Vehicle cybersecurity protects connected vehicles, their electronic systems, software, communication networks, and user data from cyberattacks. As automobiles become more connected, digital protection has become as important as physical safety.
Modern vehicles operate more like computers on wheels, with software controlling infotainment, navigation, driver assistance, and key functions. This shift towards Software-Defined Vehicles (SDVs) is changing how automakers design and maintain vehicles.
Features such as 5G, Vehicle-to-Everything (V2X), mobile applications, and cloud services connect vehicles to the outside world. However, each connection can introduce another entry point for attackers. Vehicle cybersecurity is now a core part of automotive safety and product development.
The Expanding Attack Surface in Connected Cars
A connected vehicle relies on several systems that communicate with one another. These include telematics units, infotainment platforms, Advanced Driver Assistance Systems (ADAS), Electronic Control Units (ECUs), sensors, mobile applications, and cloud services. Links between these systems can create security gaps if automakers do not protect them properly.
Telematics units connect vehicles to mobile networks for navigation, remote diagnostics, emergency assistance, and app-based features. Infotainment systems link to smartphones and online services, while ADAS uses sensors, cameras, radar, and software for functions such as lane keeping and collision warnings.
Vehicle architecture is also changing. Rather than relying on many separate ECUs, newer designs use centralized computing platforms and zone controllers to manage multiple functions. This can simplify design, but makes network separation and access control essential. A weakness in one component should not provide a route into safety-critical systems.
The attack surface extends beyond the vehicle. Mobile apps, APIs, cloud platforms, charging infrastructure, and manufacturer systems may all interact with a car. Vehicle cybersecurity must cover this wider ecosystem, not just onboard hardware.
Top Cyber Threats Facing Modern Vehicles
Cyberattacks against vehicles can target digital services, internal networks, software updates, and the personal information collected by connected systems. The consequences range from service disruption and data theft to risks that could affect vehicle operation.
Remote Hacking and Keyless Entry Attacks
Remote attacks can exploit weaknesses in wireless communication, mobile applications, telematics services, or cloud-connected platforms. Keyless entry systems can also be targeted through relay attacks. In these cases, attackers capture and extend the signal between a vehicle and its key fob, potentially making the vehicle believe the key is nearby.
Risk varies by vehicle and system, but manufacturers still need to secure wireless interfaces, authenticate devices, and limit access.
ECU and CAN Bus Vulnerabilities
Electronic Control Units manage functions such as braking support, engine performance, steering assistance, and other vehicle operations. They communicate through in-vehicle networks such as the Controller Area Network (CAN) bus.
Some vehicle networks predate today’s connected-car threat landscape. If an attacker reaches an internal network, weak authentication or poor separation may let unauthorised messages reach other components. This does not mean every connected vehicle can be remotely controlled through a CAN bus attack. Risk depends on the vehicle architecture and the attacker’s access.
Compromised Over-the-Air Software Updates
Over-the-air (OTA) updates let automakers fix bugs and address security weaknesses without a service-centre visit. However, if attackers compromise an update server, delivery channel, or software package, they may introduce malicious code or disrupt vehicle systems.
Also Read: What Are the Top Semiconductor Manufacturing Trends in 2026 and How Are They Shaping the Future of Chip Production?
Vehicle Data Breaches and Privacy Risks
Connected vehicles collect location, driving patterns, vehicle status, and user preferences for navigation, diagnostics, and personalisation. Weak access controls or a compromised third-party platform can expose this information. Automakers must protect vehicle data throughout its lifecycle.
Upstream Security‘s 2025 Global Automotive and Smart Mobility Cybersecurity Report documented 409 new automotive and smart mobility cyber incidents in 2024, compared with 295 in 2023. It also found that telematics and application-server attacks accounted for 66% of incidents, up from 43% in the previous year. The findings underline the growing importance of securing the services and digital connections surrounding vehicles.
Core Cybersecurity Solutions for Automakers
Automakers need a layered approach. No single product can prevent every attack, so security must be built into vehicle architecture, software development, communication, monitoring, and maintenance.
Build Secure Vehicle Architecture from the Start
Security should be considered during the design stage, rather than added after a vehicle is developed. This approach, often called secure by design, requires teams to identify potential risks early and decide how systems should communicate.
Network segmentation is one important measure. It separates safety-critical systems from infotainment, telematics, and other less critical components. Access between these networks should be restricted and monitored. Hardware security modules (HSMs) and roots of trust can protect cryptographic keys and device identity.
Automakers should maintain an inventory of vehicle software and components, track versions, test systems for vulnerabilities, and plan how to respond when weaknesses are found. NHTSA’s cybersecurity guidance recommends a layered approach and highlights practices such as software asset management, vulnerability identification, and protection of vehicle systems. Its recommendations are voluntary guidance, but they offer a practical reference for manufacturers developing their security programmes.
Protect Vehicle Communication with Encryption and Authentication
Vehicles exchange information with other vehicles, roadside infrastructure, mobile devices, cloud services, and manufacturers. Encryption protects information from unauthorised viewing, while authentication helps verify trusted devices and messages.
Public Key Infrastructure (PKI) can support this process by managing digital certificates and cryptographic identities. Encryption alone is not enough. Automakers also need secure key storage, certificate renewal, access controls, and a way to revoke compromised credentials.
Use Intrusion Detection and Prevention Systems
Intrusion Detection and Prevention Systems (IDPS) can monitor vehicle networks and connected services for unusual activity. They may identify unexpected message patterns, suspicious access attempts, or changes in normal system behaviour.
AI and machine learning can analyse vehicle and fleet data, but alerts need validation. False alarms can overwhelm teams, while missed signals can leave attacks undetected. Automated monitoring should therefore include escalation procedures and human review.
Secure Over-the-Air Software Updates
OTA updates need strong controls at every stage, from software development to installation. Automakers should digitally sign update packages so vehicles can verify that software comes from an authorised source and has not been altered. Secure boot processes can help ensure that only trusted software runs when a vehicle starts.
Manufacturers should manage software versions, block unauthorised downgrades, test updates, and provide a safe recovery process. Auto-ISAC’s updated Best Practice Guides, released in April 2025, address areas including cybersecurity management, governance, third-party risk, awareness and training, and secure development. These practices support a broader approach in which update security is part of an organisation-wide cybersecurity programme.
Navigating Automotive Cybersecurity Standards and Regulations
Automotive cybersecurity standards help manufacturers build consistent processes for identifying, assessing, and managing risks. Two important frameworks are ISO/SAE 21434 and the United Nations Regulation No. 155 (UN R155).
ISO/SAE 21434 provides a framework for cybersecurity engineering across the vehicle lifecycle. It covers activities from concept and product development through production, operation, maintenance, and decommissioning. It encourages manufacturers and suppliers to identify threats, assess risks, define security measures, and manage vulnerabilities as vehicles and their software evolve. It sets out a risk-management process, not a specific technology or product.
UN R155 establishes cybersecurity management system (CSMS) requirements for vehicle manufacturers seeking type approval in jurisdictions that apply the regulation. It places emphasis on managing cybersecurity risks across vehicle development and production, as well as monitoring and responding to threats after vehicles enter service. UNECE’s 2025 implementation discussions and workshops have continued to address the practical application of UN R155 and related software-update requirements, including challenges involving multi-stage vehicles.
Together, these frameworks make cybersecurity a continuing responsibility for automakers and suppliers, not a final check before launch.
The Future of Vehicle Cybersecurity with AI and vSOCs
As connected vehicle fleets grow, automakers will need ways to monitor threats beyond individual vehicles. A vehicle Security Operations Centre (vSOC) brings together security monitoring, threat intelligence, incident response, and fleet-level visibility. It can reveal fleet-wide patterns.
AI and machine learning may strengthen these capabilities by helping teams review telemetry, prioritise alerts, and identify unusual behaviour. These tools should support, not replace, security specialists. They will also need processes to share threat information with suppliers and respond to incidents.
Looking Ahead
Connected vehicles bring new services and capabilities, but they also create new security responsibilities. Automakers must protect hardware, software, communication networks, cloud services, and customer data as one connected ecosystem. Ultimately, vehicle cybersecurity must be treated as a continuous safety and engineering priority, from the first design decisions through years of operation and software updates.
