Should automotive teams prioritise relay resistance over perimeter hardening?

Why the access path deserves priority over the network perimeter

The question is really about where trust is granted. For vehicle entry systems, the control point is often the wireless key chain or fob interaction, not the external network boundary. If an attacker can extend, relay, or replay a valid signal, a hardened perimeter on the backend does little to stop the initial abuse of legitimate access.

That means teams should think in terms of the attack path, not just the environment boundary. A strong perimeter still matters for telematics, cloud services, and backend integrity, but it does not compensate for a weak acceptance decision at the point where the car decides a key is authentic.

Modern vehicle security is therefore a layered problem: prevent unauthorized signal use at the edge, then protect the downstream systems that manage remote features, diagnostics, and fleet operations. The most effective control is the one that breaks the attacker’s shortest path to a trusted action.

What relay resistance changes in practice

Relay resistance reduces the value of proximity abuse by making it harder to present a valid key signal at the vehicle when the legitimate key is far away. That can be done through design choices such as motion sensing, timed challenge-response behaviour, shielding, short-range constraints, or other anti-relay measures. The point is to stop the car from granting access simply because a valid signal can be forwarded.

Perimeter hardening addresses a different class of risk. It protects gateways, service endpoints, update channels, and telemetry infrastructure from intrusion, but it does not invalidate a captured or relayed access grant at the door handle. If the entry decision is weak, the rest of the stack inherits that weakness.

For automotive teams, the right mental model is a trust hierarchy. The closer a control sits to the access decision, the more directly it affects theft resistance. The farther away it sits, the more it improves resilience after access has already been gained.

How to decide what to prioritise

Priority should follow the abuse path your threat model says is most realistic. If theft, key relay, or replay is the primary concern, then hardening the acceptance path for the key signal should come before investment in perimeter controls that only affect backend reachability. If the concern is remote compromise of cloud services, fleet portals, or OTA infrastructure, then perimeter and backend hardening become more important.

In practice, most automotive programmes need both, but not in equal order. Controls that prevent unauthorised vehicle entry usually deserve earlier attention because they directly reduce physical theft and secondary compromise. Backend hardening remains essential for service integrity, but it should not be treated as a substitute for strong access control at the vehicle boundary.

The best sequencing is usually to close the most direct abuse route first, then raise the cost of follow-on compromise across connected services.

Risk and Threat Considerations

Relay and replay attacks create a high-consequence failure mode because they turn a legitimate credential path into an access bypass. The risk is not theoretical: once a valid signal is accepted at distance, the attacker can often unlock the vehicle, start it, or gain further access before any perimeter control becomes relevant.

Failure mechanism: The vehicle trusts a forwarded or replayed key signal as if it were local and authentic, so the attacker exploits the access decision rather than breaking the backend.

Impact: Physical theft, unauthorised entry, downstream exposure of in-vehicle systems, and in some cases access to connected accounts or services that share trust with the vehicle.

Practitioner Guidance

What to prioritise: Treat the key acceptance path as the first control plane to harden when the main abuse case is relay, replay, or proximity extension. Backend perimeter controls should be measured as supporting resilience, not as the primary theft barrier.

What to verify: Confirm that the vehicle or access system has a genuine anti-relay design decision, not just a stronger cloud perimeter. Look for evidence that valid signal presentation is constrained by timing, proximity, or challenge-response behaviour rather than by network policy alone.

What good looks like: A thief who can reach the signal cannot automatically convert that reach into trusted access. The system should force the attacker to defeat the access decision itself, not merely the network around it.

Practitioner takeaway: If the abuse path is at the key boundary, harden the key boundary first; perimeter hardening is valuable, but it is the wrong first line of defence against relay abuse.

Related resources from NHI Mgmt Group

• Should security teams prioritise identity segmentation over perimeter hardening?
• When should teams prioritise CI/CD hardening over broader secret scanning?
• When should SAP teams prioritise interface hardening over routine patch sequencing?
• When should teams prioritise access reviews over more Linux hardening work?