Cybersecurity and Software Integrity

An EV is a cyber-physical system: software can control access, charging, propulsion support functions and the data shared with apps or cloud services. Cybersecurity therefore protects safety, privacy and availability, not just information on a screen.

The attack surface

A connected EV is part of a larger system. Its exposed interfaces can include:

cellular, Wi-Fi and Bluetooth connections;
NFC, Bluetooth Low Energy and ultra-wideband digital keys;
the manufacturer's app, owner account and cloud services;
infotainment apps, USB media and paired phones;
diagnostic and service interfaces;
over-the-air update infrastructure; and
the charging connection, charging operator and payment or energy-management services.

An interface is not a vulnerability by itself. Risk depends on what the interface is allowed to do, how strongly users and devices are authenticated, how software is isolated, and how quickly the manufacturer can detect and repair faults.

EVs are not automatically less secure than combustion vehicles. Their close integration with apps, charging and frequent software updates does, however, make the quality of the complete digital ecosystem especially visible to owners.

How a vehicle limits an intrusion

Good vehicle security assumes that one component can eventually fail. Several defensive layers should prevent that failure from becoming control of the whole car.

Hardware-backed trust and secure boot let a controller verify that the software it loads was signed by an authorized party. Signed updates protect authenticity and integrity; encryption alone does not prove who created an update.

Network separation limits communication between domains. Infotainment, telematics, diagnostics, charging and safety-related control should not share unrestricted trust. Gateways can filter messages, authenticate sensitive commands and prevent a compromised entertainment function from freely addressing critical controllers.

Least privilege gives each process, app and technician only the access needed for the task. Remote climate control, for example, does not need the same authority as key enrollment or service programming.

Protected diagnostics require authenticated access, controlled key enrollment and auditable service actions. Physical access to an OBD or maintenance connector should not automatically grant permission to create a key or rewrite a controller.

Monitoring and incident response look for abnormal behavior, support forensic investigation and allow the manufacturer to revoke credentials, update software or contain a compromised service.

NHTSA's current best-practice guidance recommends layered protections, segmentation, logging, vulnerability management and rapid incident response. ISO/SAE 21434 organizes cybersecurity engineering across the vehicle lifecycle, from concept and development through operation, maintenance and decommissioning. NHTSA: Cybersecurity Best Practices for the Safety of Modern Vehicles ISO/SAE 21434:2021 road-vehicle cybersecurity engineering

Updates are a security control

Over-the-air updates can close vulnerabilities without a workshop visit, but the update mechanism is itself a high-value target. A sound process needs more than a download button:

the package and its source are authenticated;
the vehicle checks that the software matches its exact hardware and configuration;
installation occurs only under safe conditions;
interrupted or failed updates have a defined recovery path;
installed versions and dependencies remain traceable; and
the manufacturer can investigate problems after deployment.

UN Regulation No. 155 establishes requirements for a manufacturer's Cyber Security Management System and vehicle type approval in participating markets. UN Regulation No. 156 addresses Software Update Management Systems and vehicle update processes. ISO 24089 covers software-update engineering at organizational and project level. These are process and approval frameworks, not a promise that a particular vehicle can never be compromised. UNECE: UN Regulation No. 155 on vehicle cybersecurity UNECE: UN Regulation No. 156 on software updates ISO 24089:2023 road-vehicle software update engineering

Update support also has an ownership dimension. A vehicle that remains in service for many years needs a clear policy for security fixes, compatible replacement modules and the eventual end of connected-service support. An unexplained loss of updates or app access can remove a security layer even when the car still drives normally.

Apps, accounts and digital identity

The owner's account may be able to locate the car, unlock it, share access or initiate remote functions. Account security is therefore part of vehicle security.

Owners should use a unique password, enable multi-factor authentication when offered, protect the recovery email account and review every authorized driver and mobile device. A shared digital key is a credential, not merely a saved contact. It should have the narrowest practical permission and expiry, then be revoked when it is no longer needed.

Manufacturers should separate routine remote functions from high-impact actions such as ownership transfer, adding a driver or enrolling a new key. Those actions merit fresh authentication, clear alerts and an audit trail. Sensitive credentials should be protected in hardware-backed storage where supported.

The European Data Protection Board recommends local processing where practical, straightforward deletion controls, and logical or physical separation of vital functions from telecommunications. Those privacy measures also reduce the amount of data or authority exposed when an online service is compromised. EDPB guidelines for personal data in connected vehicles

Charging is part of the security boundary

Connected charging links the EV to equipment operated by a home owner, employer, charging network or utility. The ecosystem can include the vehicle, charger, local network, operator cloud, payment service and energy-management platform.

NIST's cybersecurity profile for extreme-fast-charging infrastructure identifies risks across all of those domains. Possible consequences include loss of service, stolen data, manipulated charging behavior and wider operational disruption. It does not mean that connecting to an unfamiliar charger automatically gives it control of the vehicle; the relevant question is how each system authenticates peers, validates messages and isolates the charging interface from other vehicle functions. NIST: Cybersecurity Framework Profile for EV fast-charging infrastructure

For owners, the practical controls are modest: install charger firmware updates, change default administrator credentials, secure the home network, use trusted operator apps and inspect unexpected account or charging activity. Damage, loose connectors and electrical faults are safety issues and should be handled under charging and service guidance rather than treated as evidence of a cyberattack.

What owners can evaluate

Most internal security architecture is invisible during a test drive, but buyers can still ask useful questions:

Does the manufacturer state how long the vehicle will receive security updates?
Can the owner enable multi-factor authentication and review active sessions?
Are shared drivers and digital keys easy to inspect and revoke?
Does the app notify the owner when a new key, driver or device is added?
Is there a published channel for reporting security vulnerabilities?
Can personal data and credentials be erased before sale?
Which functions stop working if the subscription, mobile network or cloud service ends?

A long feature list is not evidence of strong security. Clear lifecycle support, restrained permissions and recoverable failure modes matter more.

If something appears compromised

Unexpected unlock alerts, newly enrolled drivers, unfamiliar charging sessions or unexplained account changes deserve prompt action. Use a trusted device to change the manufacturer-account and recovery-email passwords, enable multi-factor authentication, revoke unknown sessions and keys, and contact the manufacturer through an official channel.

If theft or physical intrusion is suspected, contact police and the insurer before confronting anyone or attempting recovery. Preserve relevant notifications, timestamps and video. A warning affecting driving, charging or high-voltage systems requires the vehicle manufacturer's safety and service instructions; cybersecurity troubleshooting should never bypass an interlock or involve opening high-voltage equipment.

For the owner-facing layers that complement cybersecurity, see EV security systems.