Why Your Fire Department's CAD System Is a Target

# Why Your Fire Department’s CAD System Is a Bigger Target Than You Think

Most fire departments have a fire safety plan, an apparatus maintenance schedule, and a training calendar. Almost none of them have ever asked a simple question: what happens to our CAD system if someone locks us out of it?

That’s not a hypothetical anymore. It’s already happened, more than once, to real departments.

## This Isn’t Theoretical

In 2024, a public safety agency had 100% of its first responder communications knocked out. Attackers brute-forced their way into a VPN connection that didn’t have multi-factor authentication turned on, then deployed ransomware. The department lost its dispatch capability entirely. This is documented in a joint threat report from MS-ISAC and Motorola Solutions, not a hypothetical scare story.

That’s not an isolated case. Ransomware attacks on emergency call handling systems, the CAD and 911 infrastructure that dispatches every unit you send out the door, rose from happening once every 74 days in 2024 to once every 60 days in 2025. When these attacks hit, downtime has ranged from one week to 25 days. Every single confirmed cyberattack on U.S. emergency call handling systems in 2024 and 2025 involved ransomware. CISA has publicly documented departments getting forced back to manual, paper dispatch because their systems were down.

## Why Fire Departments Specifically

Most cybersecurity consultants have never set foot in a station. They understand servers and laptops. They don’t understand what a CAD outage actually means at 2am, why mutual aid radio interoperability matters, or how a volunteer department runs with no dedicated IT staff and a limited budget.

That gap matters. A generic small-business IT audit doesn’t ask the right questions for a fire department:

**CAD and dispatch systems.** Is access properly controlled? Is there MFA on remote connections? What’s the actual fallback plan if the system goes down mid-shift?

**Mobile data terminals.** In-apparatus MDTs often run on aging hardware, shared across crews, with whatever security posture a vendor set up years ago and nobody’s touched since.

**Mutual aid interoperability.** Radio and data systems that connect to neighboring departments during mutual aid calls, often without anyone clearly responsible for securing that connection.

**Station network segmentation.** Administrative systems, scheduling software, and personnel records frequently sit on the same network as operational systems, with no separation between them.

## The Reality Most Departments Are Working With

This isn’t a knock on anyone running a department. Most fire departments, especially volunteer and combination agencies, don’t have a dedicated IT person. Whoever’s tech-savvy ends up handling network issues on top of their actual job. That means cybersecurity gets handled reactively, after something breaks, instead of reviewed proactively, before it does.

A readiness review built for fire departments has to account for that reality. It’s not a corporate security audit demanding a full-time security team and an unlimited budget. It identifies what actually matters most for a department your size, with the resources you actually have, and gives you a clear, prioritized path forward instead of a 40-page report nobody has time to read.

## What This Actually Looks Like

A real fire department cyber readiness review covers:

– CAD and dispatch system access controls and fallback planning
– Mobile data terminal device management and encryption
– Mutual aid connection security
– Station network segmentation between admin and operational systems
– Personnel records security
– Ransomware readiness, including backup verification and a manual dispatch fallback plan

None of this requires a massive budget. It requires someone who actually understands both sides, the technical side and what it means to be the department running toward the call, not away from it.

—

**Forward Security Labs runs a Fire Department Cyber Readiness Assessment built specifically around this reality**, starting at $749. Built by a working volunteer firefighter and cybersecurity professional, not an outside vendor guessing at how a firehouse actually operates.

[See the Fire Department Cyber Readiness page →](https://forwardsecuritylabs.com/fire-department-cyber-readiness/)

—

**Sources:**
– MS-ISAC and Motorola Solutions, “Persistent Disruptive Cyber Activity Impacting U.S. Public Safety” (June 2025)
– CISA, public advisories on ransomware disrupting police department and 911 call center operations