The modern vehicle is yet another device in the large Internet of Things. With the touch of a button, it can move forward from a tight parking space towards you; with another touch, it can park itself without any driver manoeuvring. On the road, the vehicle checks for obstacles in all directions using AI trained on vast road data and keeps you in the same lane, cruising adaptively based on vehicle trafficking front of you. It alerts you when you are drowsy at the wheel, checking your health against the indicators used to train its AI model. It determines the ideal cabin temperature while passengers enjoy streaming services on the car’s infotainment system. Now more than ever, the modern vehicle is a smartphone that can move, and soon, take us wherever we desire.
Traditional vehicles were independent mechanical machines operating in isolation, with complete reliance on driver control and line of sight. The rise of technological capabilities brings about a more connected, software-defined vehicle ecosystem, offering driver assistance through real-time environmental processing. Today, connectivity and software features are being increasingly viewed as foundational components of the vehicle rather than optional value-adds. According to the 2026 Deloitte Global Automotive Consumer Study (GACS) – India, about 95 percent of Indian consumers are willing to pay for software-defined vehicle capabilities such as safety, security and continuous vehicle health reporting.
Per the study, India stands out in next-generation mobility readiness, with 81 percent finding software-defined vehicles helpful and 84 percent willing to adopt AI-enabled customisation. As manufacturers innovate the ecosystem, securing the connected vehicle landscape, from mobile applications and cloud systems to charging infrastructure and software updates, is of equal importance as meeting customer feature demands.
The expanding cyber risk landscape in connected vehicles
The increased reliance on connected systems increases associated risks to the vehicle ecosystem, potentially compromising critical operations or the safety of passengers and the supporting infrastructure.
Consider are mote vehicle start feature offered by the vehicle manufacturer through mobile applications. While useful to the consumer, a lack of application security can allow an attacker to hack into the application and gain control, potentially harming the vehicle, passengers, and any infrastructure connected to the application. Remote updates to vehicles can risk installing malicious firmware across fleets, causing massive operational downtime due to time-consuming vehicle recalls for fixes. Tampering with vehicle sensors, especially those that govern AI-enabled autonomous features, can enable attackers to manipulate vehicle steering, braking or acceleration, taking control away from the driver and putting public safety at risk. Cyberattacks on a manufacturer’s cloud infrastructure cannot only cause downtime for connected applications but also expose private user information and vehicle data to hacking.
Towards securing the vehicle lifecycle
Modern software-defined connected vehicles are incredibly complex, containing millions of lines of code, interconnected components, applications, backend devices, enterprise IT and vehicle communication technology, which presents a challenge in securing the vehicle end-to-end.
However, the security of vehicles on the road are determined by the extent of security measures implemented throughout the vehicle production lifecycle. Components, both software and hardware, must be designed with security as the foundation, enabling only authorised personnel to access the vehicle and its components. Manufacturers must detail security expectations for suppliers and ensure visibility into cyber risks across the supply chain. Security checks must involve not only individual components but also interactions among various mechanical and electrical components. Charging infrastructure and battery management systems for electric vehicles must be resilient, given that poorly designed mobile applications may expose infrastructure without proper authentication or authorisation, leaving charging networks vulnerable or enabling malicious manipulation of battery health. Adequate vehicle monitoring capabilities must be in place, with transparent and prompt alerts to the vehicle consumer in the event of a compromise of the vehicle or supporting infrastructure.
According to the 2026 Deloitte GACS report, the country shows the strongest global concern about sharing connected-vehicle data, including 73 percent concerned about personal device data and 72 percent about vehicle location data, pointing to rising expectations around transparency, privacy safeguards and responsible data governance.[PT1] Hence, development of mobile applications and supporting cloud ecosystems must ensure that vehicle and user privacy concerns are addressed at every stage of the development process.
Remote software updates and corresponding channels must be secured with adequate encryption to safeguard packages that can alter vehicle operations. As AI-enabled cyberattacks increase, vehicle manufacturers must ensure resilience of their infrastructure and use AI capabilities to strengthen their defences and recovery mechanisms.
With security at its foundation and AI-enhanced defence mechanisms, both manufacturers and consumers can continue to reap the benefits and momentum of an increasingly connected vehicle in an ever-connected world.
Authored by Santosh Jinugu, Partner, Deloitte India
