Innovation is no longer viewed as a long-term initiative reserved for research labs or future planning sessions; it has become a core business requirement. Customers, partners, and investors increasingly expect companies to deliver not only operational excellence, but also a clear vision for how their products and services will evolve to meet tomorrow’s challenges.
Today’s Operational Platforms are also transforming through innovation. They are becoming more connected and digitally dependent; the need for real-time visibility into onboard systems is no longer optional, it is foundational to safety, mission readiness, and resilience.
Tobias Folatelli, Commercial and Public Security Research Analyst, sat down with Toby Magsig, CEO of Shift5, to uncover how they are redefining the way that fleets in motion are secured, moving the industry beyond legacy assumptions toward continuous, full-spectrum observability. By transforming onboard data into actionable intelligence, the company is elevating cybersecurity from a reactive safeguard to an operational advantage.
Folatelli: Many people still associate OT cybersecurity with fixed industrial environments. How would you define onboard OT cybersecurity, and why does it require a fundamentally different approach?
Magsig: The foundation is the distinction between IT and OT. IT security protects data, the confidentiality and integrity of information. OT security protects the physical, the systems that actually operate machinery in the real world. They're interconnected, but they run under different constraints and fail in different ways. When IT fails, information is exposed. When OT fails, something physical stops working, and the outcome can be catastrophic.
Onboard OT raises those stakes even higher, because the asset is moving. Most of the OT security industry is built around fixed infrastructure, water treatment plants, energy grids, manufacturing floors. Critical, but stationary. Shift5 secures platforms that move: aircraft, maritime vessels, ground vehicles, trains. On a moving platform, a compromise to navigation, communications, or another critical system can mean mission failure or loss of life. Our objective goes beyond detecting a threat - it's understanding which systems are affected, what the impact is, and preventing an incursion from affecting safe operation of a platform.
Folatelli: You often describe Shift5 as pioneering onboard OT observability. What does “observability” mean in this context?
Magsig: For us, observability means capturing everything happening on a platform, in full. Not a sample, not a log here and there, but 100% of the data moving across the buses, collected passively, without ever interfering with the systems themselves. That's the foundation. Once you have it, you can establish what normal looks like on that specific platform, which is the only way to recognize when something changes.
But capturing the data isn't the end of it. The data only matters if an operator can act on it. We take what's coming off the platform and turn it into something usable in the moment, so an anomaly gets surfaced and acted on, not left in a file for someone to find later. That combination - full visibility into how an asset is operating and near real-time feedback to the operator - is what lets observability address a host of challenges: safety, readiness, and sustainment.
Folatelli: How does real-time onboard observability change the way operators respond to cyber threats?
Magsig: You can't protect what you can't see. That's as true on a platform as it is on a network.
Without visibility, you're reacting blind. Something has to go visibly wrong before anyone looks, and even then you're guessing at what happened and what it affected. Observability changes the quality of that response. You see the problem as it's happening, you know which systems are involved, and you can act on facts instead of assumptions. The response is still a response, but an informed one, and that can be the difference between recovering quickly and not recovering at all.
Early warning is where it goes further. Our RF-based detection picks up GPS spoofing attempts up to 200 nautical miles out, before a platform ever enters the compromised environment. That gives an operator advance notice, the chance to prepare or reroute ahead of the threat rather than respond once they're in it. Serial bus monitoring then shows how navigation is actually being affected once you're inside that environment, so the operator has both the heads-up and the full picture.
Read the full interview here.
