CapMetro Turns Data Visibility into Continuous Protection with Varonis

CapMetro keeps Austin, Texas moving, providing public transportation across buses, trains, paratransit, bicycles, and rail infrastructure. Behind those services is a growing and increasingly complex technology environment with evolving data-security demands.

When John Kiczek joined CapMetro more than four years ago, the organization was still early in its cybersecurity journey. Visibility was limited, security practices were decentralized, and foundational security controls, such as MFA, were still being put in place.

An early Varonis proof of value focused on permissions and data helped demonstrate what a more data-centric approach to security could look like. “I was impressed. I thought they were a trailblazer,” said Kiczek.

Since then, Varonis has become a central part of CapMetro’s security strategy.

CHALLENGE

Keep pace with growing data security demands

As CapMetro modernized its cybersecurity program, the scope of the team’s responsibility continued to grow. The three-person cybersecurity team needed better visibility into data and activity, but with limited resources, round-the-clock security operations weren’t realistic.

We don’t have the staff to do 24-7 live. Varonis covers those dead spots. We can rest assured that someone’s always monitoring it.

Investigations also competed with proactive priorities. Every alert that required manual investigation slowed efforts to strengthen security controls, protect sensitive information, and prepare the organization for emerging technologies.

CapMetro needed a way to maintain continuous security coverage, accelerate investigation and response, and focus resources where they could have the greatest impact.

THE SOLUTION‍

Driving faster investigation and remediation

To extend its security coverage without staffing an internal team around the clock, CapMetro uses Varonis MDDR for continuous monitoring and response. When suspicious activity arises, Varonis can investigate while keeping CapMetro informed.

I’ll get an email or a notice saying that Varonis is investigating something, and 99.9% of the time it is resolved without any interaction on our behalf. That just saves so much time. It’s invaluable.

For CapMetro, that translates into additional security capacity without additional internal headcount, effectively extending the capacity of their team. “This is probably doing what a team of two or three analysts would do,” explained Kiczek.

While MDDR reduces the work required to investigate potential threats, Varonis’ automations further reduce the operational burden by addressing security findings at scale.  Some findings are remediated automatically, while others that need more business context, ownership knowledge, or explicit approvals. are reviewed by the team before remediation.  For issues such as inactive users, this gives CapMetro a more consistent path from identifying risk to reducing it.

Data Security ready for what comes next

Continuous coverage and reduced manual work help CapMetro address today’s security demands. The same data-security foundation also helps the organization adapt as its data footprint and technology environments evolve.

When CapMetro stood up its own transit police department in 2025, the organization took on new requirements to protect Criminal Justice Information Services (CJIS) data.

We have CJIS data that’s going to be on the wire that we have to really restrict. We worked with the team and set up rules as far as tagging that and knowing where it is and if it comes across the wire.

CapMetro worked with Varonis to classify that information, understand where it resides, and establish alerts to identify activity requiring attention, which plays an important role supporting the new police department. “It’s just something we couldn’t do without a tool like Varonis”.

As CapMetro takes on new technologies, that foundation is evolving again. Kiczek described Varonis as the organization’s “first step into AI,” with monitoring around Microsoft Copilot and Azure. Together, these capabilities give CapMetro a data-security foundation that can adapt as its sensitive data, technologies, and security priorities evolve.

RESULTS

More Security Coverage Without Building a 24x7 Team

With Varonis, CapMetro has extended security coverage beyond the working hours of its lean cybersecurity team while reducing the manual effort

Required to investigate and address security issues.  According to Kiczek, 99.9% of MDDR investigations are resolved without interaction from CapMetro.

The combination of continuous coverage and reduced manual work gives CapMetro more capacity to dedicate its resources where they’re needed most. Automation further reduces manual effort for security findings such as inactive users, while classification and monitoring help the organization protect sensitive CJIS data as its security requirements evolve.

For Kiczek, the impact comes down to both time and coverage.

It really takes the onus off out-of-hours support and even in hours. It frees up the team to have that amount of time, and the cost of it versus salaries for someone is no comparison.

As CapMetro’s data, technology, and security priorities continue to evolve, Varonis has become a foundational part of its security strategy.

With Varonis, CapMetro has:

• Gained 24x7 threat detection and response with MDDR
• Reduced manual effort with automated remediation and continuous policy enforcement
• Improved visibility into sensitive CJIS data
• Expanded security capacity without expanding internal headcount
• Strengthened its data-security foundation for Microsoft Copilot adoption