Modern vehicles can contain roughly 100 million lines of code, reflecting the growing software complexity of connected and automated automotive systems.[1] The assumption that vehicles are manufactured hunks of metal rolling down the road is long outdated. The growing dominance of software in the automotive sector has expanded the attack surface of modern vehicles, placing connected vehicle platforms increasingly in the crosshairs of cyber threat actors.
However, software is no longer the sole target of cyber criminals. Automotive hardware systems now also require cybersecurity. Hardware-level attacks such as laser fault injection (LFI) have attracted increasing attention. In an LFI attack, a precisely targeted laser pulse induces faults within a semiconductor device, potentially leading to instruction skips, authentication bypasses, or other unintended behavior. Such attacks might seem improbable until they are not.
This blog explores why automotive cybersecurity must encompass both software and hardware components.
Understanding the Growing Attack Surface of Modern Vehicles
To understand why cybersecurity must embrace hardware alongside software, it helps to trace how the industry has changed over the last decade.
As automotive technologies have advanced, the number of electronic control units (ECUs) has proliferated, each with complex code and circuitry. Today’s vehicles routinely incorporate advanced driver-assistance systems (ADAS), a broad category of technologies that includes lane-keeping, automatic emergency braking, adaptive cruise control, and other perception and control functions. In addition, cars are becoming more connected, receiving real-time traffic information and messages. One of the operating principles of smart cities is that connected vehicles should coordinate with one another for smoother traffic flow. Any of these systems is a likely target for cyberattacks.
As vehicle architectures evolve toward more centralized and zonal designs, principles such as segmentation, isolation, and controlled communication paths become increasingly important. While the approach simplifies cybersecurity implementation, a successful breach could have more catastrophic consequences.
Threat actors can also ride on the coattails of communication protocols. In 2025, researchers disclosed a zero-click wireless CarPlay attack chain in which vulnerabilities in Bluetooth® pairing and iAP2 session setup could be leveraged to access a vulnerable AirPlay software development kit (SDK) path over Wi-Fi®, enabling compromise of affected infotainment systems.[2] In 2015, a pair of researchers demonstrated just how easy it was to take control of a Jeep’s infotainment system, ultimately leading to control of key functions like steering and braking.[3] Vehicles use over-the-air (OTA) software updates, vehicle-to-vehicle (V2V) communication, and Bluetooth, cellular, and Wi-Fi connections. Such an assortment requires more gatekeeping to ensure security.
Against this backdrop, industry standards and regulatory frameworks, such as International Organization for Standardization (ISO) 21434, United Nations Economic Commission for Europe (UNECE) World Forum for Harmonization of Vehicle Regulations (WP.29), and UN Regulation No. 155 (UN R155), reflect the need for stronger and more standardized automotive cybersecurity.[4] However, these regulations entail more than just hardened software. Hardware must also support secure boot integrity and provide tamper resistance.
Protecting Automotive Systems at the Hardware Layer
Manufacturers must use a multi-pronged approach to secure both hardware and software components in vehicles.
Among the many methods used for hardware is a hardware root of trust (HRoT), which provides secure boot, verifies the integrity of the underlying firmware, and stores sensitive cryptographic keys. Hardware security modules are dedicated cryptographic co-processors embedded in electronic components that can generate and store keys, providing secure authentication. Because they isolate key storage and cryptographic operations from the main application-processing environment, these modules can reduce exposure of sensitive material and strengthen the overall security architecture.
Other methods physically separate data-processing areas to enhance security. For example, a trusted execution environment (TEE) is an isolated processing environment within the main processor, out of reach of most operations, that protects vital functions under lock and key. In a data classification approach, data are grouped based on their sensitivity level. Similarly, network segmentation separates data into groups with separate security controls.[5]
Yet another method, physically unclonable functions (PUFs), leverages the inherent minor differences in the manufacturing of electronic components to enable communication that verifies these differences. For example, an input voltage applied to specific hardware will respond in a specific way due to differences in the silicon chip. Any other responses can be tagged as rogue.
Automotive cybersecurity is also focusing on securing in-vehicle networking. The traditional mode of communication within a vehicle’s system, the controller area network (CAN) bus, enables hundreds of microcontrollers to interact without a central computer. Unfortunately, the system is notoriously unsafe because any node on the bus can send a message to any other node, and all nodes are inherently trusted.
Newer methods, such as Controller Area Network Flexible Data-Rate (CAN FD), enable higher data rates and larger payloads than classic CAN. While CAN FD does not inherently provide encryption or authentication, its expanded payload and bandwidth can support higher-layer security mechanisms.
Revving Up for the Future
As vehicles become more software-defined and connected, effective automotive cybersecurity will increasingly rely on hardware-supported security mechanisms such as secure boot, TEEs, and protected in-vehicle communication architectures working alongside software controls and regulatory compliance frameworks.
Poornima Apte is an engineer turned writer with B2B specialties in robotics, AI, cybersecurity, smart technologies and digital transformation.
