The transportation sector encompasses aviation, maritime, rail, and road transport, all of which rely increasingly on digital systems for operations, safety, and passenger services. Transportation organisations are designated as critical infrastructure in most jurisdictions and face threats from nation-state actors, cybercriminals targeting passenger data, and attackers seeking to disrupt transport services.
Penetration testing for transportation must address a diverse technology landscape including operational technology controlling physical systems (signalling, air traffic control, vessel navigation), passenger-facing applications (booking, check-in, infotainment), corporate IT systems, and the growing ecosystem of connected vehicles and autonomous systems.
Safety is paramount in transportation pen testing, requiring testers to understand the safety implications of system compromises and work within strict operational constraints. EU transportation entities must comply with NIS 2, while aviation-specific requirements include standards from EASA and ICAO. Regular penetration testing helps transportation organisations protect passengers, maintain service continuity, and comply with sector-specific regulations.
Featured partner for Transportation.
US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.
US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.
Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors.
Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.
London-based cybersecurity provider, now part of Kroll, delivering CREST-accredited penetration testing, managed detection and response, and incident response with a 550-strong cyber team.
Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.
Airbus group cybersecurity consultancy with ANSSI PASSI qualification. Aerospace, defence, and critical infrastructure penetration testing across Europe.
Munich- and Budapest-based embedded cybersecurity experts focused on financial services, automotive and mobility, manufacturing and industrial automation, energy and more. The services and platform go beyond compliance, supporting the requirements of the Cyber Resilience Act, PCI PTS, UN R155, ISO/SAE 21434 and other standards and regulations.
Atlanta-based pen testing firm serving major enterprises. Known for physical penetration testing alongside network and application assessments.
Yes, with appropriate precautions. Testing of safety-critical systems requires specialist expertise, careful scoping, and may involve testing on representative environments rather than live production systems.
Testing should cover passenger-facing applications, operational technology (signalling, control systems), crew management systems, supply chain integrations, and connected vehicle/vessel systems.
NIS 2 covers transport as an essential sector. Aviation has EASA cybersecurity requirements. Maritime has IMO guidelines. Rail operators may need to comply with national rail cybersecurity regulations.