Fire Department CAD System Target
Most fire departments have a fire safety plan, an apparatus maintenance schedule, and a training calendar. Almost none of them have ever asked a simple question: what happens to our CAD system if someone locks us out of it?
That’s not a hypothetical anymore. It’s already happened, more than once, to real departments.
This Isn’t Theoretical
In 2024, a Kansas public safety agency had 100% of its first responder communications disrupted throughout the day. Attackers brute-forced their way into a VPN connection that didn’t have multi-factor authentication turned on, then deployed ransomware. This is documented in a joint threat report from MS-ISAC and Motorola Solutions, not a hypothetical scare story.
That’s not an isolated case. Ransomware attacks on emergency call handling systems, the CAD and 911 infrastructure that dispatches every unit you send out the door, rose from happening once every 74 days in 2024 to an average of once every 60 days in 2025, according to a separate Public Safety Threat Alliance (PSTA) report. When these attacks hit, downtime has ranged from one week to 25 days. Every emergency call handling attack the PSTA observed in 2024 and 2025 involved ransomware. Ransomware has already taken CAD systems offline in cities including Baltimore (2018) and Dallas (2023), leaving dispatchers working by voice and by hand.
Why Fire Departments Specifically
Most cybersecurity consultants have never set foot in a station. They understand servers and laptops. They don’t understand what a CAD outage actually means at 2am, why mutual aid radio interoperability matters, or how a volunteer department runs with no dedicated IT staff and a limited budget.
That gap matters. A generic small-business IT audit doesn’t ask the right questions for a fire department:
CAD and dispatch systems. Is access properly controlled? Is there MFA on remote connections? What’s the actual fallback plan if the system goes down mid-shift?
Mobile data terminals. In-apparatus MDTs often run on aging hardware, shared across crews, with whatever security posture a vendor set up years ago and nobody’s touched since.
Mutual aid interoperability. Radio and data systems that connect to neighboring departments during mutual aid calls, often without anyone clearly responsible for securing that connection.
Station network segmentation. Administrative systems, scheduling software, and personnel records frequently sit on the same network as operational systems, with no separation between them.
The Reality Most Departments Are Working With
This isn’t a knock on anyone running a department. Most fire departments, especially volunteer and combination agencies, don’t have a dedicated IT person. Whoever’s tech-savvy ends up handling network issues on top of their actual job. That means cybersecurity gets handled reactively, after something breaks, instead of reviewed proactively, before it does.
A readiness review built for fire departments has to account for that reality. It’s not a corporate security audit demanding a full-time security team and an unlimited budget. It identifies what actually matters most for a department your size, with the resources you actually have, and gives you a clear, prioritized path forward instead of a 40-page report nobody has time to read.
What This Actually Looks Like
A real fire department cyber readiness review covers:
- CAD and dispatch system access controls and fallback planning
- Mobile data terminal device management and encryption
- Mutual aid connection security
- Station network segmentation between admin and operational systems
- Personnel records security
- Ransomware readiness, including backup verification and a manual dispatch fallback plan
None of this requires a massive budget. It requires someone who actually understands both sides, the technical side and what it means to be the department running toward the call, not away from it.
Forward Security Labs offers a Fire Department Cyber Readiness Review built specifically around this reality, a fixed-price $749 review. It is built by a cybersecurity professional with 20+ years in emergency healthcare, including EMT, ER tech, paramedic, and EMS supervisor experience, not an outside vendor guessing at how emergency response actually operates.
See the Fire Department Cyber Readiness page →
Sources:
- MS-ISAC and Motorola Solutions Public Safety Threat Alliance, “Persistent Disruptive Cyber Activity Impacting U.S. Public Safety Mission-Critical Services” (June 2025)
- Motorola Solutions, “Cyber Risks to 911: The Latest PSTA Threat Report”, summarizing the PSTA’s 2025 Cyber Threats to Emergency Call Handling report (August 2025)
- CISA, Public Safety Emergency Communications ransomware resources
- Technical.ly, Baltimore 911 CAD ransomware attack (March 2018); TechCrunch, Dallas ransomware attack (May 2023)
