Cybersecurity for Autonomous Vehicles: Protecting Road Safety Systems

• Autonomous vehicles (AVs) depend on software, so a cyberattack can become a safety problem.
• Machine learning and AI help detect attacks; some researchers are testing blockchain for data integrity.
• Carmakers like Tesla and Waymo build much of their security in-house, while security vendors sell to the auto industry.
• Regulators are setting cybersecurity requirements for new vehicles.
• Carmakers, suppliers and security firms have to work together on defenses.

Why AV security is a safety issue

Autonomous vehicles promise fewer crashes and more mobility for people who can’t drive. They also run on sensors and complex software, which gives attackers something to aim at. In a self-driving car a hack is not just a data breach. A compromised system could put passengers and pedestrians in danger. Here is where AV security stands and who is working on it.

Technology for defending autonomous vehicles

Machine learning models can learn what normal behavior looks like on a vehicle’s internal networks and flag anomalies. AI systems can then help sort real attacks from noise quickly enough to matter while the car is moving.

Some researchers and suppliers are testing blockchain technology to secure data exchanged between vehicles and infrastructure, using a tamper-evident ledger to show that data has not been altered. It remains experimental. Most production security still relies on encryption and signed software updates.

Who is working on AV security

Carmakers and specialist firms are both involved. Tesla and Waymo build much of their security into their own vehicle designs, and Tesla runs a bug bounty that pays researchers to find flaws; traditional security vendors such as McAfee and Symantec have also pitched automotive security products to the industry.

Cooperation matters because vehicle engineers and security specialists know different things. A secure car needs both.

Rules for vehicle cybersecurity

Regulators are tightening requirements. In the U.S., the National Highway Traffic Safety Administration (NHTSA) publishes cybersecurity best practices for modern vehicles, updated in 2022, which call for monitoring threats and updating software over the life of the vehicle. In Europe, UN Regulation No. 155 has required a certified cybersecurity management system for all new vehicles sold since July 2024.

The European Union’s General Data Protection Regulation (GDPR) also applies. Since connected cars collect location and driver data that has to be handled lawfully.

What it will take

Self-driving cars will only be as safe as their software is secure. That means continuous monitoring, signed updates and regulations with real requirements behind them.

It also means carmakers sharing information about attacks instead of treating them as competitive secrets.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.