Custom Truck One Source is a heavy equipment company, not a software shop - which means the threat surface looks different. The attackable surface isn't just corporate endpoints and SaaS sprawl; it's an over-10,000-unit rental fleet, more than 40 physical locations across North America, and a customer base of 3,000+ across utilities, telecom, rail, construction, forestry, and oil and gas. That's a lot of industrial control systems, telematics, and operational technology sitting alongside traditional enterprise IT. The company does over $1.8 billion in annual revenue, and every dollar touches equipment lifecycle systems - manufacturing (under the Load King brand, producing trailers, cranes, dump trucks, service trucks, and water trucks), sales, rentals, aftermarket parts and service, customization, remanufacturing, financing, and asset disposal through auctions.
The logistics are the challenge. Over 2,600 employees across a dispersed footprint handling everything from equipment customization to remanufacturing means the security team isn't just protecting a data center - it's managing risk across physical facilities, supply chain integrations, and customer-facing platforms that move heavy iron. Financing and auction operations introduce payment card data and financial records. The rental fleet generates telemetry and diagnostic data at scale. Each of these is a distinct domain with its own tooling and access control requirements.
Founded in 1996 by the Ross family out of a three-bay shop in Kansas City, Missouri, the company has scaled into a full-lifecycle equipment provider. For security practitioners, the draw is operational complexity: the environment spans manufacturing floors, field service operations, corporate systems, and a growing digital estate. The work is less about defending a perimeter and more about securing a sprawling, physically distributed operation that underpins critical infrastructure industries.
