Q3 2026 automotive cyber risk: what changed for connected systems?

TL;DR: 400 automotive cybersecurity incidents were observed in Q3 2026, down 16.1% from Q2, while in-vehicle systems became the most affected domain and AI-related risks appeared across vehicle, manufacturing, and enterprise layers, according to VicOne research. The pattern shows that automotive security governance now has to follow connected ecosystem exposure, not just perimeter IT.

Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “VicOne Situational Awareness Report: 400 Cyber Incidents, with In-Vehicle Systems Most Affected in Q3 2026”.

By the numbers:

• VicOne observed 400 automotive cybersecurity incidents in Q3 2026, down 16.1% from 477 in Q2.
• In-vehicle systems became the most affected domain with 174 incidents, compared with 149 affecting Enterprise IT.
• Asia increased 36.8% to 93 incidents, while the Americas accounted for 184 incidents.

Key questions

Q: What breaks when connected vehicle systems rely on weak authentication and relayable trust?

A: Weak authentication lets attackers convert a small exposed surface into account takeover, telemetry access, or operational control.

Q: Why do fleet platforms and charging systems create a larger security risk than isolated vehicle software?

A: Because they extend the trust boundary beyond the vehicle itself.

Q: What are the signs that connected automotive access controls are failing?

A: Look for unauthenticated endpoints, replayable protocol flows, shared credentials across partners, excessive API reach, and AI or automation tools with broad service access.

Practitioner guidance

• Audit external trust boundaries in fleet and charging services Inventory every externally reachable API, relayable authentication flow, and device-to-cloud handshake that can reach fleet, charging, or telemetry data.
• Separate vehicle, enterprise, and supplier access paths Ensure third-party support, dealer workflows, and internal admin access do not share the same credentials, sessions, or network trust.
• Treat update chains as privileged delivery channels Verify that software and firmware update mechanisms are signed, integrity-checked, and protected from unauthorized distribution or tampering.

Bottom line: Automotive cyber risk is increasingly distributed across connected services, suppliers, charging systems, and vehicle software rather than confined to the vehicle alone.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →