Automotive data growth is widening connected-car cyber risk

At a glance

What this is: This is VicOne’s automotive cybersecurity report summary, which argues that connected cars and their data ecosystems are expanding the attack surface faster than governance and risk controls are adapting.

Why it matters: It matters because automotive security teams now need to manage data access, connected-service exposure and cyber risk together, rather than treating vehicle security and data governance as separate problems.

Context

Connected vehicles are now data-rich systems as much as they are transport assets, which means the security problem extends beyond software flaws to the governance of information flows, monetisation paths and third-party exposure. In this environment, compliance, vulnerability management and operational risk all intersect, and connected-car programmes can no longer rely on a narrow vehicle-only security model.

VicOne frames the current automotive threat landscape as a balance problem: organisations are trying to adopt connected features and advanced vehicle capabilities while keeping cyber risk within tolerable bounds. That tension is typical of the sector, but the report suggests the industry still needs a more holistic view of data security, incident trends and forward-looking cyber planning.

Key questions

Q: What should automotive security teams do first when connected-car data exposure is unclear?

A: Start with a data-flow and dependency inventory. You need to know which systems collect, store and transmit vehicle data, which suppliers or apps can access it, and where trust is assumed rather than verified. Without that map, controls are usually applied too late and to the wrong boundary.

Q: Why do connected vehicles create greater cyber risk for fleet operators than isolated systems?

A: Connected vehicles expand risk because every wireless interface becomes a possible entry point, including Bluetooth, Wi Fi, cellular links, radio systems, tire pressure monitoring, and even compromised media. Once attackers reach the telematics environment, they can disrupt vehicle operation, attack backend servers, or pivot into corporate systems. The more connectivity a fleet adds, the larger the attack surface becomes.

Q: What are the signs that automotive cyber governance is too fragmented?

A: Look for duplicated risk registers, inconsistent supplier reviews, unclear ownership of vehicle data, and security decisions made separately by engineering, privacy and compliance teams. Fragmentation usually shows up as delayed remediation, uneven policy enforcement and gaps between product design and incident response.

Q: How should organisations balance connected-car innovation with cybersecurity oversight?

A: Treat each new feature, integration or monetisation path as a governance decision, not just a product decision. The right balance comes from defining approval gates, access rules and accountability before deployment, then revisiting them as the ecosystem and threat landscape evolve.

Technical breakdown

Connected-car data ecosystems and exposure paths

Connected-car ecosystems link vehicles, cloud services, mobile apps, dealerships, insurers and OEM platforms through persistent data exchange. That creates multiple trust boundaries, each with its own authentication, authorisation and logging requirements. The security issue is not simply whether a car is compromised, but whether data can be accessed, reused or monetised across a chain of services without adequate governance. The broader the ecosystem, the harder it becomes to treat each connection as isolated. Practical implication: map data flows and third-party dependencies before you decide where to place control points.

Practical implication: Map data flows and third-party dependencies before you decide where to place control points.

Why automotive risk management must span cyber and compliance

Automotive security is no longer only an engineering discipline. It now sits alongside regulatory obligations, privacy expectations, supplier assurance and cyber incident response. That means the control model has to account for who can access data, how it moves, how long it is retained and which organisations share accountability for misuse or exposure. When compliance and security are separated, blind spots appear in both reporting and remediation. Practical implication: align legal, security and engineering ownership around the same risk register and escalation path.

Practical implication: Align legal, security and engineering ownership around the same risk register and escalation path.

Balancing innovation with cybersecurity protection

The report’s underlying architecture question is how to keep adding connected features without enlarging the blast radius of failure. In practical terms, every new data service, vehicle feature or partnership can increase dependency on identity, access and trust decisions outside the vehicle itself. For automotive programmes, this is where IAM concepts begin to matter: service access, API trust and privileged operational pathways all shape cyber exposure. Practical implication: treat new connected functionality as a governance change, not just a product enhancement.

Practical implication: Treat new connected functionality as a governance change, not just a product enhancement.

NHI Mgmt Group analysis

Connected-car security is now a data governance problem, not only a vehicle security problem. The article shows that the centre of gravity has shifted toward the automotive data ecosystem, where monetisation and service integration create new exposure paths. That changes the control conversation from isolated technical hardening to lifecycle governance over access, retention and third-party sharing. Practitioners should expect data governance and cyber governance to converge in connected-vehicle programmes.

The industry’s real challenge is control fragmentation across OEMs, suppliers and service platforms. When each participant manages its own slice of the ecosystem, no single team owns the full exposure picture. That fragmentation is what turns routine integrations into persistent risk. The practical conclusion is that automotive security needs shared accountability models that span engineering, legal and operations.

Automotive data ecosystem: this is the expanding network of vehicle telemetry, cloud services, partner integrations and consumer apps that creates both value and attack surface. VicOne’s report makes clear that the ecosystem itself is the asset under pressure. If organisations cannot inventory where data moves and who can touch it, they cannot govern the security boundary. Practitioners should treat ecosystem visibility as a prerequisite for any sustainable automotive cyber strategy.

The next phase of automotive cybersecurity will reward programmes that connect risk management to product planning. The report’s emphasis on predictions and strategic balance suggests that the future issue is not just defending what exists, but deciding which features are acceptable to ship under which controls. That is a governance maturity test as much as a technical one. Practitioners should fold cyber requirements into product and platform planning earlier.

Identity controls matter in automotive environments because the attack surface is increasingly service-based. Once connected vehicles depend on APIs, cloud services and operational portals, access control becomes part of the safety and resilience story. That makes IAM, privileged access and service authentication relevant to automotive security even when the article is not framed as an identity paper. Practitioners should review access governance wherever vehicle data or functions cross organisational boundaries.

What this signals

Automotive cyber programmes are moving toward ecosystem governance. The practical unit of control is no longer the vehicle alone but the chain of services, data holders and partners around it. Teams should expect security reviews to expand into supplier assurance, access governance and data-flow oversight.

Identity and access control are becoming relevant inside automotive security reviews. As more functions depend on cloud portals, APIs and support tooling, privileged access becomes part of the vehicle risk conversation. Teams should test whether operational access is still scoped to the task, the partner and the data boundary.

Automotive cybersecurity maturity will increasingly be judged by how well teams connect product change to risk control. The strongest programmes will not separate innovation approvals from security decisions. They will force new connected features to inherit governance requirements before exposure reaches customers.

For practitioners

• Inventory connected-car data flows Build a complete map of where vehicle data originates, where it is stored, who can consume it and which third parties receive it. Use that inventory to identify hidden trust relationships and unsupported assumptions.
• Align cyber risk and compliance ownership Create a shared governance model across security, legal, privacy and engineering so that regulatory obligations, incident response and supplier risk are reviewed together rather than in separate workstreams.
• Treat new connected features as risk changes Require security review before enabling new data services, telematics integrations or partner-facing capabilities, because every added connection changes the exposure profile of the vehicle ecosystem.
• Review privileged access across automotive platforms Audit admin, service and partner access to cloud portals, APIs and support tooling to ensure that operational access cannot be reused outside its intended purpose.

Key takeaways

• Connected-car security now depends on governing the automotive data ecosystem, not just hardening individual vehicles.
• The key risk is fragmentation across OEMs, suppliers and service platforms, which leaves no single team with a complete exposure picture.
• Automotive programmes need shared ownership of access, compliance and risk so that new connected features are reviewed before they expand the attack surface.

Key terms

• Connected Car Data: Data generated by a vehicle and its surrounding systems, including telematics, infotainment, location, engine performance, and road conditions. In privacy terms, this data can reveal information about the driver and passengers, so it needs governance, access control, and careful handling across the full connected-car lifecycle.
• Automotive Cybersecurity: Automotive cybersecurity is the discipline of protecting connected vehicles and their supporting systems from unauthorized access, disruption, and manipulation. It includes securing in-vehicle software, remote services, charging infrastructure, and third-party integrations so attackers cannot alter behavior, steal data, or interrupt operations at scale.
• Privileged Access: Privileged access is any elevated entitlement that can change systems, data, or security settings. When privilege is excessive or poorly scoped, a single compromised identity can create outsized blast radius across environments.
• Supplier risk in automotive security: Supplier risk in automotive security is the exposure created when third parties build, host, support or process parts of the vehicle ecosystem. The risk is not limited to direct compromise; weak governance at one supplier can affect data, availability and trust across the broader automotive environment.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and identity lifecycle basics. It is suited to practitioners who need to connect access control with broader security programmes.