2026 Mobility Outlook Miniseries: Cybersecurity Trends

According to a report published by the Mineta Transportation Institute (MTI) in May 2025, the transit industry is ill-prepared for cybersecurity threats and attacks. The study was based on survey responses from 78 transit agencies, interviews with transit professionals and a literature review.  

MTI’s key findings align with transit agencies’ responses to our Annual Mobility Outlook Survey from the past several years: there is a lack of expertise surrounding cybersecurity best practices. Specifically, MTI’s report stated that “many executives do not appreciate the risks their organizations face, and if they do, many leaders do not know what their teams are doing to address these risks.” 

While technology’s rapid change of pace has consistently been the top challenge for transit agencies according to responses from Mobility Outlook Surveys, immediately following that is a lack of expertise and personnel at the agency. This isn’t to say agencies are brushing off cybersecurity threats. On average, for the last five years, 73% of survey respondents agreed cybersecurity is a concern. This year, 74% agreed it was a concern.  

So what can agencies do to help close this skill gap and take actional steps to protect their systems? According to MTI’s report, agencies should, among other things: 

• Develop a yearly updated individualized cybersecurity plan.   
• Conduct a cybersecurity assessment at least annually and address the shortcomings identified in that assessment in a timely manner. 

Addressing cybersecurity concerns 

The good news is work is already being done on both of these fronts. According to this year’s responses, 42% of agencies have a cybersecurity incident response plan in place compared to 35% in 2025. The number of agencies with this in place has somewhat grown over the years. In 2020, 26% reported having a plan in place, which grew to nearly 30% in 2021, 34% in 2022, 52% in 2023 and then dropped back to 38% in 2024.  

These plans aren’t just sitting on shelves collecting dust. In line with MTI’s recommendation to conduct annual assessments, agencies are committed to reviewing their incident response plans once a year. While this year’s responses saw a sharp decline—nearly 40% reporting reviewing plans once a year—in general, there has been a strong response in this area. In 2022, 48% reviewed their plans once a year. That grew to 76% in 2023 and 93% in 2024 before dropping down to 60% in 2025.  

The other good news is that historical data shows only a slim number of agencies responding to our survey reported experiencing a cyberattack. 2020 saw the highest number of reported cyberattacks, 27% of responding agencies, but that number quickly dropped in 2021 to 9%—the same percentage for this year.  

Though there has been fluctuation over the years, in general, agencies average identifying a cyberattack within hours; however, some agencies have reported taking over a month to recognize a cyberattack. There’s also a wide range in how long it takes agencies to recover from a cyberattack, ranging from minutes up to months. For 2026, 20% of responding agencies said it took hours to fully recover—compared to 2025 where 43% recovered within a week.