Resources Categories

Back

INDUSTRY FACT FILE · RAILWAYS, METRO & SURFACE TRANSPORT

Main Products and Services in Railways, Metro and Surface Transport

What India's rail, metro, bus, tolling and transit technology organisations deliver, the operational, ticketing, enterprise and supplier systems behind each service, and where those systems create cybersecurity, safety and compliance exposure.

In this document

1. How transport organisations earn and fund their services

2. Products and services by organisation type

3. The operational layer: signalling, control, communications and fleets

4. The commercial layer: ticketing, fare collection, tolling and passenger platforms

5. The systems behind the products and services

6. Trends that change the attack surface

7. Mapping operations to Codec Networks engagements

1. How transport organisations earn and fund their services

Revenue stream	How it works	Security relevance
Passenger fares	Reserved and unreserved rail tickets, metro fares, bus tickets through counters, apps, cards and agents	Platform uptime at peak, bot and fraud resistance, payment security, passenger data
Freight and parcel	Freight contracts, terminals and the freight operations information system	FOIS integrity, customer portals, e-way bill and GST integrations
Toll and user fees	FASTag/NETC collection at plazas, annual passes, concession revenue	Plaza system availability, settlement integrity, acquiring and issuing rules
Non-fare revenue	Advertising, retail, property development, catering, station facilities	Partner integrations, digital signage, PoS and Wi-Fi
Government funding and viability support	Budgetary support, Centre–state equity, viability gap funding	Project data, procurement integrity, audit and parliamentary scrutiny
Technology and services	Ticketing commissions, AFC, telematics, ITS and app services sold to operators	Customer contracts, secure SDLC, data processing obligations

2. Products and services by organisation type

Organisation type	Main products and services	Key systems
Indian Railways	Passenger and freight trains, stations, parcel, suburban services	Interlocking, Kavach, traffic management, traction SCADA, crew and train management, station systems
Railway PSUs	Ticketing and catering (IRCTC), core applications (CRIS), telecom and Wi-Fi (RailTel), corridors and construction	PRS, UTS, FOIS, NTES, IRCTC web and app, railway data centres, telecom backbone
Metro and RRTS corporations	Urban and regional rail services, stations, property	CBTC, OCC, SCADA, AFC gates and NCMC, passenger information, CCTV, depot systems
State transport undertakings	Inter-city and city buses, depots, passes	Electronic ticketing machines, online booking, vehicle tracking, depot ERP
Tolling operators	Toll collection, plaza operations, annual passes	Plaza lane systems, RFID readers, NETC acquiring, settlement and reconciliation
Ticketing and transit technology	Booking apps, AFC, ITS, telematics, MaaS	Customer-facing apps and APIs, payment gateways, cloud back ends, device fleets

3. The operational layer: signalling, control, communications and fleets

Trains are kept apart and moving by signalling and control systems: electronic and relay interlocking at stations, the indigenous Kavach automatic train protection system approved by RDSO (version 4.0 in July 2024 and now being commissioned corridor by corridor), communications-based train control on metro lines, centralised traffic control and operations control centres, and SCADA for traction power and station services. These systems have safety cases, long lives and specialist OEMs who maintain them, often through remote diagnostic connections and maintenance laptops. Train radio and telecom networks, GPS-based tracking, passenger information displays, public address and CCTV connect the control room to drivers, stations and crowds.

Fleets add another layer. Rolling stock carries on-board control and diagnostic networks; depots run maintenance management and SCADA; state transport buses carry AIS 140 tracking devices and electronic ticketing machines reporting to state monitoring centres; and crew, driver and loco pilot apps carry operational information such as speed restrictions, work zones and rosters. Denmark's 2022 stoppage showed that when a supplier's driver app fails, the operator's safety rules can stop the service even though the signalling is untouched.

4. The commercial layer: ticketing, fare collection, tolling and passenger platforms

The commercial layer is where most passengers meet the operator. The passenger reservation system and unreserved ticketing system built by CRIS serve counters, IRCTC's website and app and authorised partners; around 89 per cent of reserved tickets are now booked online, with launch-time demand for popular trains creating the conditions for bots and scalping. Metros run automatic fare collection with tokens, cards, QR tickets and the RuPay National Common Mobility Card; buses sell through ticketing machines and apps; and highway tolling runs through FASTag on the NPCI NETC network, with acquiring banks, issuers and concessionaires settling daily.

Behind these sit payment gateways, tokenisation services, loyalty and refund workflows, call centres, enterprise ERP, HR and email, cloud hosting and a growing set of passenger data—identity documents for reserved travel, card and wallet tokens, travel histories and CCTV footage—that the DPDP Act and Rules will govern from May 2027.

Highest-risk moments

Launch-time ticket sales and festive peaks, OEM remote sessions into interlocking, Kavach or CBTC maintenance systems, contractor laptops in relay rooms and depots, changes to passenger information and PA content, settlement bank-detail changes at toll operators, supplier app outages and the first minutes of a station network incident are where transport incidents typically begin or escalate.

5. The systems behind the products and services

Title: Figure 2: Where cyber risk sits across the rail and surface transport value chain. - Description: Figure 2: Where cyber risk sits across the rail and surface transport value chain.

Figure 2: Where cyber risk sits across the rail and surface transport value chain.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Plan and build	Design and BIM data, contractor systems, project ERP	Data protection, contractor security, payment fraud controls
Signal and control	Interlocking, Kavach, CBTC, OCC, traffic management, traction SCADA	OT assessment, segmentation, OEM access, OT monitoring
Operate and maintain	Rolling stock networks, depots, driver and crew apps, telecom, GPS	Supplier criticality, fallbacks, radio and telecom security
Sell and ticket	PRS, UTS, IRCTC, AFC, NCMC, bus ticketing, FASTag/NETC	API and app testing, bot and fraud controls, PCI DSS, tokenisation
Serve and inform	Displays, PA, apps, call centres, station Wi-Fi, CCTV	Content control, segregation, privacy, crisis communication
Enterprise and data	ERP, HR, email, cloud, passenger data stores	EDR, backups, identity, SOC, DPDP

6. Trends that change the attack surface

Trend	What is changing	Security implication
Kavach and signalling modernisation	Nationwide Kavach 4.0 rollout, electronic interlocking, CBTC on new metro lines	More networked safety systems and OEM connections to secure
Platform-scale ticketing	Online share rising; apps, QR and NCMC replacing counters	Bot, fraud and availability risk at national scale
Electronic tolling and passes	FASTag on all lanes, annual passes, moves towards barrier-free tolling	Settlement integrity and roadside device exposure
Connected fleets	AIS 140 tracking, telematics, electric bus charging and depot systems	Fleet IoT and state monitoring centres as targets
Supplier-delivered operations	Driver apps, AFC, telecom and maintenance run by vendors	Supplier outages and access as operational risk
Regulatory formalisation	CERT-In audit guidelines, NCIIPC notifications, DPDP	Independent audits that include OT and privacy

7. Mapping operations to Codec Networks engagements

If the organisation operates…	Recommended starting engagement
Signalling, Kavach, CBTC or an operations control centre	OT architecture assessment, segmentation design, OEM access controls
Ticketing, AFC, toll or passenger apps and APIs	Application and API security testing, bot and fraud resistance, PCI DSS readiness
Train radio, telecom, passenger information and station networks	Communications and station network security review
Fleets with telematics, ticketing machines or depot systems	Fleet IoT and depot security assessment, backups
Critical suppliers holding remote access or hosting operational apps	Third-party access programme, supplier criticality mapping, joint exercises
Passenger data across apps, cards and CCTV	DPDP programme, data mapping, breach readiness

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by operator and line.