Every DOT Mode Has the Same Cyber Gap: Unauthenticated Devices

In April 2026, the Department of Transportation's Office of Inspector General reported that the FAA does not effectively secure the high-impact systems supporting the National Airspace System. The audit covered 45 systems that NIST categorizes as causing severe or catastrophic harm if compromised. It found outdated security control baselines, incomplete documentation of the controls in place, and known vulnerabilities that were never tracked to closure.That is not an aviation story. The same weakness runs through rail, transit, highway and maritime operations, and it has a single root cause. Safety-critical commands move between field devices that cannot cryptographically prove who they are.

How bad is the aviation baseline?

The Inspector General's findings sit on top of an infrastructure problem GAO has been documenting for years. GAO reported in March 2025 that of the 138 systems the FAA uses to manage the national airspace, 51 are unsustainable and another 54 are potentially unsustainable. For the most critical of them, replacement is six to ten years away.

That is 105 of 138 systems supporting roughly 45,000 flights a day, operating past the point where the vendor, the parts supply, or the security model can be relied on.

The same gap, mode by mode

DOT has 11 operating administrations. The equipment differs completely. The failure mode does not.

A checksum confirms that a packet arrived intact. It says nothing about who sent it. Default credentials are worse, because every operator of that model shares them.

Why does the pattern repeat across every mode?

Three structural facts explain it.

• Transportation assets outlive their cryptography. A signal controller, a ship-to-shore crane, or an end-of-train device is a 20-to-30-year asset. Certificate lifetimes are measured in months and are getting shorter. Nothing in the procurement cycle accounts for that gap.
• Field devices lose connectivity by design. A certificate is only as strong as the validation path behind it: a reachable certificate authority, a current revocation list or OCSP responder, and an accurate clock. Tunnels, trackside cabinets, remote ramps, terminals and vessels break that path as a matter of routine operation.
• The compute budget is small. Roadside units, telemetry radios and PLCs were specified for a control function, not for certificate parsing, chain validation and renewal.
• Authenticate with no reachable authority. If the device cannot verify a peer while disconnected, it will fail open or fail the mission.
• Fit the hardware that is already installed. Retrofit matters more than greenfield, because the installed base is the exposure.
• Survive the asset's service life. A device commissioned in 2026 and retired in 2050 has to remain secure against a cryptanalytically relevant quantum computer.
• Run without human intervention. There is no maintenance budget for manual credential renewal across tens of thousands of roadside and trackside endpoints.
• Work across vendor boundaries. No single manufacturer owns a mode, let alone a corridor.
• No certificate authority dependency, so the device authenticates while air-gapped or disconnected.
• A sub-1MB embedded executable, small enough for constrained industrial and roadside hardware.
• A symmetric-key architecture that is natively quantum-secure rather than a post-quantum bolt-on, which matches a 30-year asset life.
• Provision once, runs forever. No renewal cycle, no revocation list, no truck roll.
• A lightweight SDK that integrates at the protocol layer rather than requiring an infrastructure rebuild.

Put those together and the result is predictable. When certificates cannot be deployed, the field falls back to shared static credentials, factory defaults, checksums, or nothing.

Modernization is replacing the pipes, not the trust model

The FAA's Brand New Air Traffic Control System is a genuine rebuild: 5,170 new fiber, satellite and wireless connections, 27,625 new radios, 612 radars, and a target completion date at the end of 2028 against a $12.5 billion congressional down payment.

Underneath it, the FAA Enterprise Network Services program is moving roughly 4,600 continuously operating facilities from time division multiplexing to IP. AT&T took the prime role in August 2026 on an initial $74.3 million task order expected to grow into a multibillion-dollar, 15-year program.

This is the right investment and it raises the stakes on identity. Moving from dedicated circuits to a routed IP network removes the physical isolation that quietly served as authentication for decades. Once any endpoint can reach any other endpoint, every endpoint has to prove itself. The transport is funded. The trust model is still an open architectural decision, and it is being made now.

What does a workable answer have to do?

Any credible fix for transportation operational technology has to clear five bars at once.

Certificate lifecycle management does not clear those bars. It manages the certificate problem more efficiently. It does not remove the dependency on a reachable authority, and it does not shrink to fit a telemetry radio.

Where AKM fits

AKMSecure built Autonomous Key Management^™ for exactly this environment. In most transportation operational technology, PKI was never viable, so AKM is not replacing it. AKM delivers encryption and authentication where certificates could never reach.

The architecture is simple to state. A pre-shared crypto seed algorithmically generates unlimited key material on the device itself. Quantum-resilient symmetric keys refresh with every session, autonomously. Every network packet is verified for integrity. A self-healing mechanism restores availability without operator action.

Against the five bars above:

The operational numbers follow from the architecture. The handshake completes in under a millisecond, against 300 to 700 milliseconds for PKI. More than 40% of reported attacks involve stolen PKI credentials, and AKM leaves no persistent credential to steal. Total cost of ownership runs at roughly one quarter of PKI's, because the recurring labor of certificate management disappears rather than being automated. AKM has been validated on live industrial control equipment and is protected by four U.S. patents.

This is Zero Trust at the protocol layer, which is what DoD Zero Trust reference architecture, NIST SP 800-207 and EO 14028 all describe and which certificate infrastructure has never delivered in the field. Every session is independently verified. No standing privilege is left behind. Nothing persists that an attacker can reuse or escalate.

The window is open now

DOT is in the middle of the largest transportation infrastructure investment in decades, and cybersecurity is no longer separable from safety in how the department frames its own mission. Every one of those programs is specifying a communications architecture right now. Endpoint identity is a decision inside that specification, and it is far cheaper to make it before the fiber is pulled than after 5,170 connections are live.

The equipment in the field cannot prove who it is. That is the gap. It is fixable, and the fix has to work without a certificate authority on the other end.

About AKMSecure

AKMSecure delivers a patented Autonomous Key Management™ protocol built to replace outdated PKI approaches with a dynamic, quantum-secure, air-gapped-capable architecture. Instead of relying on persistent credentials that can be stolen, reused, or abused, AKM enables independently verified sessions with no standing privileges left behind. The result is a model that better aligns with Zero Trust principles, reduces certificate-based risk, and supports resilient operations across enterprise IT, OT and Tactical Edge environments. Built to NSA-grade security standards and deployable as a lightweight SDK, AKMSecure helps organizations modernize trust at the protocol layer without rebuilding everything around it.