Topic starter
14/07/2026 4:26 pm
TL;DR: API incidents now account for 17% of all attacks in connected mobility, 92% are remote, and more than 60% affect thousands to millions of assets, according to Upstream Security’s 2025 report. The pattern shows API governance has become operational resilience work, not just application hardening.
Editorial analysis by NHI Mgmt Group, based on content published by Upstream Security: “When API Security Fails, Mobility Breaks: Lessons from 2025’s Cyber Incidents”.
By the numbers:
- API incidents now account for 17% of all attacks in connected mobility, ahead of infotainment as an entry point.
Key questions
Q: What breaks when mobility APIs are exposed without transaction-level authorisation?
A: The API may still authenticate a user while allowing the wrong action on the wrong object.
Q: Why do exposed API keys create outsized risk in mobility ecosystems?
A: Exposed API keys are reusable non-human credentials, so one leak can support automated abuse across many systems before detection or rotation occurs.
Q: How can security teams tell when a mobility API is being abused?
A: Look for valid requests that violate expected business context, such as object IDs that cross accounts, vehicle actions that do not match the session state, or high-volume calls against control endpoints.
Practitioner guidance
- Map API authority to real-world actions Document which APIs can unlock vehicles, alter charging states, expose VIN-linked accounts, or access model assets, then assign an accountable owner to each action path.
- Govern machine credentials as NHI assets Inventory API keys, service tokens, and integration secrets across mobility platforms, then enforce rotation, revocation, and scope review as a machine identity control.
- Validate object-level authorisation on mobility transactions Test whether an authenticated user can access another driver, vehicle, charger, or fleet object through IDs, portal flows, or API calls that should be isolated.
Bottom line: API failures in connected mobility are no longer isolated software defects because they can translate directly into physical and operational disruption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:34 pm
API governance is now a resilience control, not a narrow application control. In connected mobility, the API is often the decision point for vehicle access, charging orchestration, and account linkage. Once that layer fails, the blast radius extends across physical systems, operations, and customer trust. Practitioners should treat API governance as a core resilience discipline, not a security add-on.
A few things that frame the scale:
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%), according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Should connected mobility teams prioritise API security over traditional perimeter controls?
A: Yes, when the API is the trust boundary for customer access, vehicle commands, or charging operations. Perimeter controls cannot compensate for weak authorisation, exposed keys, or over-shared objects at the transaction layer. The right priority is to secure the business action, because that is where the operational risk actually lands.
👉 Read our full editorial: API security failures are now a mobility resilience problem