Public lighting tenders must adapt to AI cyber risks

Cybercriminals are already using AI to identify vulnerabilities, steal credentials and penetrate networks. For cities and utilities, this raises the stakes when choosing the software that controls public lighting.

The threat is documented. Cities and utilities are attacked every day by millions of AI-powered robots. The UK’s National Cyber Security Centre warns that AI will make cyber intrusions more efficient and accelerate the exploitation of unpatched systems. The French ANSSI security service works everyday on threat cases with French cities and public authorities.

For a connected lighting network, consider the potential consequences if an attacker gains sufficient access to the Central Management Software:

Unauthorised switching: commands sent to cabinet or light point controllers could leave streets, pedestrian crossings or junctions dark.
Altered lighting programmes: modified schedules could switch lights off during busy periods or leave them running unnecessarily.
Disrupted supervision: operators could lose visibility of faults and the ability to manage lighting remotely, delaying maintenance and recovery.

These are plausible scenarios, depending on system architecture and safeguards. They show why protecting the central platform is a public-service continuity and safety requirement. These scenarios make cybersecurity a service continuity and safety requirement… and a procurement priority.

This is why we propose giving cybersecurity its own explicit score in public lighting tenders.

The platform must first meet operational needs. But the evidence that it can be securely maintained, monitored and recovered should carry at least as much weight as its price.

Give cybersecurity its own score

When security is folded into a broad technical score, its importance can become difficult to see and easier to outweigh with a lower price. We propose an explicit evaluation model, adapted to each project:

Technical fit remains the leading criterion: the platform must meet operational needs. Cybersecurity follows, with a weight at least equal to price. Mandatory security requirements should remain pass-or-fail conditions. The cybersecurity score should then differentiate suppliers through evidence: independent testing, vulnerability management, update commitments, monitoring and recovery arrangements, and a robust ISO27001 certification which garanties that the company has implemented all measures to minimize risks.

Evaluate the software independently from the hardware

A manufacturer may deliver excellent controllers and capable software. However, hardware performance alone does not demonstrate the security maturity of the central platform.

Citylinx focuses on software only rather than manufacturing controllers. Its multi-vendor approach allows cities and utilities to select their operational platform independently, then procure compatible equipment from different suppliers.

That independence does not automatically guarantee security. It enables a stronger purchasing decision: assess the CMS against its own operational and cybersecurity requirements, rather than accepting it simply because it accompanies the hardware.

Citylinx brings verifiable commitments to that assessment: company-wide ISO 27001 certification, annual independent penetration testing, automated cloud monitoring, cloud-independence, and the possibility to run on-premise or on a sovereign secured cloud. These provide complementary evidence of security management, technical assessment and operational oversight, not a promise of immunity from attack.

Choose a deployment that fits your security policy

Citylinx can run in its managed, monitored cloud, in a sovereign cloud in your country subject to the selected provider and requirements, or on your own on-premise servers. This flexibility supports your organisation’s governance and hosting requirements.

Each option must include clear responsibilities for updates, access management, monitoring, backups and recovery. Hosting location alone is not a security guarantee.

For your next lighting tender, give cybersecurity a visible score and ask every software supplier to substantiate it.

Talk to Citylinx about your technical, cybersecurity and hosting requirements.

Building the next generation of city operations

At Citylinx, we believe the future belongs to open ecosystems where every partner can contribute its expertise while cities remain free to choose the technologies that best fit their needs.

If you are a manufacturer looking to integrate your devices into an open, multi-supplier smart city platform, we’d love to discuss how we can build the next generation of city operations together.

Let’s shape the future of smart lighting… openly.