Cylus

Cylus develops CylusOne, a unified cybersecurity platform purpose-built for rail and mass-transit operators. The platform provides continuous monitoring, threat detection, and operational risk reduction across all critical rail systems—signaling and train control, CCTV, rolling stock, dispatch, SCADA, and passenger information systems—in a single pane of glass. Unlike generic industrial cybersecurity tools designed for IT/OT convergence, Cylus' domain-specific approach recognizes that rail environments combine extreme uptime requirements, legacy system heterogeneity, safety-critical operations, and operational technology architectures that differ significantly from utility SCADA or manufacturing environments. The core capability is rapid asset visibility and anomaly detection tuned to rail-specific operational patterns, enabling security teams to distinguish actual threats from normal operational variation in real time.

Cylus was founded in 2017 by Israeli cybersecurity entrepreneurs and now operates with a team of 51–200 across Tel Aviv headquarters and growing international presence. The company has completed a Series B funding round (approximately $37 million in early 2024, bringing total funding to roughly $77 million) from a mix of strategic infrastructure-sector investors and financial backers. Notable endorsements include Alstom, a global rail system integrator, citing Cylus as a partner to enhance rail network resilience. The company holds industry certifications including IEC 62443-4-2 Security Level 3 (the first rail cybersecurity solution to achieve this), IEC 62443-4-1, ISO 27001, ISO 27017, and ISO 9001, reflecting both technical depth and mature operational security governance. Cylus has achieved early customer deployments among major European and international rail operators, positioning itself as the dedicated market leader in rail cybersecurity.

The commercial market for rail cybersecurity is driven by regulatory momentum (EU NIS2 Directive, national critical infrastructure mandates, ISO/IEC rail security standards), modernization of legacy signaling and train control systems, and rising threat visibility following high-profile transit sector incidents globally. Rail operators face acute procurement and integration challenges due to the safety-critical nature of changes, extreme uptime requirements (99.99%+), and complexity of coordinating across multiple legacy system vendors. Cylus' domain expertise and railroad-specific understanding of these constraints give it advantage over broader OT security vendors. The market addressable base includes hundreds of major rail operators across Europe, North America, Asia-Pacific, and emerging rail networks, with ongoing digital transformation investments in signaling modernization, autonomous operations, and cybersecurity resilience. Pricing models (per-asset, per-operator, or managed service SaaS) remain typical for mid-stage infrastructure software, with annual contracts favored by operator procurement.

Dual-use potential is strong and substantive. Transportation infrastructure cyber resilience is critical for both civilian economic mobility and defense logistics continuity. Rail disruption can paralyze urban mobility, damage supply chains (especially in critical sectors like defense manufacturing and energy), and degrade mobilization readiness for national defense. Adversary interest in rail sabotage (cyber, physical, or hybrid) is documented in both peer and non-peer conflict contexts. A capable rail cybersecurity platform that operates across all layers of train control, signaling, and operational technology directly supports national resilience against infrastructure-level cyber attack or sabotage. Israeli defense and security authorities have recognized critical infrastructure cyber resilience as a national strategic priority, and Cylus' technology and market position position it as a natural strategic asset for broader national cyber defense policy and international technology partnerships.

Competitive positioning is strong within the narrow rail-security domain but faces broader competition from mature OT security vendors (Claroty, Nozomi Networks, Waterfall Security Solutions) that are expanding into vertical specialization, and major industrial controls vendors (Cisco, Nokia) with OT security arms. However, Cylus' dedicated rail domain model, proven rail certifications, and established operator relationships create high switching costs and strong moat relative to generic entrants. The primary competitive risk is acquisition of rail-security capability by a much larger vendor, which could commoditize the market. Cylus' size, strategic value, and Israeli origin make it an attractive acquisition candidate for European or North American infrastructure-security consolidators or for Israeli strategic investors.