Shift5 Gets $75M for Cyber Push in Defense and Transit

A military and transportation security startup founded by a former U.S. Army captain raised $75 million to address threats to critical infrastructure and defense systems.

See Also: New Trend in Federal Cybersecurity: Streamlining Efficiency with a Holistic IT Approach

Washington D.C.-area Shift5 will use the Series C funds to aid cybersecurity and operational intelligence as adversaries exploit outdated systems that were not designed with cyberthreats in mind, said co-CTO Ronak Shah. He said the money will help scale technology, enhance analytics, expand into new markets, and improve proactive maintenance and mission-readiness through better data insights.

“We’re starting to see an incredible amount of salience when it comes to wanting to secure and harden our critical infrastructure,” Shah said. “We’re starting to see a massive increase in cyber adversaries targeting our critical infrastructure, including transportation and our nation’s weapon systems. The time, for us to be able to do that, quite frankly, probably was quite some time ago, but it’s never is too late.”

Shift5, established in 2018, employs 132 people and has raised $180.5 million of outside funding, having last completed a $33 million Series B funding extension in June 2023 led by Moore Strategic Ventures. The company is led by Josh Lospinoso, who help build hacking tools for the National Security Agency’s Tailored Access Operations, Army Cyber Command, and the Cyber National Mission Force (see: Shift5 Gets $33M to Help Safeguard Commercial Transportation).

Cyberthreats Intensify for Aviation, Maritime, Rail

Legacy weapons systems and transportation platforms were developed decades ago at a time when cybersecurity was not a design priority. These systems lack fundamental security hardening mechanisms, creating an asymmetric threat advantage for adversaries. Shift5 is building threat detection libraries, enumerating known threats, and enabling customers to hunt for unknown threats via data analytics.

“Whether it’s an oil/gas pipeline or water treatment facility, all those computers were not designed with certain cybersecurity principles,” he said. “You’ve seen a tremendous amount of investment, an entire ecosystem getting cropped up to help harden that critical infrastructure. The transportation and weapon systems space is following that same trajectory because of that asymmetric advantage I talked about.”

Shah said the Hedosophia-led Series C funding will be used to scale Shift5’s operations in the defense sector, where they already have significant traction, and to extend into commercial industries such as aviation, rail and maritime. Having technology that works in both military and civilian domains positions the company uniquely, but entry into these sectors comes with regulatory and technical complexities.

“There’s a massive application to the commercial side, whether that’s aviation, maritime or rail, and we want to continue to expand and gain more traction there,” Shah told Information Security Media Group. “These new sectors that we’re involved in have a tremendous amount of regulation that is required of our product.”

Aviation, maritime and rail rely on embedded systems and communication protocols that are often just as vulnerable as their military counterparts, but with fewer cyber protections and greater implications for public safety, Shah said. Commercial systems can be vulnerable since they lack hardened systems like those used in defense; commercial aviation, for example, often lacks hardened GPS systems.

“Commercial aviation systems may not have hardened GPS units that are able to still operate in GPS-denied or interfered environments,” Shah said. “That’s a problem that’s being felt even harder by the commercial sector.”

How Operational Data Can Help Predict Equipment Failure

GPS is critical not only for location tracking but also for timing synchronization across vehicle systems, and interfering with GPS can confuse aircraft navigation systems, throw off system clocks, and degrade mission performance. As RF interference becomes easier to conduct due to the commoditization of attack hardware, it represents a significant threat across both commercial and military domains.

“A lot of your critical systems become degraded in capability, and that’s obviously a major issue in terms of being able to complete your mission or being able to ensure safety,” Shah said.

Shah said operational data can be used to predict equipment failure, optimize maintenance cycles, and understand performance degradation before a catastrophic breakdown occurs. Unlike schedule-based maintenance, which is reactive and often inefficient, Shah said Shift5’s approach enables condition-based and predictive maintenance, resulting in lower costs, higher uptime, and better safety outcomes.

“The industry has really been on a very static schedule-based maintenance cycle,” Shah said. “What this allows you to do is to be a little more adaptive, and actually pinpoint with data, ‘What are the actual systems that we need to pay attention to before we lose a lot of uptime for those systems?'”

The primary measure of success for the Series C funding is Shift5’s ability to drive mission outcomes in the case of defense, or safety and reliability in the commercial sectors, Shah said. Instead of focusing solely on revenue growth, he said Shift5 is tracking whether their data analytics platform solves critical operational problems like security blind spots, maintenance inefficiencies, or RF interference issues.

“This data on these platforms has a tremendous amount of value to our customers in solving some of their most critical problems across cyber, RF, integrity, maintenance, compliance and a number of other use cases,” Shah said. “And so we want to ensure that our customers are seeing those outcomes getting driven by the data and the analytics that we are developing for them.”