The traditional image of a vehicle as a machine with four wheels connected to a chassis moving down the streets has become obsolete. Today’s vehicles are sophisticated and compact computers on wheels, equipped with advanced sensors, processors, and connectivity features that not only transport people and goods but also interact dynamically with their environment. More broadly encompassed by the term "mobility industry," this sector has long embraced the concept of connected vehicles that communicate with one another and with infrastructure to enhance safety, efficiency, user experience, and security. “Vehicle to everything” (V2X) is no longer an outlandish concept. Vehicle designers and stakeholders must consider communications from vehicle to infrastructure (V2I), vehicle to cloud (V2C), and vehicle to other external entities to guarantee the secure communication of transmitted messages.
Alongside connectivity, the rise of shared mobility services and the rapid development of autonomous driving technologies are reshaping how people think about transportation. These innovations are driving a profound transformation in the industry, shifting the focus from purely mechanical engineering to software-driven ecosystems that prioritize sustainability, personalization, efficiency, and new business models. As digitalization and automation converge, the automotive landscape is evolving into a complex and interconnected network that challenges traditional paradigms and opens new mobility frontiers worldwide. In this complex connected ecosystem, protection against cyberattacks has become increasingly critical.
Beyond Regulation and Certification
In July 2024, the United Nations Economic Commission for Europe (UNECE) regulation R155 made it mandatory for all original equipment manufacturers (OEMs) to obtain vehicle homologation.1 Automakers now must demonstrate that their vehicles are developed under a structured cybersecurity management system (CSMS). This requirement significantly raises the importance of defining a CSMS and demands well-structured and approvable processes and products from both automakers and their suppliers. Given that many of these enterprises previously lacked mature cybersecurity standards and principles, it is clear that a majority pursue compliance or certification primarily as a marketing tool rather than from a genuine desire to integrate security practices. Consequently, many fail to fully embed cybersecurity into their development processes.
The automotive industry and cybersecurity experts must embrace certain principles to improve the resilience and protection of connected vehicles. In addition, automotive cybersecurity experts require some key skills and qualities. They must be not only skilled in traditional IT security but also deeply knowledgeable about the unique complexities of automotive systems. Unlike conventional IT environments, vehicle cybersecurity cannot be effectively addressed by generic IT security solutions alone. The automotive ecosystem involves intricate hardware–software integration, real-time communication networks, embedded systems, and safety-critical components that require specialized understanding. To truly excel as an automotive cybersecurity expert, one must possess comprehensive knowledge of how vehicles are designed, manufactured, and brought to market. This includes familiarity with the entire supply chain, from component sourcing and production processes to software development; various standards and processes; vehicle assembly and continuous after-sale monitoring; and vehicle security operations center (SOC) processes. Understanding these aspects is essential because vulnerabilities can arise at any stage, and effective security measures must be integrated throughout the vehicle’s life cycle.
Moreover, automotive cybersecurity professionals must be adept at navigating the regulatory landscape and keep up to date on industry standards and emerging technologies such as connected and autonomous vehicles and the role of artificial intelligence (AI) in this industry. Their expertise ensures that security solutions are tailored to protect not only the vehicle’s internal systems but also its communications with external networks, infrastructure, cloud services, grid powers, pedestrians, and digital devices.
Examining Automotive Cyberattacks
A 2025 report found that 65% of the cyberattacks against the automotive industry in 2024 were performed by black-hat hackers. In addition, attacks against telematics and application servers increased from 43% in 2023 to 66% in 2024 (figure 1).2
Different attack vectors require different mitigation strategies. For example, attacks targeting controlled area network (CAN) buses (2% of attacks) and electronic control units (ECUs; 8% of attacks) are primarily internal threats that can be mitigated by enhancing security measures on the vehicle’s internal boards and ECUs. This could include implementing message authentication codes (MACs), secure boot mechanisms, and encrypted communication protocols within the CAN bus. In contrast, attacks related to third-party services (5% of attacks) occur outside the vehicle and require adjustments in the vehicle’s supply chain management, including thorough performance reviews and security assessments of third-party providers.
It is important to note that the security measures applied within a single ECU are quite different from those needed to protect the entire vehicle architecture or the whole ecosystem and the surrounding environment. The latter must defend against cyberattacks originating from external interfaces, such as attacks targeting the servers of the enterprises managing vehicle services.
Multilayered Solutions to Automotive Cybersecurity
Enterprises must actively develop and prepare their personnel by building the key competencies essential for automotive cybersecurity. Beyond complying with any applicable standards or regulations related to their products and processes, automotive enterprises should ensure that their teams possess the fundamental skills and knowledge that underlie effective security practices.
Unlike conventional IT environments, vehicle cybersecurity cannot be effectively addressed by generic IT security solutions alone.To help the automotive industry improve its resilience and strengthen the internal security of its members, the following recommendations cover a number of critical areas and actionable steps.
Adopt a Risk-Based Approach
A comprehensive risk-based approach is recommended for the development of vehicles and their internal systems. This approach should guide the entire vehicle life cycle—development, production, and operation—through a structured, traceable process. This process should not only align with standards and regulations in the automotive sector but also support the development team’s ability to predict and plan security measures in advance and then implement, verify, integrate, and validate all security measures. Threat analysis and risk assessment (TARA), as outlined in International Organization for Standardization (ISO)/Society of Automotive Engineers (SAE) 21434:2021, is one of the main deliverables.3 This activity is performed at the vehicle level and then defines the security goals for subsequent systems. Knowledge of threats at the vehicle level can support an efficient TARA and consequently ensure a more secure and robust approach to other development activities and mitigate risk proactively.
TARA can also impact the supply chain. By identifying assets, highlighting potential vulnerabilities, and presenting an attack tree analysis, TARA simulates potential attacks on the supply chain from an attacker’s point of view. Knowing which chain is vulnerable means that it can be improved or even replaced with a more secure alternative.
In addition, adopting a risk-based approach at the organizational level—with strong commitment from top management—and applying it throughout the system development process can play a crucial role in creating secure automotive products. Maintaining this risk-based approach both at the organizational level and during product development not only improves the security of the final product but also saves time and resources when seeking compliance with industry standards and regulations.
Apply Quality Standards and Best Practices
Quality standards should be applied throughout the enterprise during development, operation, and manufacturing activities. Security thrives in a well-organized ecosystem; a secure product cannot be produced in a chaotic environment. Best practices play an important role in creating and promoting a secure life cycle in the automotive sector. The ability to trace requirements from the system level to the software and hardware level supports every action that follows. Extracting the functional system requirements from security objectives; deriving hardware and software requirements from system requirements; identifying the security requirements at the system, software, and hardware levels; performing and implementing each requirement at the code level; and maintaining the full bidirectional traceability of all these steps are vital.
Acquire Knowledge of Automotive-Specific Attack Vectors
It is crucial that cybersecurity experts in the automotive industry have comprehensive knowledge of industry-specific attack vectors. For example, the attack vectors identified in figure 1 can pinpoint the areas that require proficiency and expertise. Further, knowledge of vehicle architecture, software development, common debuggers and compilers for different microcontrollers, and prevalent practices related to integration and testing methodology can help identify attack surfaces and proactively mitigate risk. Cybersecurity in the automotive industry must address a combination of IT and OT. Beyond the vehicle itself, cybersecurity experts work with traditional IT components such as security information and event management (SIEM) systems, SOCs, servers, and related infrastructure. In contrast, in-vehicle security requires specialized knowledge of vehicle networks and communication protocols such as CAN. Penetration testing and fuzz testing using specialized tools are essential to identify vulnerabilities. Additionally, automotive systems use specific microcontrollers designed to securely store cryptographic keys and perform security operations. Vehicles also employ various architectural designs, such as zonal or domain architecture. Each architecture type presents unique security challenges that can significantly impact the vehicle’s overall security. To ensure a broader understanding of attack surfaces, considering the entire ecosystem is fundamental.
Form a Comprehensive Understanding of Regulations and Standards
It is critical to stay up to date with relevant regulations (e.g., UNECE R155/156, ISO/SAE 21434) and ensure compliance with all legal and safety requirements. Some automotive regulations vary depending on which sector of the supply chain an organization operates in and its location. It is crucial to understand which regulations are relevant to ensure full compliance. For example, if an enterprise handles sensitive data and personally identifiable information (PII) in the European Union, the General Data Protection Regulation (GDPR) applies.4 If it is involved in vehicle development and manufacturing in China, compliance with standards such as GB 44495 is mandatory.5
Similarly, enterprises operating in the United States that plan to integrate software or hardware into vehicles, or that provide software or hardware for automakers, must be aware of new regulations restricting the use of software developed in certain countries starting in 2027, with hardware restrictions following in 2030.6 This means that automotive suppliers must stay informed of regional regulatory requirements to ensure that their products comply with local laws.
Beyond regional differences, the primary goal of all regulations and standards is to ensure the delivery of a safe, secure, and reliable final product that allows people to travel safely on the roads. Despite variations, many standards share fundamental requirements. By adopting these shared principles early, enterprises can save time and resources, streamline their compliance efforts, and accelerate the compliance and certification process. Having a clear understanding of applicable regulations by region and sector, combined with a focus on core safety and security principles, is essential for success in the global automotive industry.
Maintain Threat Intelligence and Attack-Type Awareness
Continuously monitor and analyze emerging threats and attack techniques specific to the automotive sector to proactively defend against new vulnerabilities. Having a deep understanding of the common attack types, as well as the tactics, techniques, and procedures (TTPs) used by attackers in the automotive industry, is crucial. This knowledge facilitates the identification of potential vulnerabilities and attack surfaces early on by conducting a TARA. Proactively anticipating how attackers might target systems enhances the ability to design stronger defenses and ultimately deliver a more secure and resilient final product.
Institute API Security Management
APIs are weak points in the security chain of most enterprises. As indicated in figure 1, APIs rank second among attack vectors in the automotive industry. Security experts require in-depth knowledge of API security and best practices applicable to the development and deployment of APIs.
Understand Vehicle Communication Protocols and Security Implications
A foundation of automotive cybersecurity expertise is a thorough understanding of vehicle architecture and communication protocols. Modern vehicles still rely heavily on protocols such as CAN, Local Interconnect Network (LIN), and Media-Oriented Systems Transport (MOST) for communication between ECUs.
CAN is a widely used protocol for message exchange among ECUs. This protocol was not initially designed with robust security features, making it vulnerable to various types of attacks in today's threat landscape.7 Therefore, understanding CAN protocol vulnerabilities and strategies to ensure secure communication within a vehicle's architecture is essential. These strategies may include implementing intrusion detection systems, message authentication, and encryption techniques.8
Knowledge of Unified Diagnostic Services (UDS) is also indispensable, as it is used for vehicle diagnostics and maintenance. However, its design and typical network configurations can expose critical security vulnerabilities. Addressing these vulnerabilities requires improving authentication mechanisms, securing gateway configurations, and adopting advanced certificate management to protect connected and autonomous vehicles from sophisticated attacks.
Learn About Business Models in the Automotive Industry
Having a solid understanding of the various business models within the automotive industry is essential for anyone aiming to develop expertise in automotive security. Different segments of the industry have distinct security requirements and challenges, so knowledge of these differences helps newcomers focus their efforts to gain relevant experience.
For example, working in a tier 1 supplier that manufactures ECUs for critical components such as e-shifters or braking systems involves a strong focus on embedded systems, real-time software development, and in-vehicle communication protocols. Security efforts in this case prioritize protecting the vehicle’s internal network and ensuring the safety and reliability of hardware and software components.
In contrast, an enterprise managing a shared vehicle service portal operates in a different domain where web application security, privacy, and data protection are paramount. Here, the focus shifts toward safeguarding user data, complying with privacy regulations, and securing cloud-based services.
Understanding these distinct business models allows security professionals to tailor their skills and approaches, ensuring that they meet the specific needs and compliance requirements of their sector of the automotive ecosystem.
Conclusion
A comprehensive, secure approach to vehicle production has many critical elements. It is important to understand vehicle architecture and each domain within the vehicle. Connected vehicles and digitalization are not merely buzzwords; they represent fundamental shifts that significantly influence the role of cybersecurity professionals in the automotive industry. For anyone preparing to enter this field, a deep understanding of vehicle systems, communication protocols, and regulatory landscapes is essential.
To strengthen resilience, automotive enterprises must adopt a multilayered approach, starting with a risk-based mindset, applying recognized standards and best practices, maintaining requirement traceability across system, software, and hardware levels, and staying informed of attack vectors and emerging threats. As the industry evolves, continuous learning, collaboration across departments, and aligning security with business models will be key to success. Those entering the field should see cybersecurity not as a static checklist, but as a dynamic, integral part of modern automotive innovation.
Endnotes
1
United Nations Economic Commission for Europe, UN Regulation No. 155-Cyber security and cyber security management system, 2021
2 Upstream Security, "2025 Automotive & Smart Mobility Global Cybersecurity Report," 11 February 2025
3 International Organization for Standardization (ISO), Society of Automotive Engineers (SAE), Technical Committee on Electrical and Electronic Components and General System Aspects (ISO/TC 22/SC 32), ISO/SAE 21434:2021 Road vehicles—Cybersecurity engineering, 2021
4 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR])
5 State Administration for Market Regulation, Standardization Administration of the People’s Republic of China, GB 44495 Technical Requirements for Vehicle Cybersecurity
6 US Department of Commerce Bureau of Industry and Security, “15 CFR Part 791, Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles,” Federal Register, vol. 90, iss. 10, 2025
7 Raghavan, S.S.; "CAN Bus Security: The Unseen Cybersecurity Battle in Connected Vehicles," TechLatest, 24 March 2025
8 Karrouchi, M.; Rhiat, M.; et al.; “Analysis of Current Attacks on the CAN Bus and Development of a New Solution to Detect These Types of Malicious Threats,” E3S Web of Conferences, 2023
Soheil Nazem
Is an operational technology (OT) cybersecurity auditor at UL Solutions, specializing in automotive security and industrial automation and control systems (IACS) security. His journey in security began in the automotive sector and later expanded to encompass other industries within the OT and industrial sectors. Prior to his current role, Nazem led the OT Cybersecurity Expertise Center at Capgemini Engineering Italy, driving advanced security initiatives in OT environments. His expertise ensures robust and compliant security solutions in complex, connected ecosystems in automotive and IACS sectors.
