EV cybersecurity: are visibility controls keeping up with attack surface?

TL;DR: Electric vehicle cybersecurity now spans the vehicle, charger, mobile app, and cloud backend, and Finite State argues that the most reliable defense starts with visibility into the software actually shipped across that ecosystem. The lesson for practitioners is that reachability and inventory matter more than broad vulnerability counts when the attack surface includes third-party code, connected chargers, and remote commands.

Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “Electric Vehicle Cybersecurity: Risks, Real Incidents, and How to Protect the Ecosystem”.

By the numbers:

• Global electric car sales grew about 20% in 2025 to top 20 million, according to the IEA.
• Electric cars reached a 25% share of the world car market, according to the IEA.

Key questions

Q: What breaks when EV cybersecurity does not cover chargers and cloud backends?

A: Security fails at the ecosystem boundary.

Q: Why do third-party apps create so much risk in connected vehicles?

A: Third-party apps often sit close to remote commands, telemetry, and authentication flows, so they inherit trust that is broader than their original purpose.

Q: What signs show that EV vulnerability management is missing the real risk?

A: The clearest signs are large vulnerability lists with no exploitability ranking, missing firmware provenance, and no distinction between reachable and unreachable flaws.

Practitioner guidance

• Build a shipped-firmware inventory Create a ground-truth SBOM from the firmware and binaries actually deployed in the vehicle and charger, including supplier and open-source components.
• Separate charging networks from enterprise systems Segment EVSE management traffic, charger administration, and remote command paths so a compromised charger cannot pivot into unrelated infrastructure.
• Review third-party app and token trust Audit every mobile app, data logger, and remote-service token that can issue vehicle or charging commands, then revoke anything that is not explicitly needed.

Bottom line: EV cybersecurity depends on governing the whole connected ecosystem, not only the car’s internal electronics.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →