Reading time
6 minutes
One of the advantages of the modern software-defined vehicle (SDV) is that it’s highly connected to the world around it. Drivers can plan and update routes, order a tow truck, process payments for charging and other services, access Wi-Fi, and receive over-the-air (OTA) updates to access the latest software features and functionality.
But with that connectivity comes a high degree of risk exposure. Vehicle-to-everything, or V2X, connectivity opens many channels for cyberattacks. Every line of code, every integration point, and every connected electronic control unit (ECU) is a potential entry point for hackers to exert control over the SDV and its systems. And the typical SDV is supported by over 100 million lines of code and 100 ECUs.
Recently a cybersecurity researcher gained control of many of the systems in the BYD Shark 6, a Chinese pickup truck model, without using a single password — including the headlights, wipers, door locks, infotainment screen, and cockpit microphone. The researcher even recorded a call in which the driver revealed a personal banking password. While the steering and braking systems were protected, the demonstration remains powerful.
The High Cost of Noncompliance
Cyberattacks cost the global auto industry a staggering $22.5 billion in 2024 — increasing more than 22X over 2022. These expenses reflect ransomware attacks, data breaches, social engineering and phishing schemes, and system downtime. But they don’t consider the lasting damage to the reputations of automakers and their suppliers when they lose consumer trust — which can be even more costly.
To combat cybercrime, the global automotive industry has introduced a series of cybersecurity regulations that ensure SDVs are adequately protected. Chief among these is the international automotive standard ISO/SAE 21434, which defines engineering requirements used by original equipment manufacturers (OEMs) and their tiers of suppliers to minimize cybersecurity risks and protect road users.
Compliance with ISO/SAE 21434 is recommended, but optional. However, the UN World Forum for Harmonization of Vehicle Regulations has introduced two binding legal regulations, UNECE R155 and UNECE R156. Automakers in regions governed by the UNECE regulations — including the European Union (EU), the United Kingdom (UK), Japan, and South Korea — cannot sell vehicles in those regions unless they comply.
China has introduced its own mandatory vehicle cybersecurity regulation, GB 44495, which aligns with key concepts from UNECE R155 and ISO/SAE 21434, while also incorporating requirements specific to the Chinese market. In India, the automotive industry is bracing for the launch of AIS-189 as a major mandatory baseline for vehicle cybersecurity. AIS-189 is India’s local adaptation of UNECE R155.
Increasingly, these regulations are actively shaping the market offerings of automakers. For example, Porsche had to discontinue sales of its top-selling model, the Macan, in the EU in 2024. Reportedly, the automaker did not consider bringing the existing vehicle platform into compliance with UNECE R155 and R156 economically viable.
How Can Automakers Manage Increasing Regulation?
There’s no question that strict compliance with cybersecurity regulations and standards is necessary. However, implementing these requirements across today’s software-defined vehicles places a significant burden on OEMs and their suppliers.
Modern vehicles combine extensive connectivity, complex software architectures, and contributions from numerous Tier 1, Tier 2, and lower-tier suppliers. To demonstrate compliance with regulations and standards, manufacturers must systematically identify cybersecurity threats, assess risks, define mitigations, and maintain evidence throughout the vehicle lifecycle.
This challenge has elevated Threat Analysis and Risk Assessment (TARA) from a specialized cybersecurity activity to a critical engineering discipline. TARA provides the structured methodology automakers use to identify potential attack scenarios, evaluate their impact, prioritize risks, and justify cybersecurity controls across increasingly complex vehicle architectures.
Today automakers must balance the rigors of conducting a comprehensive TARA, covering all SDV components, with their need for a fast launch of their newest model — and their need for healthy profit margins. Performing a thorough TARA can consume weeks, becoming both a bottleneck and cost center for OEMs. Yet insufficient analysis can create significant downstream risks, including compliance issues, recalls, remediation costs, brand damage, and, in the worst case, impacts on vehicle safety and customer trust.
It’s a daunting task to establish the specialized expertise, let alone the processes and cybersecurity controls, needed to drive threat analysis and risk assessment across the modern global supply chain.
As a result, automakers who take on the TARA challenge alone face growing issues around cybersecurity consistency, traceability, completeness, and analyst capacity. They’re challenged not only to conduct the necessary analysis, but also to document their findings to prove compliance. And, with every design change, the manual TARA process starts over again.
Elektrobit Delivers Robust, AI-Assisted TARA at Scale
The good news? Elektrobit can help. With over 35 years of award-winning automotive software expertise, Elektrobit’s innovative portfolio includes end-to-end cybersecurity solutions that help OEMs and their suppliers meet the growing challenge of SDV cybersecurity.
Cybercriminals and hackers are increasingly using AI to target and attack vehicle systems. Elektrobit counters with advanced, AI-assisted tooling and solutions that identify and eliminate risks at the earliest stages of SDV architecture development, when security interventions are most effective.
By leveraging AI to automate the threat analysis and risk assessment process, Elektrobit makes TARA execution faster, more resource-efficient, and more consistent. Elektrobit’s proprietary toolkit combines specialized AI agents, structured workflows, and domain-specific cybersecurity expertise to accelerate the TARA process without sacrificing engineering rigor.
Instead of relying on a time-consuming, step-by-step approach, Elektrobit software supports parallel risk analysis across multiple assets and system elements. This enables automakers to scale TARA activities across complex vehicle architectures and supply chains while maintaining consistency and engineering rigor.
Designed to support compliance with ISO/SAE 21434, UNECE R155, AIS-189, AIS 190, and other emerging cybersecurity regulations, Elektrobit’s solutions generate auditable cybersecurity work products suitable for regulatory reviews and assessments.
A Single, Expert Source for Cybersecurity: The Elektrobit Difference
While many vendors offer cybersecurity services and solutions, few combine proven, validated cybersecurity expertise with AI-enabled engineering execution. Elektrobit brings together certified cybersecurity management capabilities, experienced analysts, and advanced engineering tooling for single-source TARA assistance.
Automotive cybersecurity expertise is deeply embedded in Elektrobit’s products and culture. In fact, Elektrobit maintains an independently assessed Cybersecurity Management System (CSMS), verified by UL Solutions, that provides customers with third-party validation and a high degree of confidence.
By working with Elektrobit, customers benefit from a development partner that applies the same cybersecurity discipline internally that regulators expect across the automotive supply chain. Internal cybersecurity teams can focus on higher-level security decisions and risk evaluation, while Elektrobit’s AI-assisted workflows deliver consistency, accuracy, and completeness.
The end result? Faster delivery of actionable cybersecurity guidance throughout the development cycle, particularly during the initial architecture and concept phases when security decisions have the highest impact and the lowest cost.
As the system architecture changes and evolves, threats and risks can be quickly and efficiently reassessed without starting from scratch. TARA transforms from a one-time, resource-intensive task to a dynamic, repeatable, and highly automated process that covers the complex SDV supply chain.
Cybersecurity Is an Opportunity, Not an Obstacle
Today cybersecurity assessments represent a significant bottleneck for the world’s automakers as they drive increasingly aggressive development schedules.
For OEMs that can accelerate cybersecurity engineering while maintaining rigor and consistency, cybersecurity becomes a competitive advantage. Automakers can match their leading-edge SDV designs with equally advanced, robust cybersecurity protocols and controls, while still getting to market first — creating a win-win for both consumers and shareholders.
Contact the automotive cybersecurity experts at Elektrobit to jumpstart this transformation in your own supply chain. From concept development through field maintenance, we’ll help you minimize your cybersecurity risks — while maximizing your rewards with industry-leading cybersecurity engineering.
Author
David LehmeierPrincipal engineer cybersecurity
