SHIFT5

A small box, bolted into a very big problem

Somewhere over a training range, an F-16 is having a private conversation. Its avionics, its sensors, its flight controls - all chatting across a data bus standard first written in 1973, long before anyone worried that the machine could be lied to. For most of aviation history, no one was on the line. Shift5 is the company that finally picked up.

In 2026, Shift5 is no longer the scrappy idea three Army cyber officers sketched out. It is the company the Pentagon calls when it wants to know what the vehicle itself is saying - and several of America's largest passenger railroads call for the same reason. The pitch fits on a business card: operational intelligence for every vehicle, every fleet, every mission. The execution fits inside a ruggedized device the size of a lunchbox.

The genius is almost annoyingly simple. Shift5 does not ask a 40-year-old weapon system to behave like a modern laptop. It just plugs into the wiring already there, reads the raw serial-bus and radio-frequency traffic, and makes sense of it. No rip-and-replace. No begging a defense program office for a decade-long upgrade. The data was always free. Somebody just had to bother collecting it.

The most connected machines on earth were flying blind

Here is the uncomfortable fact the founders kept running into. A modern fighter jet, a freight locomotive, a naval vessel - these are not single machines. They are dozens of computers wired together, exchanging millions of messages a trip. And almost none of those internal networks were ever designed to be monitored, let alone defended. The security industry spent thirty years protecting the office network. The vehicle network, where the actual mission lives, got nothing.

It gets worse, which is to say more interesting. The same blindness that lets a cyber intrusion slip by also hides the early tremor of a mechanical failure. A bus that no one reads cannot warn you about an attacker, and it cannot warn you that a part is about to quit. One blind spot, two expensive ways to get hurt. Shift5's bet was that you could fix both with the same data - if anyone finally decided to read it.

Three people who already knew how to break in

Shift5's founders did not theorize about weapon-system vulnerabilities. They found them. Josh Lospinoso, Michael Weigand, and James Correnti were among the people who stood up U.S. Army Cyber Command and ran some of the first modern cyber assessments of military platforms. Before that, Lospinoso built elite tooling for the NSA's Tailored Access Operations and co-founded RedOwl Analytics, an insider-threat company Raytheon bought in 2017.

So when they argued that planes and trains were dangerously readable, they were not guessing. They had done the reading. The bet they placed in 2018 was that the defensive version of that work - watching the bus instead of exploiting it - would matter to a lot more than the military. A locomotive and a fighter jet, it turns out, have the same fundamental problem. Different vehicle, identical blind spot.

One feed. Four very different answers.

Plug the Shift5 device into a vehicle's bus and it starts collecting everything - the serial-bus traffic, the RF environment, the GPS signal. From that single, unglamorous stream of bits, the platform produces four different products that would normally require four different vendors. The clever part is not any one of them. It is that they all come from the same wire.

The money followed the deployments

Skeptics are right to ask whether defense-tech narratives ever survive contact with a budget. Here the numbers do most of the talking. Across four years the funding climbed from a $20M Series A to a $75M Series C, with Insight Partners, Booz Allen Ventures, 645 Ventures, Moore Strategic Ventures and finally Hedosophia all putting money in. Over the year before that Series C, Shift5 says vehicle deployments more than doubled and headcount grew roughly 40%.

The customer list is the other receipt. Shift5 supports the U.S. Army, Navy, Air Force, Space Force, and Special Operations Command, with concrete programs like a MIL-STD-1553 databus upgrade for the F-16 (worth up to $9.9M) and configuration work on Army combat vehicles through the RCCTO. On the commercial side, several of the largest U.S. passenger rail systems run the same platform - the rare defense product that also rides a commuter train.

"Forged in America. For America."

Shift5 wears its motive plainly, which is refreshing in an industry fond of euphemism. The stated mission is operational intelligence for defense and transportation - protecting the servicemembers who fly the jets and the commuters who ride the trains, by reading the data those machines already produce. The three internal values are equally blunt: mission-first, relentless innovation, data-driven precision. You can argue with the marketing, but it is hard to argue with the premise that a machine carrying people should be allowed to explain itself.

There is an obvious tension in a company that is both a Silicon-Valley-style venture bet and a defense supplier, and Shift5 does not pretend otherwise. Its leadership frames the goal as a "generational company - one that can do well and do good." Whether those two things stay aligned is the question every dual-use company eventually has to answer. For now, the alignment is doing the heavy lifting: the safety feature and the security feature and the maintenance feature are, conveniently, the same product.

The blind spot is closing

As fleets get more autonomous and more contested - drones, autonomous logistics, GPS-denied environments - the vehicle network stops being a back-office concern and becomes the front line. A spoofed GPS signal or a tampered bus message is not a data breach. It is a navigation failure at altitude. The argument Shift5 has been making since 2018 is about to get a lot less theoretical, and a lot more crowded with competitors who suddenly agree.

Return to that F-16 over the range. The conversation across its data bus has not changed - the same dialect, the same forty-year-old standard, the same millions of messages a sortie. What changed is that someone is finally on the line, parsing every word in real time, ready to flag the lie or the looming failure before the pilot ever feels it. The machine was always talking. Shift5's whole business is the unglamorous, slightly overdue act of listening.