Threat modelling a connected vehicle

The client is a German carmaker developing a connected vehicle whose attack surface spans the car, its app, and the cloud. Here, security flaws carry safety risk, and under UNECE R155 demonstrable cybersecurity engineering is a condition of type approval.

They needed to find and address design-level risks before they were welded into production hardware.

A connected vehicle exposed a wide attack surface across the car, its companion app, and the cloud backend. The threats spanned three very different domains that had to be reasoned about together.

Here, flaws carried safety risk, not just data risk, and under UNECE R155, demonstrable cybersecurity engineering is a condition of type approval. The consequences reached from data into physical safety and market access.

The manufacturer needed to find and address design-level risks before they were welded into production hardware. Once in hardware, fixes become enormously more expensive.

We threat-modelled the vehicle, app, and cloud as one connected system against ISO 21434, rather than assessing each in isolation. Modelling the whole system is what surfaces the cross-domain attack paths.

Attack paths were prioritised by anything that could affect safety, so the most consequential risks led the remediation. Safety-first prioritisation is what a regulated automotive programme demands.

We worked with the engineering teams to turn findings into concrete design changes and mitigations, and structured the evidence to align with UNECE R155, supporting the type-approval case directly. Security work fed straight into approval.