Security of connected and automated vehicles (CAV)

Security of connected and automated vehicles (CAV) is critical to ensure safe, reliable, and trustworthy operation in an increasingly connected environment. As vehicles exchange data internally and with external systems, cybersecurity protects safety critical functions from unauthorized access, manipulation, and disruption. CAV security encompasses both in-vehicle security, which protects onboard systems, and V2X security, which secures communications with the surrounding ecosystem. Together, these measures enable resilient, safe, and dependable connected and automated mobility.

In‑vehicle security focuses on protecting the internal digital architecture where safety‑critical decisions are executed. Modern vehicles rely on interconnected electronic control units (ECUs), sensors, actuators, and software platforms communicating over in‑vehicle networks and gateways. Effective in‑vehicle security prevents unauthorized access, malicious code execution, data manipulation, and unintended control of vehicle functions. Key measures include secure ECU design, access control, secure boot and software integrity, network segmentation, intrusion detection, and continuous monitoring throughout the vehicle lifecycle. As vehicles become increasingly software‑defined, strong in‑vehicle cybersecurity is essential to preserve functional integrity and ensure safe operation.

V2X security addresses the protection of communications between vehicles and their external environment, including vehicle‑to‑vehicle (V2V), vehicle‑to‑infrastructure (V2I), vehicle‑to‑pedestrian (V2P), and vehicle‑to‑network (V2N). These communications enable the real‑time exchange of safety‑critical information such as position, speed, traffic conditions, and hazard warnings, improving situational awareness and traffic efficiency. At the same time, they expand the attack surface, introducing risks such as spoofing, replay attacks, jamming, and denial‑of‑service. Robust V2X security relies on strong authentication, message integrity, encryption, certificate and key management, and resilience against communication failures, ensuring trusted and reliable cooperative driving.

The AV cybersecurity assessment approach

TÜV SÜD has developed a cybersecurity assessment methodology specifically for the AV approval process. Based on international cybersecurity standards and current industry best practices, the approach helps organizations identify risks, validate security controls, and support regulatory readiness throughout vehicle development.

1. Identify critical assets

The first step focuses on identifying critical vehicle assets and ensuring cybersecurity risks are properly understood and mitigated. This includes threat analysis and risk assessment (TARA), identification of critical components across the automotive ecosystem, evaluation of cybersecurity threats and risks, and development of cybersecurity concepts to address identified vulnerabilities.

2. Verify security measures

The second step verifies that critical vehicle systems implement effective cybersecurity controls. We review implemented security measures, perform deviation analysis, evaluate alignment between cybersecurity mechanisms and the cybersecurity concept, and provide technical guidance to help organization prepare documentation that meets approval requirements.

3. Validate through testing

The final step confirms that implemented cybersecurity measures perform as intended through testing and validation activities. We review security test results, validate cybersecurity mechanisms, and provides detailed technical reporting to support cybersecurity and roadworthiness evaluations. 

TÜV SÜD supports the automotive industry in securing connected and automated vehicles through independent, end-to-end cybersecurity audits and assessments across the vehicle lifecycle. Through cybersecurity assessments, system level verification, and Cybersecurity Management System (CSMS) evaluations, TÜV SÜD helps OEMs and suppliers identify risks, validate security controls, and demonstrate compliance with key regulations and standards such as UN R155 and ISO/SAE 21434. By combining deep automotive expertise with globally recognized conformity assessment services, TÜV SÜD enables safe deployment, regulatory readiness, and trusted operation of connected and automated vehicles worldwide.