For transportation cybersecurity, AI isn’t helping fight..so far

The presentation by James McQuiggan, the advisory chief information security officer at Apparent Security, was more an example of how the cybersecurity industry is approaching AI, seeing it as a foe rather than an asset, at least at this point.

The dark side

When McQuiggan was introduced, it was to say that “he’s going to be talking about the dark side of AI, how cybercriminals use it for their purposes.”

And that was what he spoke about, with no reference to any tools–yet–that might help the cybersecurity teams fend off intruders looking to crash a system and take it hostage.

McGuiggan made presentations of “deepfakes” stealing voices and appearances, using AI to produce the deceptions. 

“We’ve been playing around with large language models and agentic AI now for the last four plus years, and cybercriminals are doing the same thing,” McGuiggan said.

And that’s important. McGuiggan said AI can create cybersecurity vulnerabilities not just from an outsider successfully hacking a company, whether driven by AI or not, but through internal use of an AI tool that goes awry. McGuiggan referred to it as “shadow AI.”

“You know that your users are going to be leveraging AI capability,” McGuiggan said. “They want to. They’re not doing it to be malicious. They’re doing it because they want to be more efficient.”

But he added that the internal users need to be educated on the risks their use of AI in a company setting can do to raise the risks for a successful outside attack.

LinkedIn still a problem

At the 2025 edition of the NMFTA cybersecurity conference, one example of cybercriminals seeking access to a company that caught the attendees’ attention came from Todd Florence, the CIO of Estes Express, who said outside cybercriminals were setting up faked LinkedIn accounts featuring beautiful women, hoping an internal employee (presumably male) would seek to connect with them, hoping to meet them professionally…and then maybe personally.

McGuiggan’s reference to LinkedIn at this year’s conference was less lighthearted. And AI played a role.

“It’s a lot easier with agentic AI to be able to go through and collect all the information that they need overall,” he said. “Cybercriminals are going through and scraping LinkedIn, your websites, people that work at your organization.You know shippers and brokers, carriers, and if you’ve got fake ones that are being generated, you’re going to deal with a lot of fraud, deal with a lot of spoofed domains, all trying to make money.”

He contrasted the fraudulent emails that would arrive from cybercrooks just a few years ago, infamous for their frequent misspellings and bad grammar, with what is coming off an LLM today. Today’s output has eliminated those errors and is highly polished, McGuiggan said. 

“In the last couple of years, we’ve been hearing about agentic AI being able to leverage that, scheduling things for us, looking at our email and sending out responses,” McGuiggan said. Ransomware attacks are “fully leveraging AI,” he added. 

What companies are up against, McGuiggan said, is a situation where a cybercriminal can invest as much as $100,000 on a deepfake campaign, and come back with a ransom payment in the millions.

The NMFTA meeting is a relatively small gathering, but it is attended by people laser-focused on the issue. Maybe they’re with a carrier; maybe they’re providing cybersecurity services to companies trying to figure out how not to be a mark. There are a range of government officials as well. 

Melanie Padron, the vice president of strategic growth at IT Architeks, who works solely with transportation companies on cybersecurity issues, spelled out the five-point “cyber battle plan” she said IT Architeks undertakes with companies that are considering hiring their services.

Melanie Padron addresses the NMFTA cybersecurity conference.

The plan touches on points she made in her presentation, and aligns with sort of a general “call to action” that has been the self-help theme at these recent meetings.

The plan: one, clearly identify the person at a company who owns cybersecurity (which isn’t always clear); two, determine the last time there was an independent cyber risk assessment; three, determine when the most recent incident response plan was studied; four, get a “full vendor access audit”; and five, determine when the most recent “full backup restoration access audit” took place.

The last point brought an observation from Padron. 

“Do you have a new brake system for your trucks?” she asked. “Would you just trust the word, or would you test it? You test it. You inspect it. You document it. You train your drivers on it. Cybersecurity should be no different.”

Some positive AI uses on the horizon

Padron, on the sidelines of the conference, also pushed back against the idea that AI is not yet proving to be a force that will allow the forces fighting cyber crooks to push back. She said her company is reviewing several AI tools that are targeted toward the “shadow AI” issues referred to by McGuiggan. 

One of the first panels featured two individuals who are on the front lines of cybersecurity and trucking: Erica Brigance,  vice president of technology at LTL carrier ArcBest (NASDAQ: ARCB) and Florence, appearing before another NMFTA cybersecurity event.

Estes hack still is remembered

Florence is something of a rock star in the world of trucking cybersecurity, having been the chief technology official three years ago on October 1, 2023–the presentation was one day before the anniversary–when LTL carrier Estes was hit with a massive cybersecurity attack. 

The public approach by CEO Webb Estes was widely lauded as a success in being so open to the public about the company’s travails. When Estes made a public broadcast to bring his customers and others up to date on where the company’s recovery efforts stood, Florence was at his side.

Florence, speaking to FreightWaves at the conference, said he made numerous phone calls to customers during that time. And he said what surprised him were the number who said during their response some version of “when we had our cyberattack.”

“The threats are increasing, and the way that we are combating that is also changing greatly,” Brigance said. “But it’s ever present. It certainly keeps me up at night. It’s certainly the reason why, as soon as I wake up in the morning, I’m looking at my phone as well.”

More articles by John Kingston

Another aspect of Montgomery: it might make human brokers more valuable

Per diem: one approach is stable, other is higher

Daimler Truck: concerned about using cash to avoid new NoX rules