Our team was approached by a US state-wide transport and infrastructure provider to conduct a combined physical and cyber threat assessment. This was done to improve the client’s overall risk management and support the placement of insurance, by linking the approach to extant risk -management frameworks.

The assessment focused predominantly on critical terror and cyber threats, from both overseas organisations and domestic actors. After identifying the threats, we mapped these over to the clients assets, highlighting the applicable risks and enabling risk treatment.

This uncovered adversary methodologies that were previously unknown to the client, which included the ability to procure modified versions of industry specific equipment to cause damage. Such equipment would give adversaries an unexpected advantage over the client’s security, who were quickly informed of the problem.

This approach also enabled our consultants to understand where physical or cyber vulnerabilities could converge and be exploited to impact the company in either domain. This is critically important for companies where operational technology and assets are becoming integrated with IT systems. Finally, the team developed a risk treatment plan and provided recommendations on the risk transfer strategy of the organisation, reducing its exposure and contributing to a safer and more robust transport network.