Topic starter
21/10/2026 2:46 pm
TL;DR: In-vehicle systems became the most affected domain in Q3 2026, even as automotive cybersecurity incidents fell to 400 from the prior quarter, according to VicOne. Security teams now need controls that follow trust links across connected services, suppliers, charging systems, and vehicle software.
Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “VicOne Situational Awareness Report: 400 Cyber Incidents, with In-Vehicle Systems Most Affected in Q3 2026”.
By the numbers:
- VicOne observed 400 automotive cybersecurity incidents in Q3 2026, down 16.1% from 477 in Q2.
- In-vehicle systems became the most affected domain with 174 incidents, compared with 149 affecting Enterprise IT.
- Asia increased 36.8% to 93 incidents, while the Americas accounted for 184 incidents.
Key questions
A: Because they extend the trust boundary beyond the vehicle itself.
Q: What are the signs that connected automotive access controls are failing?
A: Look for unauthenticated endpoints, replayable protocol flows, shared credentials across partners, excessive API reach, and AI or automation tools with broad service access.
Q: What breaks when connected vehicle systems rely on weak authentication and relayable trust?
A: Weak authentication lets attackers convert a small exposed surface into account takeover, telemetry access, or operational control.
Practitioner guidance
- Audit external trust boundaries in fleet and charging services Inventory every externally reachable API, relayable authentication flow, and device-to-cloud handshake that can reach fleet, charging, or telemetry data.
- Separate vehicle, enterprise, and supplier access paths Ensure third-party support, dealer workflows, and internal admin access do not share the same credentials, sessions, or network trust.
- Treat update chains as privileged delivery channels Verify that software and firmware update mechanisms are signed, integrity-checked, and protected from unauthorized distribution or tampering.
Bottom line: Automotive cyber risk is increasingly distributed across connected services, suppliers, charging systems, and vehicle software rather than confined to the vehicle alone.
Glossary terms: Connected Automotive Ecosystem, Trust Propagation, Machine Identity, Agentic Privilege Scope
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/10/2026 7:00 pm
Automotive cyber risk is now a governance problem across connected identities, not a vehicle-only engineering issue. The report shows that the highest-risk paths span APIs, suppliers, charging systems, AI workflows, and update channels. That means ownership must extend beyond product security into identity governance, access control, and third-party lifecycle oversight. Practitioners should manage the vehicle ecosystem as a distributed trust environment.
A question worth separating out:
Q: How should organisations govern AI agents and third-party services in automotive workflows?
A: They should treat both as delegated actors with scoped privileges, explicit ownership, and periodic review. The key is to bind access to the task, the session, and the service identity, then remove standing authority wherever possible. That reduces the chance that automation or suppliers can turn routine integration into uncontrolled access.
👉 Read our full editorial: Automotive cyber risk shifted toward in-vehicle systems in Q3 2026
This post was modified 3 days ago by NHI Mgmt Group