As AI applications in smart vehicles become increasingly widespread, cybersecurity vulnerabilities in connected vehicles are becoming more evident. According to Taiwan-based automotive cybersecurity specialist VicOne, a subsidiary of Trend Micro, the number of automotive vulnerabilities reached a record high in 2024, with over 77% occurring in in-vehicle or onboard systems.
Leveraging over 30 years of Trend Micro's cybersecurity expertise, VicOne provides advanced automotive protection and deep security insights to help create safer, smarter vehicles. Recently, the company released the "Shifting Gears – VicOne 2025 Automotive Cybersecurity Report," which highlights critical cybersecurity risks facing the global automotive industry.
The report indicates that in 2024 alone, 530 automotive-related common vulnerabilities and exposures (CVEs) were reported—a record high, nearly doubling the figure from 2021. The growing attack surface and rising system complexity have shifted vulnerabilities from chip-related issues to in-vehicle infotainment (IVI) systems, operating systems, and electric vehicle (EV) charging infrastructure.
VicOne CEO Max Cheng noted that the industry is transforming mobility technologies. AI is enabling automakers to differentiate their vehicles, accelerate time-to-market, and enhance customer experiences. However, as software-defined vehicles (SDVs) and AI-powered innovations advance, so do cybersecurity threats, Cheng said, adding that the expanding EV charging ecosystem and the increasing complexity of in-vehicle systems have further intensified security risks.
Evolving cyber threats in the automotive industry
VicOne pointed out that cloud and backend systems have become the most common attack vectors, with threats including ransomware attacks, data breaches, and social engineering scams. Meanwhile, onboard system vulnerabilities are often exploited for vehicle hijacking, supply chain attacks, keyless entry breaches, and over-the-air (OTA) update manipulation.
In addition, cybercriminals are increasingly targeting suppliers and third-party component providers, the weakest links in the highly interconnected automotive supply chain. These attacks expose the industry to significant operational and financial risks, making proactive, multi-layered cybersecurity strategies essential for safeguarding vehicles and ensuring long-term success.
AI: A double-edged sword for cybersecurity
While AI presents immense opportunities, it also introduces new operational, financial, and strategic risks for automakers. As the foundation for generative AI, large language models (LLMs) have become prime targets for cybercriminals due to their reliance on critical corporate data, their unpredictable autonomous learning, and their vulnerability to manipulation.
According to VicOne, major operational risks in AI applications include insecure plugin designs, improper output handling, and adversarial attacks. Additionally, the industry faces emerging strategic risks, such as significant shifts in governance structures and accountability, as well as financial risks related to risk management and brand reputation.
As the automotive industry navigates this evolving cybersecurity landscape, adopting robust security measures across the entire supply chain will be crucial to mitigating risks while embracing the future of AI-driven mobility, VicOne stressed.
Article translated by Willis Ke and edited by Jerry Chen
