wave white on navy

As vehicles become increasingly connected, cybersecurity is no longer a niche concern…

…it’s a foundational requirement. While regulatory frameworks like UN R155 and ISO/SAE 21434 are shaping OEM practices, end users remain exposed to risks that vary by use case. This guide offers tailored cybersecurity advice for six distinct user groups, helping individuals and organisations protect their vehicles, data, and operations.

Individual car owners

Use Case: Personal transportation, smart features, mobile app integration

Key risks

  • Keyless entry exploits (e.g., relay attacks)
  • Mobile app vulnerabilities
  • Infotainment data leakage (contacts, location history)
  • Firmware tampering in used vehicles (most buyers and dealers today don’t inspect firmware integrity in used cars, but this is an emerging risk)

Device & Access Security

  • Use signal-blocking pouches for key fobs to prevent relay attacks.
  • Set strong, unique passwords for connected vehicle apps.
  • Disable unused wireless interfaces (Bluetooth, Wi-Fi) when not in use.
  • Avoid connecting unknown USB devices to infotainment ports.

Software Integrity

  • Regularly install OTA (Over-The-Air) updates for infotainment and telematics systems.
  • Register the vehicle with the manufacturer—even if out of warranty—to receive recall alerts, software patches, and cybersecurity updates notifications.
  • During service visits, request a VIN-based software check or try booking service using the car manufacturer’s online service portal and inspect all notifications to identify available updates not listed in public databases.

Used Vehicle Precautions

  • If purchasing a used vehicle, request a dealer-level diagnostic reset. This goes beyond user-accessible infotainment resets and ensures firmware integrity across ECUs.
  • Be aware that optional updates (e.g., battery optimisation, cybersecurity patches) may not appear on DVSA recall databases but can be critical.
two cars with two different cyber security ratings

Small and medium business vehicle users

Use Case: Delivery vans, tradespeople, mobile services

Small businesses often lack dedicated IT or cybersecurity teams, yet they’re increasingly operating vehicles that behave like mobile computers. Below is our best attempt to simplify and expand it to make it practical, specific, and SMB-friendly.

Key risks:

  • Data theft or tampering
  • Poor separation between personal and business data
  • Weak mobile device security linked to vehicle systems

Mobile Device Management (MDM)

  • Deploy MDM software on all phones/tablets used for navigation, dispatch, or vehicle control.
  • Enforce screen locks, app restrictions, and remote wipe capabilities.
  • Prevent unauthorised apps from accessing vehicle-linked data.

GPS & Route Data Protection

  • Use encrypted fleet tracking platforms; avoid free apps with unclear data policies.
  • Audit access to route history and driver behaviour logs.
  • Disable location sharing on personal devices unless operationally required.

Staff Cyber Awareness

  • Train staff to avoid syncing personal accounts with vehicle infotainment systems.
  • Prohibit use of unknown USB drives or chargers in company vehicles.
  • Restrict app installations to vetted, business-approved tools.

Aftermarket Cybersecurity Enhancements

  • Install OBD-II port locks to prevent unauthorised diagnostics or tampering.
  • Use signal-blocking pouches for key fobs.
  • Audit aftermarket telematics modules for encryption, patching capability, and access control.

Create a Simple Cyber Checklist

Even without dedicated IT and cybersecurity staff, SMBs can implement a basic checklist:

  • Who has access to vehicle apps and data?
  • Are all connected devices password-protected?
  • Is the vehicle software current? – Are staff trained to report suspicious behaviour?

Corporate fleet operators

Use Case: Logistics, rentals, company cars

Telematics Control Units (TCUs) have become a standard feature in modern fleet vehicles, particularly those used in logistics, delivery, public services, and commercial transport. These embedded modules enable real-time tracking, diagnostics, and remote management, and are often essential for regulatory compliance—such as with the Electronic Logging Device (ELD) mandate, which requires automatic logging of driver hours and vehicle activity.

While TCUs offer robust functionality, many fleet operators—especially small and medium-sized businesses—are opting to use drivers’ mobile phones as a cost-effective alternative. Mobile apps can replicate many TCU functions, including GPS tracking and job dispatch, but they introduce additional cybersecurity and privacy risks if not properly secured and managed.

Key risks:

  • Fleet-wide vulnerabilities from centralised systems
  • Remote access abuse
  • GDPR violations from improper tracking or data handling (Improper or covert tracking even within businesses can breach GDPR and employee privacy laws)

Fleet-Wide Monitoring

  • Deploy cybersecurity monitoring tools across all vehicles.
  • Enforce OTA updates for infotainment, telematics, and safety-critical ECUs.

Mobile Security

  • MDM is foundational but insufficient on its own. Pair it with mobile endpoint protection software to detect phishing links, malicious SMS, unsafe networks, and rogue apps.
  • Use solutions that offer real-time threat detection, behavioural analysis, and network protection.

Network Segmentation

  • Create logical and physical boundaries between vehicle systems and enterprise infrastructure.
  • Use separate Wi-Fi networks or cellular APNs for vehicle-linked devices.
  • Implement VLANs or SD-WAN policies to restrict data flow and isolate risk.
  • Facilitate telecom-layer isolation: Route telemetry and remote commands through private APNs and VPN/MPLS backhaul to avoid public internet exposure and enforce network-level policy boundaries

Compliance & Governance

  • Align with GDPR, ELD mandates, and ISO/SAE 21434 where applicable.
  • Maintain audit trails for software updates, access logs, and data handling procedures.

Public sector & emergency vehicles

Use Case: Police, ambulances, municipal services

Public sector and emergency vehicles often carry specialized onboard computer systems that are significantly more complex, mission-critical, and sensitive than those found in standard connected vehicles. These systems support not just mobility, but real-time coordination, secure data exchange, and life-saving operations.

This ruggedized equipment is commonly referred to as a Mobile Data Terminal (MDT) or Mobile Data Computer (MDC), and is typically integrated with Computer-Aided Dispatch (CAD) platforms. These systems enable direct access to national databases, incident reporting tools, and encrypted communication networks.

While the cybersecurity of MDT/MDC platforms warrants its own governance framework, the following recommendations focus on the vehicle-level risks and protections that apply across emergency fleets:

Key risks:

  • Targeted attacks (e.g., sabotage, ransomware)
  • Exposure of sensitive data (medical, law enforcement)
  • Legacy systems with poor patching
  • Unauthorised tracking via covert RF devices (no headline-grabbing case has yet been exposed, but experts are worried)

Vehicle Hardening

  • Secure physical access points (OBD-II, USB, wireless interfaces).
  • Ensure all onboard systems are patched and running verified firmware.

Counter-Surveillance Measures

  • Conduct periodic sweeps using RF detectors, magnetic probes, or thermal imaging to detect unauthorised tracking devices.
  • Engage TSCM (Technical Surveillance Countermeasures) specialists for high-risk deployments.

Penetration Testing & Compliance

  • Perform regular penetration testing on vehicle networks and connected systems.
  • Ensure alignment with national cybersecurity standards and emergency service protocols.

Specialised Equipment Governance

– MDTs (Mobile Data Terminals) and MDCs (Mobile Data Computers) should be managed under separate security policies, with encrypted communication and strict access control.

Tech enthusiasts & tinkerers

Use Case: Modding, diagnostics, custom firmware

Tech-savvy vehicle owners often explore the boundaries of what their cars can do – whether through performance tuning, custom firmware, or advanced diagnostics. This hands-on experimentation can unlock new features and insights, but it also introduces cybersecurity risks that are often overlooked. From bricking ECUs to unintentionally exposing vehicle systems to remote threats, the consequences of poorly vetted tools or modifications can be significant.

Key risks:

  • Bricking ECUs or exposing vulnerabilities
  • Installing unverified third-party tools
  • Unintentionally sharing sensitive data
  • Use only trusted diagnostic and flashing tools.
  • Avoid jailbreaking infotainment systems or bypassing OEM security layers.
  • Maintain backups of original firmware before making modifications.
  • Understand the legal and warranty implications of software changes.

Shared mobility & car subscription users

Use Case: Car sharing, ride-hailing, short-term rentals

Users of shared mobility services interact with vehicles that are accessed by multiple individuals over short periods. These vehicles often rely on app-based entry, cloud-connected infotainment systems, and remote fleet management tools. While convenient, this model introduces unique cybersecurity risks—particularly around data residue, account manipulation, and inconsistent software maintenance.

Key risks:

  • Data residue from previous users
  • App-based access manipulation
  • Inconsistent software updates across shared fleets
  • Always log out of infotainment systems after use.
  • Avoid syncing personal accounts (e.g., Google, Spotify) with shared vehicles.
  • Use privacy mode if available to limit data retention.
  • Report suspicious behaviour or system glitches to the provider immediately.

Keeping it safe – Final thoughts

As vehicles evolve into software-defined platforms, cybersecurity must evolve with them. By segmenting advice based on user type, we can better address the unique risks faced by individuals, small businesses, fleet operators, and public sector teams. Whether you’re buying a used EV, managing a delivery fleet, or deploying emergency vehicles, proactive cyber hygiene is no longer optional—it’s essential.

Conclusion: The road ahead for automotive cyber security

As we wrap up this series on automotive cybersecurity, it’s evident that securing our vehicles is both challenging and essential. We’ve explored the transformation of modern cars into sophisticated data centres on wheels, the cybersecurity threats they face, and the innovative solutions being developed to counter these risks.

From understanding the evolution of vehicle connectivity and the expanding attack surface to examining real-world incidents and speculative scenarios, we’ve highlighted the critical need for robust cybersecurity measures. The industry’s response, driven by regulatory frameworks, architectural shifts, and embedded defence technologies, underscores the importance of staying ahead of potential threats.

As we look to the future, the integration of modular, upgradable, and user-controllable security systems will be key. The collaboration between OEMs, third-party providers, and consumers will shape the landscape of automotive cybersecurity, ensuring that vehicles remain not just connected but secure.

Thank you for joining us on this journey. Stay vigilant, stay informed, and drive safely.

About Reliance Cyber

Reliance Cyber delivers world class cybersecurity services tailored to the unique needs of our customers. With extensive in-house expertise and advanced technology, we protect organisations across a wide range of sectors — from enterprise to government —against the most sophisticated threats, including those from nation-state actors. Our teams safeguard critical assets, people, data, and reputations, allowing customers to focus on their core business objectives with confidence.

Get in touch with our experts

+44 (0)845 519 2946
contact@reliancecyber.com