This research focuses on enhancing cybersecurity in modern railway networks, specifically targeting vulnerabilities within the European Rail Traffic Management System (ERTMS) and European Train Control System (ETCS). As digital technologies transform railway operations, they introduce new security challenges, exemplified by recent high-profile cyberattacks. Our work centers on using penetration testing techniques to systematically identify and address these vulnerabilities. By simulating real-world attack scenarios, we expose critical weaknesses in communication systems, such as the balise transmission system (BTS), which is crucial for safe train operations. A case study on cyber incidents in Poland—where radio signal-based attacks were exploited—highlights the severe impact of these vulnerabilities. We discuss the five stages of the penetration testing process: planning, scanning, gaining and maintaining access, analysis and reporting, and remediation. The findings underscore the importance of an ongoing and iterative approach to fortifying railway cybersecurity. Finally, the presentation outlines a roadmap for developing a comprehensive risk management framework that integrates both safety and security considerations, validated through cross-simulation experiments in our lab.