Aviation security is going all-hazards. The Transport Security Amendment Act puts cyber inside it.
As a critical aviation asset, rail freight operator, freight infrastructure holder, or logistics technology platform, you sit inside a tightening regulatory stack. Aviation is regulated under ATSA rather than the SOCI CIRMP, and since 27 March 2026 cyber security incidents with a relevant or significant impact count as unlawful interference with aviation. Critical freight infrastructure and freight services assets carry the CIRMP, uplifted by the Enhanced CIRMP Rules 2026. Rail signalling and train control systems are increasingly IP-connected. Freight platforms are the shared networks Everstream Analytics identified as the target shift.
Your specific challenges
Cyber is now inside aviation security
Aviation security sits under the Aviation Transport Security Act, not the SOCI CIRMP regime. Since 27 March 2026, the Transport Security Amendment (Security of Australia's Transport Sector) Act 2025 has treated cyber security incidents as unlawful interference with aviation, with mandatory reporting to Home Affairs and ASD.
Rail signalling and train control are IP-connected now
Signalling networks originally designed for isolated operation are increasingly IP-connected. Train control, passenger information systems, and ticketing platforms can share connectivity with general IT — but carry safety-critical consequences.
Shared networks are the attack surface
Supply Chain 24/7, reporting Everstream Analytics: "Hackers are moving away from hitting individual companies and instead going after shared transportation networks." Freight booking platforms, port community systems, customs interchange systems — shared platforms with cascade reach.
Built for your situation
CIRMP cyber-hazard evidence for freight
For critical freight infrastructure and freight services assets, NodeZero maps to your chosen CIRMP cyber framework — Essential Eight, NIST CSF, ISO 27001, AESCSF or C2M2 — and gives the board factual input to the annual CIRMP report, due to CISC within 90 days of the end of the financial year. For aviation, the same testing covers the IT side of ATSA's new cyber obligations.
Segmentation validation for rail and passenger systems
Segmentation testing shows whether signalling and train control networks are isolated from corporate IT; NodeZero tests the boundary, not the signalling systems themselves. NodeZero WebApp Pentesting covers passenger-facing services and ticketing.
Platform cascade testing for logistics tech
External pentesting, cloud pentesting and NodeZero WebApp Pentesting test the shared-network attack surface Everstream Analytics flagged — TMS, WMS, freight booking, port community systems, customs platforms.
Test your cyber posture under the Transport Security Amendment Act 2025 and the CIRMP
See what an attacker could reach across your aviation, rail or freight systems