Automotive Cybersecurity

The Automotive Threat Landscape

Modern vehicles are software-defined platforms containing over 100 million lines of code, 100+ electronic control units (ECUs), and multiple wireless interfaces including cellular, Bluetooth, Wi-Fi, V2X (vehicle-to-everything), and NFC. Security researchers have demonstrated remote exploitation of vehicles through telematics units, infotainment systems, and even tire pressure monitoring sensors, achieving control over safety-critical functions including steering, braking, and acceleration.

The automotive threat surface extends well beyond the vehicle itself. Backend cloud services that manage fleet telematics, over-the-air (OTA) software updates, and connected services represent high-value targets. A compromise of the OTA update infrastructure could theoretically push malicious firmware to millions of vehicles simultaneously. Automotive supply chains span thousands of tier-1, tier-2, and tier-3 suppliers, each contributing hardware and software components that must be trusted throughout the vehicle's lifecycle.

Ransomware attacks against automotive manufacturers have halted production at major OEMs and tier-1 suppliers, costing hundreds of millions in lost revenue and recovery expenses. IP theft campaigns target proprietary EV battery technology, autonomous driving algorithms, and advanced driver assistance system (ADAS) designs. The convergence of vehicle cybersecurity with manufacturing OT security creates a complex environment where IT, OT, and product security teams must coordinate defences.

Compliance and Regulatory Requirements

The automotive industry faces an increasingly rigorous cybersecurity regulatory environment driven by vehicle safety concerns and the rapid adoption of connected and autonomous technologies.

• ISO/SAE 21434 — The international standard for road vehicle cybersecurity engineering, establishing requirements for cybersecurity risk management throughout the vehicle lifecycle from concept through decommissioning, including threat analysis and risk assessment (TARA), cybersecurity goals, and validation activities.
• UNECE WP.29 R155 — UN regulation requiring vehicle manufacturers to implement a certified Cybersecurity Management System (CSMS) covering organizational processes, vehicle risk assessment, threat monitoring, and incident response. Mandatory for type approval in markets adopting UNECE regulations including the EU, UK, Japan, and South Korea.
• UNECE WP.29 R156 — UN regulation governing software update management systems (SUMS), requiring manufacturers to demonstrate secure software update processes including integrity verification, rollback capabilities, and update tracking throughout the vehicle fleet.
• ISO 24089 — International standard for software update engineering for road vehicles, providing detailed technical requirements for implementing secure OTA and workshop-based software updates.
• TISAX (Trusted Information Security Assessment Exchange) — The automotive industry standard for information security assessments, required by major OEMs for suppliers handling sensitive prototype data, connected vehicle data, or ADAS development information.
• Auto-ISAC Best Practices — Industry guidelines published by the Automotive Information Sharing and Analysis Center covering vehicle cybersecurity, incident response, and threat intelligence sharing among automotive stakeholders.

Connected Vehicle and ECU Security

Vehicle cybersecurity requires a fundamentally different approach than traditional IT security. In-vehicle networks including CAN bus, CAN FD, LIN, FlexRay, and Automotive Ethernet connect ECUs that control everything from engine management and transmission to airbag deployment and autonomous driving functions. These networks were designed for real-time performance and reliability, not security, and most lack authentication or encryption at the protocol level.

Mjolnir Security provides automotive cybersecurity testing services including ECU penetration testing, CAN bus fuzzing and protocol analysis, telematics unit security assessments, infotainment system testing, and V2X communication security evaluation. We perform threat analysis and risk assessment (TARA) aligned with ISO 21434, helping OEMs and tier-1 suppliers identify cybersecurity goals and derive security requirements for vehicle architectures. Our testing covers both hardware attack vectors (JTAG, debug interfaces, chip decapping) and software vulnerabilities (firmware extraction, API exploitation, wireless protocol attacks).

OTA Update Security

Over-the-air software update systems are essential for maintaining vehicle cybersecurity throughout the product lifecycle, but they also represent one of the most critical attack surfaces. A compromised OTA infrastructure could be used to deploy malicious firmware at scale, disable safety features, exfiltrate vehicle data, or brick vehicles remotely. UNECE R156 mandates that manufacturers implement secure update management systems with integrity verification, authenticity checks, and rollback capabilities.

Our OTA security assessment methodology evaluates the entire update pipeline from development build systems through code signing infrastructure, CDN distribution, vehicle-side verification, and installation processes. We test the resilience of update mechanisms against man-in-the-middle attacks, replay attacks, rollback attacks, and supply chain compromise of the build pipeline. We verify that vehicles correctly reject tampered, unsigned, or out-of-sequence updates and that failed updates result in safe fallback states.

Mjolnir's Automotive Security Approach

Our automotive practice combines deep vehicle cybersecurity expertise with manufacturing OT security and enterprise IT security capabilities, providing comprehensive protection across the automotive value chain. We work with OEMs, tier-1 suppliers, fleet operators, and automotive technology companies to address the full spectrum of automotive cyber risk.

We support UNECE R155 CSMS certification and ISO 21434 implementation through structured programs that establish cybersecurity governance, risk management processes, monitoring capabilities, and incident response procedures that satisfy type approval authorities. Our team includes practitioners with automotive industry backgrounds who understand the product development lifecycle, functional safety (ISO 26262) interactions, and the supply chain dynamics that influence automotive cybersecurity decisions.

From vehicle penetration testing and TARA workshops to manufacturing OT security assessments and SOC monitoring for automotive enterprises, Mjolnir delivers the specialized cybersecurity expertise that the connected vehicle era demands.