Topic starter
21/10/2026 2:46 pm
TL;DR: Connected vehicle APIs need application trust as well as identity because credentials alone do not prove a request came from the genuine client, according to Approov. Mobile apps, cloud APIs and third-party integrations now need runtime checks and lifecycle governance across the vehicle service path.
Editorial analysis by NHI Mgmt Group, based on content published by Approov: “Auto-ISAC 2026: Why Connected Vehicle Security Must Extend Beyond the Vehicle”.
By the numbers:
- More than 60% of the vendors at the summit focused on OT security.
Key questions
Q: Why do valid credentials still leave connected vehicle services exposed?
A: Because credentials only show that a caller knows or holds a secret.
Q: What breaks when third-party vehicle integrations are treated as ordinary user access?
A: Revocation, visibility and scope control break down.
A: Security teams should treat mobility APIs as cyber physical control points, not ordinary web endpoints.
Practitioner guidance
- Define trust boundaries across the full request path Map the path from mobile app to cloud API to vehicle-related action and identify where identity, integrity and authorization are separately enforced.
- Require application authenticity for sensitive APIs Use client attestation or equivalent evidence before allowing high-value vehicle requests, especially where bearer tokens alone would otherwise grant access.
- Inventory third-party vehicle integrations as delegated access paths Record which applications can access which vehicle data or functions, who can revoke them, and what telemetry proves the access is still appropriate.
Bottom line: Connected vehicle security now depends on verifying application trust as well as user identity, because credentials alone do not prove the request came from the genuine client.
Glossary terms: App Attestation, Runtime Integrity, Delegated access path, Claim Trust Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/10/2026 7:00 pm
Application trust is now a separate control plane from identity. Connected vehicle environments show why a valid credential is no longer enough to prove a request is trustworthy. When the client software itself can be cloned, instrumented or automated, the trust decision has to move beyond user identity and into application integrity. Practitioners should treat this as a governance boundary between authentication and assurance, not a feature enhancement.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should automakers prioritise application attestation or API gateway controls first?
A: They should use both, but for different questions. Gateway controls limit traffic and policy scope, while attestation helps prove the client is the genuine application. For sensitive vehicle functions, attestation is what closes the trust gap that gateway rules cannot see.
👉 Read our full editorial: Connected vehicle APIs need application trust, not just credentials
This post was modified 3 days ago by NHI Mgmt Group