Today, the modern vehicle is increasingly a connected digital platform rather than what used to be a simple, mechanical product. Software, sensors, telematics, applications, wireless connectivity and cloud-based services are all now contributing to how vehicles operate and how information is exchanged, and whilst yes, this increased connectivity certainly has its benefits, it also creates a much broader attack surface and a higher risk of cybersecurity threats.
This is because every additional connection, interface, application or system can introduce another potential point of vulnerability, so much so that recent research from Upstream Security highlights in its 2026 Global Automotive and Smart Mobility Cybersecurity Report that almost 500 publicly reported cybersecurity incidents were reported across the automotive and smart mobility ecosystem during 2025, and that 67% of incidents stemmed from telematics and cloud environments, while 68% resulted in data or privacy breaches and 34% led to service or business disruption.
These findings demonstrate that automotive cybersecurity is no longer simply about protecting an individual vehicle from being compromised, mainly because the risks continue to increasingly extend into the wider ecosystem of cloud infrastructure, applications, APIs, connected services and business systems.
As a result, this is particularly important as the industry moves towards software-defined vehicles, where functionality can increasingly be delivered, updated and managed through software throughout the vehicle’s lifecycle.
Connected and software-defined vehicles are creating new risks
As vehicles become more connected, the potential consequences of a cybersecurity vulnerability become more significant too, especially as modern vehicles can contain numerous electronic control units, sensors and communication systems, while connected services can link vehicles to mobile applications, manufacturer platforms, cloud infrastructure and external systems.
This creates a more complex environment in which a weakness in one part of the ecosystem could potentially have implications elsewhere, and research published by Coventry University in 2025 identified that 508 vulnerabilities across the National Vulnerability Database and Automotive Attack Database, took place, with 45% being associated with remote attack vectors and 14.6% identified as having potential systemic implications capable of affecting multiple vehicles or wider transportation networks.
And whilst this does not necessarily mean that every vulnerability will result in a successful attack, it does highlight that the potential scale of the risk is changing, and that a vulnerability that can be exploited remotely or through a shared digital platform has the potential to reach far beyond a single vehicle or individual user.
Plus, this also serves as a stark reminder that cybersecurity needs to be considered throughout the vehicle lifecycle, rather than only when a vehicle is first developed.
The risks extend into repair and diagnostics
The changing cybersecurity landscape is also relevant to the repair sector, especially as modern repair processes increasingly depend on digital technology.
Today, vehicle diagnostics, estimating systems, manufacturer information, calibration equipment, workshop management platforms and other connected technologies are all fundamental parts of many repair operations, creating efficiencies that would have been difficult to achieve through traditional processes. However, increased digital dependency also means that repair businesses need to understand how their systems are protected, who has access to them and how information moves between different platforms.
As well as this, remote access is another consideration, particularly where workshops use connected diagnostic equipment, cloud-based systems or external technology providers. Though here, the objective should not be to avoid digital technology, because of course, these tools can provide significant operational benefits, but to make sure that security considerations develop alongside their use.
This focus is also firmly supported in Upstream’s 2025 report, which found that telematics and application servers accounted for 66% of identified attack vectors in 2024, with API-related attacks accounting for a further 17%.
In turn, this demonstrates the increasing importance of the digital infrastructure sitting behind connected automotive services, and for repairers and other automotive businesses, also reinforces the need to understand how external platforms and systems connect to the business too.
Customer and vehicle data needs greater protection
The growth of connected vehicles and digital automotive services is also increasing the amount of information being collected, processed and shared, as vehicle information, diagnostic data, location information, customer details and operational data can all move between manufacturers, insurers, repairers, fleet operators and technology providers, creating significant value for businesses but also making data protection an increasingly important part of automotive cybersecurity.
Naturally, this has highlighted growing concerns around the amount of information connected vehicles can collect, including location, journey and behavioural data, and the way that information can be accessed or shared through connected services and third-party systems.
But this also means that businesses now need to consider not only how they protect their own systems, but also how data is handled across the wider ecosystem too – something which, for automotive organisations, makes access controls, appropriate permissions, secure data handling and clear governance increasingly important, particularly where multiple organisations are involved in the same customer or vehicle journey.
Third-party suppliers are part of the cybersecurity conversation
One of the biggest changes in attitude required across the automotive sector is recognising that cybersecurity does not stop at the boundaries of an individual organisation.
This is because modern automotive businesses rely on extensive networks of suppliers, technology providers, software platforms, cloud services and other third parties, meaning that an organisation’s security position can be influenced by the systems and processes of businesses it works with.
However, the UK’s own principles for connected and automated vehicle cybersecurity do recognise this issue, stating that cybersecurity risks within supply chains, subcontractors and service providers need to be identified and managed as part of the wider security approach.
The importance of this became particularly visible following the 2025 cyber incident affecting Jaguar Land Rover, which caused significant disruption across the company’s operations and supply chain. And whilst the full circumstances and technical details of the incident should not be assumed, the disruption demonstrated how a major cyber event affecting one organisation can have consequences extending into a much wider automotive ecosystem.
Cybersecurity should not just be an IT issue
Perhaps the biggest change the automotive industry needs to make is accepting the fact that cybersecurity can no longer sit exclusively with an IT team or external technology provider, mainly because employees across an organisation interact with digital systems every day and their actions can influence the overall security position of the business
Today, raising staff awareness and providing clear training can help employees recognise suspicious communications, understand appropriate access practices and know how to report potential incidents, while clear access controls can ensure that people only have access to the systems and information they need too.
In fact, this approach is consistent with the UK’s established cybersecurity principles for connected and automated vehicles, which emphasises board-level ownership, clear accountability and a culture of security in which individuals understand their responsibilities also.
Preparing for incidents is as important as preventing them
No organisation can assume that it will never experience a cybersecurity incident, particularly as the automotive ecosystem becomes increasingly interconnected.
The latest Upstream research makes this particularly clear, with ransom-related incidents more than doubling in 2025 compared with 2024 and accounting for 44% of reported automotive and smart mobility incidents.
At the same time, the report also found that 61% of incidents had the potential to affect thousands to millions of mobility assets, demonstrating how quickly the impact of a cyber incident can scale within a connected ecosystem.
For automotive businesses, this makes having a clear response process increasingly important, and flags the necessity of having all employees understanding who to contact if they identify a potential security issue, while also ensuring that management teams have processes for assessing the impact, communicating with relevant stakeholders and restoring critical services.
Then, as a given, conducting regular reviews of these processes can also help organisations identify weaknesses before an incident occurs, rather than attempting to establish a response strategy during a crisis – as by then, it is too late.
And finally, regulation is also changing expectations too
To add even more urgency, the shift in attitudes towards automotive cybersecurity is being reinforced by regulatory developments as well, where in the UK, the government has introduced UN Regulation No. 155 on cybersecurity and UN Regulation No. 156 on software updates into the GB type approval framework, with the first mandatory implementation date for new vehicle types beginning on 1 June 2026 and further implementation dates to follow for other vehicle categories.
These requirements are primarily focused on vehicle manufacturers and type approval, but they reflect a much wider change in the automotive industry’s approach to cybersecurity in the fact that security is increasingly being treated as something that needs to be designed, managed and maintained throughout the vehicle lifecycle rather than addressed as an afterthought.
This is an important distinction for the wider industry too, especially as compliance is now to be viewed as a baseline rather than the entire cybersecurity strategy – something which adds yet further onus on businesses who still need to consider their own systems, people, suppliers, data and operational processes.
The automotive industry’s next challenge
The automotive sector has already embraced digitalisation because it delivers significant benefits, from connected vehicle services and advanced diagnostics through to cloud-based repair systems, remote software updates and more efficient customer journeys.
The challenge now, however, is ensuring that cybersecurity develops at the same pace.
For automotive businesses, this means recognising that cybersecurity is now part of good business management and ensuring that responsibility is shared across the organisation, and by improving employee awareness, reviewing access controls, keeping systems and software up to date, understanding third-party risks and preparing clear incident-response processes, those organisations can take practical steps towards becoming more resilient.
If you’re looking for ways to make a difference to your cybersecurity protocols, contact our team at GT Motive today to discover how our technology can help.