A ransomware attack on a car maker can stop a production line, and a flaw in signalling software can put a whole rail network at risk. The Upstream 2026 Global Automotive and Smart Mobility Cybersecurity Report analyzed 494 publicly reported incidents from 2025 and found that cyberattacks on the sector more than doubled in a single year. Cybersecurity for safety-critical systems has become an engineering discipline in its own right.
Safety-critical systems are products and infrastructure, such as vehicles, trains, aircraft, and industrial controls, where a failure can harm people or stop essential operations.
We spoke with Aspon Issa, Team Lead Cybersecurity at Expleo Romania, about how to protect them. He explains why these industries need a system-level view of security, how regulations raise the bar, how his team uses AI, and what Expleo brings to its first DefCamp.
Transitioning from aerospace engineering into cybersecurity
Many of the best security specialists came to the field from a different career, and Aspon’s story fits that pattern. He graduated in Aerospace Engineering and spent his first years working as an avionics and aerospace engineer, yet cybersecurity has remained a personal passion since his early twenties.
That engineering background later became an important part of how I approach cybersecurity, particularly when working with complex products and systems.
When he decided to switch careers, he did not have to change companies. Expleo backed the move from the start. That support, he says, has defined his decade at the company.
At the time, I was already working at Expleo. One thing that has stood out throughout my 10-year journey with the company is the support I received whenever I wanted to learn and take on new challenges. When I decided to transition into cybersecurity, Expleo gave me that opportunity.
Since then, I've grown from a cybersecurity engineer into leadership roles, delivering projects across railway, automotive, and OT environments. Today, I'm proud to lead the Cybersecurity team in Romania and contribute to the growth of both the team and the business. In many ways, what started as a personal passion has become a career, shaped by continuous learning and the opportunities I've had at Expleo.
30 years of Expleo in Romania, and a growing cyber team
Expleo has worked in Romania for more than 30 years, supporting customers through major technological and industrial transformations. As industries became more connected, cybersecurity grew naturally out of the company’s digital and engineering work, and demand soon called for a dedicated local team.
As demand for cybersecurity expertise continued to grow, it became clear that these capabilities were also needed closer to customers in Romania. In response to market demand, we developed a local cybersecurity team that has become an important contributor to Expleo's cybersecurity capabilities.
Today, the Romanian team combines cybersecurity expertise with a strong engineering background and deep industry knowledge, supporting customers across automotive, railway, IT, and OT environments with cybersecurity engineering, risk assessments, penetration testing, security validation, and compliance services.
Automotive has become one of the team’s strongest areas. New rules such as UNECE R155 now require car makers to prove they manage cybersecurity across the whole vehicle lifecycle. Suppliers feel the same pressure, and many turn to specialists for help.
We have also played an important role in helping automotive customers address evolving cybersecurity requirements and prepare for regulatory compliance. Through a combination of local expertise and global collaboration, the Romanian team helps customers build secure, resilient, and innovative solutions throughout their cybersecurity journey.
Why cybersecurity for safety-critical systems differs from classic IT security
In automotive, railway, aerospace, and defense, a cyber incident can reach far beyond a database. It can affect physical safety, keep operations from running, or put an entire mission at risk.
In industries such as automotive, railway, aerospace, and defense, cybersecurity is not just about protecting data. It's about protecting complex systems where a cybersecurity issue can directly impact safety, operational continuity, and mission success.
My engineering background helps me look at cybersecurity in the context of the system itself. Understanding how a product is designed, how its different components interact, and which functions are critical helps me assess where a vulnerability could have the greatest impact and what needs to be prioritized.
That is why Aspon never judges a vulnerability on its own. The same flaw can be harmless in one component and critical in another. What matters is what the system around it does and what happens if that system fails.
This becomes particularly important in complex engineering environments, where you cannot look at every vulnerability in isolation. You need to understand the system you are protecting and the potential consequences of a security issue.
This combination of engineering understanding and cybersecurity expertise is also one of Expleo's strengths. Our teams bring together cybersecurity, engineering, software and testing capabilities to help customers build more secure and resilient products and systems.
The threats and regulations shaping cybersecurity for safety-critical systems
Cars now run on millions of lines of code, trains depend on connected signaling, and factories link their production lines to the cloud. Every new connection is another door an attacker can try. The attack surface keeps growing, and so does the rulebook. For Aspon, the two trends point in the same direction: security has to be built in from the start.
One of the biggest challenges across industries such as automotive, railway, aerospace, defense, and critical infrastructure is the expanding attack surface created by connected products, software-defined systems, cloud adoption, and the convergence of IT and OT environments. At the same time, cyber threats are becoming more sophisticated, while regulations such as NIS2, CER, the Cyber Resilience Act (CRA), UNECE R155, and ISO/SAE 21434 continue to raise expectations.
Looking ahead, cybersecurity will become even more deeply embedded into engineering and digital transformation initiatives. Organizations increasingly recognize it not only as a protective function, but also as an enabler of innovation, operational resilience, and trust. As technologies evolve and connectivity expands, building secure systems by design will become a key differentiator and a business necessity.
How AI is changing cybersecurity testing
AI cuts both ways in security. Defenders use it to detect threats faster and analyze more data, while attackers use it to automate and scale their campaigns. As a result, Aspon argues that the discourse around AI has changed.
The conversation is now shifting from "How do we adopt AI?" to "How do we adopt AI responsibly and securely?" As AI becomes part of critical products and systems, topics such as security-by-design, validation, and governance become just as important as functionality.
Inside his team, AI is already part of the daily workflow. The goal is simple: hand the repetitive work to machines and free up experts for harder problems. Expleo has even built its own AI solution for the job.
Today, AI helps cybersecurity teams work faster by supporting threat analysis, vulnerability assessments, and the processing of large volumes of information. Solutions such as Expleo's ELISAR demonstrate how AI can also enhance cybersecurity risk assessments and compliance activities by helping experts analyze complex information and identify potential gaps more efficiently. This allows specialists to spend less time on repetitive tasks and more time focusing on risk, decision-making, and complex investigations.
Attackers have access to the same technology and use it to make their campaigns harder to spot. Automation alone cannot keep up with that kind of creativity. That is why people stay firmly in charge of the decisions that matter.
At the same time, AI is also being leveraged by threat actors, making cyber threats increasingly sophisticated. Human expertise therefore remains essential. Understanding context, identifying unconventional attack paths and assessing real-world business impact still require experience, creativity, and judgment. We see AI as a powerful accelerator for experts, not a replacement for them.
Expleo's first DefCamp: a Smeeta demo and a panel
Expleo invests in the next generation of Romanian talent. Through its partnership with CCSIR, the company helps Romanian students reach international learning and networking opportunities at the Global Cybersecurity Camp. This November, the team also joins DefCamp for the first time.
This year marks Expleo's first participation at DefCamp, making it a great opportunity to connect with cybersecurity professionals, customers and partners, exchange ideas and explore future collaborations. We're excited to bring Smeeta, Expleo's cyber-resilience testing platform, to DefCamp for an interactive demonstration, while our colleague Helmi Rais will join one of the panel discussions. For us, DefCamp is about innovation, partnerships, and shaping the future of cybersecurity together.
Get your DefCamp 2026 ticket and join more than 2,500 professionals from 700 organizations at the Palace of the Parliament in Bucharest on November 19 and 20.
Stop by Expleo’s interactive Smeeta demo, then join Helmi Rais, Associate Global CyberSecurity Practice Director at Expleo, at the panel “Handcuffed Defenders, Unbound Attackers: Is AI Widening the Offense-Defense Asymmetry?” on November 20, at 15:10.
Meet the interview author:
Nadine Tudor is a marketing and communications trainee at Bit Sentinel, where she especially enjoys creating social media content and visual assets. New to cybersecurity, she’s eager to keep learning and to help make complex security topics easier for everyone to understand.
