CylusOne Rail Cybersecurity Platform

Cylus Ltd. is a rail cybersecurity company based in Tel Aviv, Israel, co-founded by CEO Amir Levintal and CTO Miki Shifman. It protects the operational technology that runs freight, passenger and urban rail, including signalling, interlocking, rolling stock, power supply and station systems, where cyberattacks can affect safety and service.

CylusOne connects passively to trackside and onboard networks. It discovers and classifies assets across CBTC, ERTMS, PTC and computer-based interlocking systems, scores vulnerabilities in the rail context, virtually segments networks into security zones and detects threats with deep packet inspection and machine learning on railway and IT protocols. Alerts include context such as packet captures and rail-specific playbooks, and compliance reports support IEC 62443, TS 50701 and NIST guidance. Users are rail operators, infrastructure managers and rolling stock makers.

• Asset discovery: Passively discovers and maps assets across signalling, rolling stock and depots.
• Vulnerability and risk management: Scores vulnerabilities by severity in the rail environment.
• Virtual segmentation: Divides networks into security zones regardless of topology.
• Threat detection: Uses deep packet inspection and machine learning on railway and IT protocols.
• Investigation and response: Provides PCAP context and rail-specific mitigation playbooks.
• Compliance reporting: Supports IEC 62443-3, TS 50701, NIST 800-82 and logs all user actions.

An urban metro operator in Hanoi or Ho Chi Minh City can monitor CBTC signalling and station networks for intrusions. A railway modernisation project can include asset inventory and IEC 62443 compliance reporting in its greenfield design. A rolling stock supplier can add onboard network monitoring to trains delivered to the region.

Rail operators gain a full inventory of signalling, onboard and station assets without disturbing safety systems, since the platform connects passively. Vulnerabilities are prioritised in the context of rail operations, so limited maintenance windows go to the most important fixes. Rail-specific detections and playbooks help security teams respond without deep railway engineering knowledge. Built-in reports support audits against IEC 62443 and TS 50701.

Rail signalling and rolling stock are becoming digital and connected through CBTC and ERTMS, which expands the attack surface. Regulators in Europe and the US now issue rail cybersecurity directives, and new metro and railway projects in Vietnam and Southeast Asia are adopting connected signalling that will need OT security from the design stage.

Office in Tel Aviv, Israel. Claims the first rail cybersecurity solution certified to IEC 62443-4-2 at SL 3, plus ISO 27001, ISO 27017 and ISO 9001. Partners include Alstom, Belden, Fortinet, AWS, HASLER Rail and duagon. The advisory board includes the CISO of SMRT and a former CISO of Singapore's LTA.