Which identities touched the railroad last night?
The adversaries probing critical infrastructure do not break in. They log in, with valid credentials, and wait. CINQUE learns what normal looks like for every identity across the enterprise, the yard, and the operations network.
Every other ledger gets reconciled.
Access does not.
Entitlement is asserted in your role model; behavior is the only proof. CINQUE reads all five control points together and shows where the two disagree.
| Persona | Entitled, per RBAC | Observed, per CINQUE | Variance |
|---|---|---|---|
| Wayside vendor tech | Signal telemetry only | Dispatch path reached | BOUNDARY CROSSED |
| Crew-ops service account | Crew boards, batch window | New scopes, off-window | SCOPE DRIFT |
| Engineering contractor | Read asset drawings | Read and bulk export | NEW EXPORT PATH |
| Maintenance AI agent | Recommend work orders | Recommend and create | FOUR-EYES BREAK |
| PTC back-office feed | Position reports, continuous | Position reports, continuous | RECONCILED |
Detection tells you what happened. Context tells you whether it was supposed to happen.
Four places railroads point it first.
The IT/OT boundary
Who, or what, is crossing from corporate toward dispatch, signaling, and PTC.
Vendors and contractors
What contracted identities actually touched, on the operations network and beyond it.
Non-human identities
Service accounts, Shadow AI, and the agents entering rail workflows, each baselined as a persona of its own.
Reporting readiness
When a risk is real, the full journey is attached: the story a 24-hour incident report needs.
TSA asks whether the controls work.
Show how access is actually used.
TSA's rail directives (SD 1580/82-2022-01 series) require segmentation, access control, continuous monitoring and detection, and patching, under a plan assessed annually.
CINQUE for Rail & Transportation security leaders
Which identities touched the railroad last night? The ledger a railroad never balances: access. Entitled versus observed across the enterprise, the yard, and the operations network.
- Who, or what, is crossing from corporate toward dispatch, signaling, and PTC
- Vendors and contractors: what they actually touched on the operations network
- Service accounts, Shadow AI, and agents in rail workflows, each baselined
- The full journey attached when a risk is real: what a 24-hour incident report needs (TSA SD 1580/82-2022-01)
Your data, handled like we mean it. You choose the export: limited, point-in-time, analyzed in an isolated environment, and deleted after your readout. Ask us for the data-handling summary; we are a security company and we expect the question.