Automotive Cybersecurity

Automotive cybersecurity refers to the systematic implementation of technical and management measures designed to safeguard the electrical and electronic (E/E) systems, on-board software, communication networks, and data of intelligent connected vehicles from cyberattacks, unauthorised intrusion, and malicious interference. As vehicles evolve from mechanical transport into "mobile data centres", code volume in premium smart vehicles has exceeded 100 million lines, generating terabytes of data daily. With cyberattacks now executable remotely without physical access, cybersecurity has emerged as the automotive industry's second vital lifeline right after functional safety.

Risk Landscape and Key Incidents

Automotive cybersecurity threats are escalating rapidly. Industry monitoring data reveals that 92% of automotive cyberattacks in 2024 were remote, contactless intrusions. Furthermore, over 70% of security vulnerabilities exhibit cross-model and cross-brand propagation capabilities, exposing millions of on-sale and existing vehicles to widespread risk once exploited.

Notable high-profile incidents in recent years include: Toyota suffering a data breach affecting 2.15 million Japanese vehicle owners due to a cloud system misconfiguration (2023); NIO falling victim to battery data tampering, where bad actors manipulated damaged battery telemetry to register as new units for regular use (2023); and Qualcomm identifying severe vulnerabilities across 64 chipset models, leaving them exposed to remote exploitation (2024). Between 2021 and 2024, cumulative automotive cybersecurity incidents globally surpassed 1,700 cases, maintaining a steady upward trend year-on-year.

Attack Surfaces and Technical Challenges

A rapidly expanding attack surface. The rise of Software-Defined Vehicles (SDVs) has dismantled traditional physical isolation boundaries within in-car systems, deeply interconnecting in-vehicle infotainment (IVI), autonomous/intelligent driving, chassis braking, and thermal management. Hackers can exploit softer entry points—such as head units, third-party interfaces, or companion mobile apps—and pivot laterally into critical vehicle control domains. In extreme scenarios, attackers can hijack critical driving controls like steering, braking, and throttle response, directly endangering the lives of occupants and road users.

The supply chain as a prime target. The vast majority of current automotive cybersecurity threats do not originate directly from carmakers (OEMs), but stem from Tier-2 and Tier-3 component and software suppliers. Unstandardised development workflows across multi-tiered supply chains, lack of rigorous security audits, and poor source-code vulnerability management allow security flaws to cascade downstream, creating a severe "single-point flaw, fleet-wide compromise" domino effect.

Three core technical hurdles: complexity in interpreting cybersecurity compliance mandates (compounded by a general lack of cybersecurity awareness among automotive engineers); fragmented software architectures and debugging difficulties (where legacy code reuse introduces hidden bugs); and prohibitive validation costs alongside heavy reliance on foreign testing tools.

Regulatory Frameworks and Standards

China has established an overarching automotive cybersecurity governance framework structured around "Statutory Laws + Mandatory National Standards (GB) + Recommended Standards".

First wave of mandatory national standards (effective 1 January 2026):

• GB 44495-2024 "Technical Requirements for Vehicle Cybersecurity": Mandates vehicle cybersecurity management system (CSMS) specifications, alongside technical baselines and test protocols for external connectivity, in-vehicle communications, software updates, and data security. It applies to Category M, Category N, and Category O vehicles equipped with at least one ECU. Benchmarked against UN Regulation No. 155 (UN R155), this standard introduces more stringent specifications regarding cryptographic security, default security baselines, vulnerability disclosure, audit logging, and vehicular data handling.

• GB 44496-2024 "General Technical Requirements for Vehicle Software Update": Regulates over-the-air (OTA) update protocols, covering mandatory user consent, cryptographic security, battery state-of-charge safeguards, and update rollback/recovery mechanisms.

• GB 44497-2024 "Intelligent and Connected Vehicles – Data Storage System for Automated Driving": Provides critical telemetry and data logging required for accident liability attribution and forensic crash investigation.

Key supporting standards: The "Several Provisions on the Management of Automobile Data Security (for Trial Implementation)" (2021) introduced fundamental data governance principles, notably "in-vehicle processing" and "no collection by default"; T/CSAC 019-2025 "Technical Requirements for Cybersecurity Testing of Intelligent and Connected Vehicles", effective August 2025, defines vehicle-level cybersecurity testing criteria and test methodologies.

International regulations: Complete built-up (CBU) exports to 54 signatory nations across the UNECE framework (including the European Union, Japan, and South Korea) must comply with UN R155 (Cybersecurity) and UN R156 (Software Updates), which became mandatory for all new vehicle type approvals starting July 2022.

Cybersecurity Methodologies and Best Practices

The industry is transitioning from reactive "post-incident patching" to a proactive "shift-left" security paradigm—embedding threat modelling and cybersecurity controls early into vehicle conceptualisation, architecture design, software development, and validation phases.

Layered defence-in-depth architecture has become the industry benchmark. Solutions like Huawei Qiankun demonstrate this through zero-trust network models, end-to-end encryption for telematics, secure in-vehicle "trust-ring" bus communications, and unique cryptographic vehicle-binding to prevent unauthorized ECU flashing or tuning. Modern on-board systems require integrated intrusion detection systems (IDS), real-time threat monitoring, and full-lifecycle vulnerability management spanning vehicle R&D, supply chain procurement, active service life, and end-of-life vehicle disposal.

Validation and compliance capabilities: Bodies like the China Academy of Information and Communications Technology (CAICT) have deployed specialized automotive cybersecurity testbeds covering wireless RF security, in-vehicle network buses, OS security, and data integrity, achieving CNAS accreditation for both GB 44495 and UN R155. Nevertheless, challenges persist, notably a shortage of full-vehicle test facilities, evolving evaluation standards, and limited deployment of domestic testing toolchains.

Industry Outlook

Cybersecurity is rapidly becoming a primary operational bottleneck impacting the high-quality transformation of the automotive sector. Globally, regulatory landscapes are diverging: China follows a "National Standard-driven, locally executed" model, the EU enforces a "regulation-driven, mandatory compliance" regime, while the US operates under a more fragmented framework—imposing complex multi-market homologation hurdles for global OEMs. Moving forward, OEMs, Tier-1/2 suppliers, tech giants, and regulators must foster deeper synergy to construct an end-to-end defensive ecosystem across R&D, supply chains, and cloud-to-vehicle telematics, ensuring product innovation never comes at the expense of public mobility safety.