while we make the good guys’ jobs easier.