Automotive cybersecurity in Q2 2026: what changed across the ecosystem?

TL;DR: 477 automotive cybersecurity incidents, a 17.8% increase from Q1, are tracked in VicOne’s Q2 2026 Situational Awareness Report, while ransomware, CWE findings, and AI-related risks spread across enterprise systems, charging infrastructure, and in-vehicle platforms. The boundary between vehicle security and enterprise security is now operational, not theoretical.

Editorial analysis by NHI Mgmt Group, based on content published by VicOne: “VicOne Situational Awareness Report: 477 Cybersecurity Incidents, 160 Ransomware Cases, and Other Automotive Threat Highlights in Q2 2026”.

By the numbers:

• VicOne observed 477 automotive-related cybersecurity incidents in Q2 2026, an almost 20% increase from Q1.
• The Americas accounted for 245 incidents, representing more than 51% of the Q2 total.
• Logistics and transportation accounted for 64 ransomware incidents, or 40% of the Q2 total.

Key questions

Q: What breaks when automotive security is managed as separate IT and vehicle programmes?

A: Teams miss the shared dependency paths that let a weakness in one layer affect another.

Q: Why do trusted software update and automation paths create such high automotive risk?

A: They concentrate trust into a small number of mechanisms that can distribute malicious or altered code quickly.

Q: What are the signs that automotive security testing is too narrow?

A: The clearest sign is repeated focus on one defect class while other exposures keep appearing in reports, such as injection, memory safety, access control, and integrity failures.

Practitioner guidance

• Build a cross-domain automotive asset inventory Include enterprise IT, connected services, charging infrastructure, supplier software, and in-vehicle components in one dependency map so you can see where risk crosses boundaries.
• Review trust assumptions in software update paths Validate how signed updates, package integrity, and backend release workflows are protected across vehicle and non-vehicle environments, especially where third-party software is involved.
• Expand testing beyond authentication defects Prioritise injection, memory safety, access control, and integrity testing across both web-facing services and embedded software, since the report shows all of these weakness classes in play.

Bottom line: Automotive cybersecurity risk now spans enterprise IT, connected services, charging infrastructure, and in-vehicle systems, so a narrow vehicle-only model is no longer sufficient.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →