Cybersecurity for automotive
Vehicles with dozens of ECUs, telematics, over-the-air updates, connected services, and charging infrastructure.
Every variant, every supplier, for the life of the vehicle.
A modern vehicle carries dozens of connected control units, a telematics unit, over-the-air updates and a backend that talks to the whole fleet. Cybersecurity is therefore part of type approval: UN R155 requires a certified cybersecurity management system and evidence for each vehicle type that risks were assessed and treated. UN R156 adds the same for software updates. In the EU both apply to all new vehicles since July 2024.
The work does not stop at the vehicle manufacturer. Requirements flow down to every supplier through contracts and cybersecurity interface agreements, and ISO/SAE 21434 is the engineering standard everyone uses to show they have been met. We help OEMs and suppliers build that evidence once, reuse it across variants and keep it current after start of production.
Who it is for
- Vehicle manufacturers and their product security teams
- Tier 1 and Tier 2 suppliers of control units, sensors and software
- Makers of telematics, infotainment and connectivity units
- Manufacturers of charging equipment and aftermarket devices
Where vehicles are exposed today
The attack paths that matter most for vehicles, their backends and the infrastructure around them.
Access
Keyless entry
Relay attacks extend the signal of the key and remain a common way to open and start vehicles.
In-vehicle network
CAN injection
Thieves reach the vehicle bus through exposed wiring and send forged messages, publicly documented in 2023.
Backend
Connected services and APIs
Vulnerabilities in connected-car backends and apps have exposed vehicles of many brands at once.
Connectivity
Telematics and infotainment
Units with cellular, Wi-Fi and Bluetooth interfaces can be reached from outside the vehicle.
Charging
Chargers and charging protocols
Charging stations have been attacked successfully at Pwn2Own Automotive every year since 2024.
Updates
Over-the-air updates
An update channel that is not protected end to end can carry malicious software to a whole fleet.
Supply chain
Third-party software
Open-source and supplier components bring known vulnerabilities into control units nobody on the team wrote.
Lifetime
Long time on the road
Vehicles stay in use far longer than their software was designed for, while new vulnerabilities appear every week.
When it went wrong
Three documented cases from the automotive industry. They show that the risk sits in the vehicle, in the supplier network and in the software that runs the business.
July 2015, vehicle hack
Jeep Cherokee: remote access over the cellular network
Security researchers showed that they could reach a Jeep Cherokee through the cellular connection of its infotainment unit and send commands to driving functions, from miles away.
Impact
Fiat Chrysler recalled about 1.4 million vehicles for a software update, and the mobile network provider blocked the open port. The case is widely seen as a turning point for vehicle cybersecurity regulation such as UN R155.
Sources: Fiat Chrysler recall, July 2015; NHTSA; Wired
March 2022, supplier attack
Toyota: all Japanese plants stop for a day
A cyberattack hit Kojima Industries, a supplier of plastic parts connected to Toyota's just-in-time ordering system.
Impact
On 1 March 2022, Toyota stopped all 28 production lines in its 14 plants in Japan, losing production of about 13,000 vehicles. Subsidiaries Daihatsu and Hino also halted plants.
Sources: Toyota statement, February 2022; Nikkei; AFP
June 2024, ransomware
CDK Global: car dealers back to pen and paper
Ransomware hit CDK Global, whose dealer management software is used by around 15,000 car dealerships in North America, on 19 June 2024.
Impact
For about two weeks, dealers could not use the systems for sales, financing and service, and many returned to manual processes.
Sources: CDK Global; Reuters; Automotive News
What a working automotive security programme needs
Six building blocks that type approval authorities, OEMs and assessors expect to see.
1
A management system that passes the audit
Processes, roles and evidence for the cybersecurity management system that UN R155 asks for.
2
TARA you can reuse
Threat analysis and risk assessment per vehicle function, reused across variants instead of repeated.
3
Requirements down to the control unit
Cybersecurity goals turned into requirements that each supplier and each control unit can implement.
4
Verification and testing
Tests and penetration tests that prove the requirements work in the real system.
5
Clear supplier interfaces
Cybersecurity interface agreements that say who delivers which work product.
6
Security after start of production
Vulnerability monitoring, incident response and secure updates for as long as the vehicle type is on the road.
How we help
From the first gap analysis to the audit and beyond start of production.
Cybersecurity management system
A CSMS that fits your organisation and passes the audit.
What we do
- Gap analysis against UN R155 and ISO/SAE 21434
- Processes, roles and evidence with your teams
- Preparation for the technical service audit
You receive
CSMS process set, gap list, audit plan
TARA and security concept
Risks known before the architecture is fixed.
What we do
- Item definition, assets and threat scenarios
- Attack paths and risk values per ISO/SAE 21434
- Cybersecurity goals and concept, variant by variant
You receive
TARA, cybersecurity goals, security concept
Supplier work products
What your OEM expects, delivered in the form they expect.
What we do
- Cybersecurity plan and interface agreement
- Requirements and verification for your component
- Cybersecurity case for the OEM review
You receive
Work products ready for OEM review
Testing and penetration testing
Proof that the protection works.
What we do
- Test cases derived from the requirements
- Penetration tests of control units, interfaces and backends
- Findings rated by risk with clear fixes
You receive
Test report, findings and retest
Vulnerability monitoring and incident response
Ready for the vulnerability that arrives after start of production.
What we do
- Monitoring of the components in each vehicle type
- PSIRT process and incident response plan
- Link to the update process under UN R156
You receive
Monitoring process, PSIRT playbook
TISAX
Information security for development and prototypes.
What we do
- Scope and assessment level for your sites
- Gap analysis against the VDA ISA catalogue
- Implementation support up to the assessment
You receive
Gap list, measures, assessment readiness
How we work
Step 1
Scope
Vehicle types, control units and your role in the supply chain.
Step 2
Assess
Gap analysis and TARA workshops with your engineers.
Step 3
Build
Processes and work products, created together with your teams.
Step 4
Support
Audits, OEM reviews and security after start of production.
Standards and regulations
UN R155
Cybersecurity and cybersecurity management system. Required for vehicle type approval in the EU, for all new vehicles since July 2024.
UN R156
Software updates and software update management system, including over-the-air updates.
ISO/SAE 21434
Cybersecurity engineering for road vehicles across the whole lifecycle, from concept to decommissioning.
ISO 24089
Software update engineering for road vehicles.
TISAX
The automotive industry's information security assessment for companies that handle sensitive data or prototypes.
Cyber Resilience Act
Does not apply to vehicles and components under EU type approval, but covers connected products outside it, such as many aftermarket devices and charging equipment.
Related services and modules
The consulting services and AITIGRITY modules automotive teams use most.
Why Nord CS
Our team has led full-vehicle threat analyses and built product security teams in the automotive supply industry, and holds TISAX implementer qualifications. AITIGRITY automates the TARA, requirements, tests and vulnerability monitoring this work needs.
See AITIGRITYQuestions we often hear
Does UN R155 apply to suppliers?
The regulation applies to the vehicle manufacturer, who needs it for type approval. Manufacturers pass the requirements to their suppliers through contracts and interface agreements, so suppliers need ISO/SAE 21434 work products for their components.
Do we need a new TARA for every variant?
Not from scratch. A structured TARA reuses assets, threats and attack paths across variants and only reassesses what changes. The AITIGRITY module Threat modeling and concept design is built for exactly this.
Is TISAX the same as ISO/SAE 21434?
No. TISAX covers the information security of your company, such as the protection of data and prototypes. ISO/SAE 21434 covers the cybersecurity engineering of the product itself. Many suppliers need both.
Does the Cyber Resilience Act apply to automotive products?
Vehicles and their components under EU type approval are excluded. Connected products outside type approval, such as many aftermarket devices and charging equipment, generally fall under the CRA. We check this product by product.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.