Why rail cybersecurity requires a different security model Why rail cybersecurity requires a different security model Digital threats are moving at rail speed. Here is how railways keep them off the train. The departure board flickers. The train glides in, the doors open, and together with hundreds of commuters you step into a world that feels reassuringly routine. “For most people, it really is just another Monday. But for the people who build and operate railways, that ordinary moment is the finish line we chase every single day.” says Eddy Thésée, Vice President Digital & Cybersecurity at Alstom. The finish line that Eddy refers to moves every day, without the passengers noticing. Why does it move? Society evolves, technologies too, and with new systems come new digital threats. The same threats that can expose your inbox are now targeting critical infrastructure: the power grids that keep hospitals running, the water systems that make cities liveable, the fibre networks that carry a bank login across continents. And yes, the railways that underpin entire economies. A cyber incident on rail can mean a missed morning commute for thousands. Why rail cybersecurity is a discipline of its own Long before connectivity became commonplace, rail already relied on software and control logic to run safely and on time. Older fleets are now being brought online for the first time, and new standards and EU requirements have turned cybersecurity into an operational duty. But the real challenge is not regulation; it is the moving machine. In most industries, cybersecurity protects stationary IT systems, think office computers and data locked away in a server room. The focus is on building digital walls: separating networks so a breach can’t spread, watching devices for suspicious behaviour, and controlling who gets access to what. These meaures work well when