ZoZoGo releases the "2026 Automotive Network and Data Security Research Report".
This report focuses on the panoramic landscape of network and data security for connected vehicles in 2026, analyzing core issues such as full-domain attack scenarios, AI-expanded attack surfaces, vulnerability landscape analysis, full-link protection systems, and data classification, grading, and cross-border compliance. Furthermore, by examining the security protection practices of 41 enterprises of various types, including 7 data security-related companies (Agile Technology, Yige Cloud, etc.), 7 representative OEMs (Seres, NIO, BYD, etc.), 8 automotive security hardware manufacturers (Yishi Intelligence, Xintei Technology, etc.), 7 automotive security software suppliers (Ruan'an, Anban, etc.), and 12 connected vehicle security service providers (Weichen Xin'an, Callisto, Quan'an Technology, etc.), the report systematically presents the industry's frontier progress in compliance certification, technology implementation, and supply chain security governance. It also reveals new risks brought by AI integration into vehicles, such as supply chain poisoning and prompt hijacking. Meanwhile, the report summarizes connected vehicle security solutions and predicts industry development trends.
[Executive Summary]
"Compliance Upgrade" Driven by Policy: From "Coping with Inspections" to "Systematic Operation"
Supply Chains Frequently "Breached": Security Must Cover the Full Domain and Full Lifecycle
AI is a "Double-Edged Sword": Attack Surfaces Extend to the "Intent Layer", and Defense Must "Use AI to Combat AI"
Cybersecurity Evolves from "Passive Response" to "Proactive Hunting"
Data Security Shifts from "Privacy Compliance" to "Full-Link Governance", with Cross-Border Becoming a "Mandatory Question"
Security Must Be Transformed from a "Cost Center" into a "Core Capability"
In 2026, the connected vehicle industry stands at a critical turning point. On the one hand, the comprehensive implementation of mandatory national standards such as GB44495/44496 marks the industry's official transition from "compliance exploration" to the "deep water zone of compliance"; on the other hand, the integration of AI large models into vehicles and the normalization of cross-border data flows are rapidly expanding vehicle attack surfaces, creating unprecedented security challenges. For OEMs, mere "passive compliance" or "point defense" can no longer cope with complex cyber threats. Transforming into a systematic security battle featuring "full lifecycle, full supply chain, and AI-driven proactive defense" has become inevitable.
I. "Compliance Upgrade" Driven by Policy: From "Coping with Inspections" to "Systematic Operation"
In 2026, the regulatory framework for automotive cybersecurity and data security in China has basically formed a closed loop. Based on mandatory standards such as GB44495-2024 "Technical Requirements for Information Security of Automobiles" and GB44496-2024 "General Technical Requirements for Automobile Software Upgrades", coupled with the implementation of the "Guidelines for Security of Automobile Data Export (2026 Edition)", the compliance requirements faced by OEMs have been upgraded from past "recommended references" to "mandatory lifelines". Corporate security strategies, organizational structures, and operational processes are facing comprehensive reshaping.
The other hand of regulation is fines. In May 2026, the European data protection authority issued a fine of 100 million euros (approximately 801 million RMB) to the operating company of the ride-hailing app Yango, for transferring users' personal data to Russia without taking protective measures required by EU law; in the same month, General Motors was fined nearly 90 million RMB for collecting and selling driving data without user consent, setting the record for the largest fine since the California Consumer Privacy Act came into effect. The logic behind the fines is clear: data is not an asset that OEMs can take or sell at will.
Facing regulatory pressure, leading OEMs are accelerating their transformation from "passive compliance" to "proactive prevention and control". Seres Automobile is a typical representative. It has built an in-depth defense system covering "cloud-pipe-terminal-chip", and with the first batch of national automotive data security management system certification and the Level 3 certification of the Data Security Capability Maturity Model (DSMM), it has proven that its systematic security capabilities have reached the industry's leading level. Meanwhile, BYD, through its self-developed "iDiQuan" intelligent security platform, follows the three-step logic of "introducing water, purifying water, and activating water" to break data silos, build a high-quality data foundation, and deploy three AI agents, achieving quality and efficiency improvements in security operations and internalizing compliance requirements into strong operational capabilities. The "5 compliance tests" by organizations such as the CAAM (China Association of Automobile Manufacturers) continue to advance, with the third batch of 49 models from 13 enterprises and the fourth batch of 43 models from 9 enterprises passing. Requirements such as anonymization of exterior faces and in-cabin processing of cockpit data are becoming industry standards.
Source: ZoZoGo
Facts have proven that compliance is only the starting point; transforming security capabilities into "internal kung fu" for sustainable operations is the core capability for enterprises to navigate cycles.
II. Supply Chains Frequently "Breached": Security Must Cover the Full Domain and Full Lifecycle
If asked what the most painful lesson for the automotive industry in 2025 was, the answer is highly likely: attackers no longer break in through the front door, but bypass it through your most trusted partners. The supply chain of connected vehicles is exceptionally complex, and a "breach" in any link could trigger a catastrophic consequence like "an ant nest causing a dam to collapse".
In March 2025, the hacker "Rey" publicly released about 700 internal documents of Jaguar Land Rover on the dark web, including source code, development logs, and employee databases—this was just a prelude; in August of the same year, the hacker group "ScatteredLapsus$Hunters" infiltrated its global production system, causing a complete shutdown of its UK factories and forcing 33,000 employees to take leave. Also in that August, Nissan's design subsidiary was attacked by "Qilin" ransomware, with 4TB of core design data stolen; cloud storage provider Snowflake was breached, causing 165 downstream enterprises, including auto parts retailer Advance Auto Parts, to suffer. By the end of 2025, the global wiring harness giant Yazaki Corporation had 350GB of data stolen by a ransomware group, containing all documents for producing parts for BMW and Nissan. The case of the Thai contract manufacturer TRU is even more typical: 1TB of data was stolen, ESXi servers were targeted for encryption, ERP and logistics systems went offline on a large scale, and some production lines were forced to downgrade to manual scheduling.
Looking at these events together, three shifts are clearly visible: the target of attacks has become physical—upgrading from stealing data to stealing core intellectual property and directly paralyzing production; the attack path has become supply-chain-oriented—over half of the incidents were achieved indirectly through cloud service providers, IT subsidiaries, and third-party suppliers, making the supply chain the weakest link; ransomware attacks have become targeted—specifically aiming at high-value data such as design drawings.
Source: Auto Standardization Committee
Problems have been exposed, and the industry's response is also upgrading. OEMs are universally recognized as the "first responsible party" for supply chain security, transmitting responsibilities to Tier 1 suppliers by signing Cybersecurity Interface Agreements (CIA); ISO/SAE 21434 certification has become a hard threshold for Tier 1 suppliers—without this "security letter of credit", it is basically impossible to enter the core supply chain; for the European market, TISAX is an unavoidable qualification. However, the overall landscape remains "led by the top, lagging by the small and medium"—for Tier 2 and Tier 3 small and medium suppliers, most OEMs are still stuck at document reviews, with very low on-site verification coverage and incomplete traceability chains.
Building a supply chain security system covering the "full domain and full lifecycle" has become an industry consensus. Geely Automobile's practice provides an excellent paradigm. Geely has not only built the first batch of CNAS-accredited national-level connected vehicle security laboratories but also, from an attacker's perspective, refined and set up over 200 normalized testing projects across 12 core testing dimensions such as system security, communication security, and data security, feeding research results back into the forward R&D process. In December 2025, Geely officially released the Global Full-Domain Security Center and the "Full-Domain Security 2.0" technology system. The 2.0 system upgrades from the "vehicle safety" perspective to the "human-vehicle-road-cloud-satellite" ecological perspective. While continuing the four major safety domains of life safety, health safety, property safety, and privacy safety, it builds a full-scenario, full-cycle security protection network through the iterative upgrade of nine major safety systems.
Geely Information Security and Privacy Protection (Representative Model: Zeekr MIX)
Source: Geely
Meanwhile, the granularity of security acceptance evaluation for supply chain manufacturers is becoming finer. Several requirements can be described as "hardcore": third-party components must not contain high-risk vulnerabilities disclosed and unpatched 6 months ago; high-risk vulnerabilities must be fixed and re-verified within 72 hours; OTA upgrade packages must be signed with OEM keys, and in some scenarios, dual signatures from suppliers and OEMs are required. The vehicle end must be able to identify and intercept upgrade packages with missing, forged, or tampered signatures. For example, Seres has currently streamlined and integrated its 300 Tier 1 suppliers down to 100, deeply embedding with CATL and Bosch, shrinking the security management radius to a controllable range. At a more fundamental hardware level, taking Xintei Technology as an example, its AliothTTA8 series MCU (Microcontroller Unit) achieves the "dual safety integration" of functional safety ASIL-D and information security EVITA FULL, filling the domestic gap in chassis domain main control chips and ensuring supply chain autonomy and security from the source.
The essence of supply chain security is expanding the security boundary from "my vehicle" to "every line of code, every chip, and every supplier in my vehicle"—full domain, full lifecycle, missing even one link is unacceptable.
III. AI is a "Double-Edged Sword": Attack Surfaces Extend to the "Intent Layer", and Defense Must "Use AI to Combat AI"
The integration of large models into vehicles brings the industry not only smarter cockpits but also a brand-new attack dimension. AI-specific risks such as "supply chain poisoning, prompt hijacking, and excessive agency" are accelerating their migration to the vehicle end. When in-vehicle large models begin to connect to toolchains such as navigation, payment, charging, and vehicle control, the attack chains that originally existed only in cloud chatbots can be seamlessly "transplanted" to the vehicle end; especially in ecosystems connected by the MCP (Model Context Protocol), high-risk attack vectors like "tool poisoning" will directly threaten Linux and Android IVI (In-Vehicle Infotainment) systems.
New-generation agents represented by OpenClaw are attractive due to the "understanding intent to completing the loop" brought by advanced system permissions, but in the in-vehicle environment, this means a digital entity with partial access to vehicle data and vehicle control command invocation rights permanently resides in the system. Prompt injection can induce it to execute unexpected operations; a tampered third-party navigation plugin could become a "digital Trojan horse" that continuously leaks driving habits; harmless "hallucinations" in Q&A scenarios could turn into dangerous operations that mistakenly delete critical data in agent scenarios. More tricky is the regulatory conflict: standards such as ISO 26262, UN R155/R156, and GB44495 all require system behavior to be deterministic, predictable, testable, and traceable, while agents inherently possess "non-determinism" and "emergence" characteristics. What to do? The prescribed remedy is "empowering rather than authorizing"—building permission sandboxes and functional guardrails to restrict agents to safe domains like infotainment; requests involving vehicle control must undergo mandatory arbitration by security middleware; high-risk operations must have human-machine interaction confirmation, keeping humans in the loop for safety-critical decisions.
Attack surfaces are evolving, and defenses must evolve accordingly. The industry's answer is straightforward: use AI to combat AI.
Facing the "spear" brought by AI, the industry must forge a sharper "shield". For example, Anban Technology, with "New Paradigm of Connected Vehicle Security" as its core, has built a new-generation automotive security system centered on "AI large model-driven agent protection + vehicle-end communication protocol security + supply chain security closed loop". By shifting security capabilities from traditional "post-event patching" to "full lifecycle proactive governance":
Relying on large models to perform natural language parsing of whole vehicle E/E (Electrical/Electronic) architecture documents, X vehicle model databases, and VSOC asset inventories, it automatically identifies critical assets such as ECUs, sensors, and communication interfaces, draws asset correlation frameworks, and automatically outputs security goals, security requirements, threat scenarios, and attack paths based on the LLM intelligent TARA (Threat Analysis and Risk Assessment) platform, realizing the automation and visualization of risk assessment.
In the risk handling phase, the platform can combine impact levels, attack feasibility, and risk level matrices to automatically generate handling decisions and push work orders, forming an operational process of "AI discovery - AI analysis - AI decision - AI closed loop", significantly shortening the whole vehicle security assessment cycle.
Anban Technology's AI-Driven New Paradigm of Connected Vehicle Security
Source: Anban Technology
Qi An Xin AISOC is a representative on this path. It has 8 built-in agents responsible for eight operational links: data collection, threat detection, intelligent analysis, intelligent investigation, intelligent response, event eradication, optimization feedback, and report generation. Based on the OODA loop, it builds an autonomous defense system, changing security operations from "people finding events" to "events finding people". Combat data shows: a global luxury OEM, leveraging AISOC, reduced the analysis time for a single alert to under 9 seconds, with an effective alert identification accuracy of 93.1%, a 2.7-fold improvement over the traditional manual mode.
TARA, this traditional security analysis link, is also being redone by AI. Quan'an Technology's "DefenseWeaver" has a built-in GoGoAIAgent, incorporating new risk carriers such as models, training and inference data, prompt entry points, knowledge bases, and tool invocation chains into the TARA scope—its judgment is that risks come not only from code vulnerabilities but also from "models being misled, data being polluted, and tools being abused". This tool serves clients including FAW Bestune, Luxshare Precision, as well as national inspection institutions like CATARC, China Merchants Vehicle Research Institute, and CEPREI (the 5th Electronics Research Institute of the Ministry of Industry and Information Technology), improving TARA analysis efficiency by 80%. Callisto's S3-TARA takes another path: over 10 agents collaborate, screening the optimal solution from 16 candidate chains of thought, backed by a data foundation built from 100,000+ causal chain data, 3 million+ security scenario samples, and 1 million+ knowledge base Q&A pairs.
OEMs are not idle either. BYD's "iDiQuan" platform has deployed three AI agents, specifically tackling email phishing, terminal data leaks, and traffic anomalies, reducing security incident handling time from 45 minutes to 5 minutes; Li Auto and Volcano Engine's collaborative AI intelligent assistant can automatically create work orders, scan code, fix vulnerabilities, and perform re-tests after receiving instructions in Feishu groups, achieving one-stop closed-loop with manual authorization. AI-native is transforming from a slogan into the daily routine of security operations.
IV. Cybersecurity Evolves from "Passive Response" to "Proactive Hunting"
In the field of cybersecurity, the traditional "passive defense" mindset can no longer cope with rapidly evolving attack methods. In 2025, a total of 206 automotive security incidents were discovered, and 238 new vulnerabilities were added. Attack targets have upgraded from stealing data to stealing core intellectual property, and even directly paralyzing manufacturing production. Therefore, OEMs must establish a "combat-oriented" cybersecurity system, possessing "proactive hunting" capabilities from threat detection and analysis to response handling.
The defenders' answer is systematization. Seres' approach is multi-layer in-depth defense of "cloud-pipe-terminal-chip", jointly deploying intrusion detection with Qi An Xin across the CAN, host, and Ethernet layers. VSOC covers about 200,000 vehicles and can also issue "cybersecurity compliance certificates" for models exported to the EU; its intelligent security system covers over 200 vehicle usage scenarios and more than 400 security functions. In April 2026, it released Security 4.0, evolving from passive safety and active safety to "intelligent safety".
The toolboxes of professional security vendors are also upgrading. ZhiChe Xin'an's ACTVSOC+ new-generation intelligent connected vehicle security operations platform is an outstanding representative of this concept. Through the AI streaming computing engine, the platform achieves a 500% improvement in detection performance and builds a whole-vehicle-level security digital twin, capable of modeling over 2,800 in-vehicle signals, achieving precise triple threat positioning of ECU, signals, and scenarios, and shortening threat discovery and response time from the "day level" to the "minute level".
ZhiChe Xin'an's New-Generation AI-Native Connected Vehicle Security Operations Platform ACTVSOC+
Source: ZhiChe Xin'an
At the underlying protocol security level, Shanghai Control Security's SmartRocketTestSec automated intelligent fuzzy penetration testing tool can conduct deep fuzzy attacks and penetration testing on mainstream in-vehicle protocols such as SOME/IP, DoIP, and CAN/CAN FD, proactively mining hidden vulnerabilities and shifting the security defense line forward to the R&D and testing phase. Yishi Intelligence's SecIC-HSM firmware serves nearly 30 OEMs, running AES performance to 4.8Gbps on Infineon AURIX TC4X, executing OTA upgrade verification and SecOC secure communication in parallel, ensuring upgrades do not interrupt CAN bus communication. These cases help OEMs achieve the leap from "mandatory compliance" to "proactive security".
From OEMs to suppliers, a clear consensus is: point security products cannot solve systemic security problems; in-depth defense and proactive immunity are the correct solutions.
V. Data Security Shifts from "Privacy Compliance" to "Full-Link Governance", with Cross-Border Becoming a "Mandatory Question"
Data is the "blood" of intelligent vehicles, and its security runs through the full lifecycle of collection, transmission, storage, usage, sharing, and destruction. The particularity of data security lies in: data not only carries privacy and compliance attributes but also directly participates in perception training, map services, model iteration, remote operations, and accident tracing. Once data is mistakenly collected, transmitted, used, or tampered with, it is not just a matter of receiving fines; it could also reversely affect vehicle behavior.
On February 3, 2026, the MIIT (Ministry of Industry and Information Technology), CAC (Cyberspace Administration of China), and six other departments jointly released the "Guidelines for Security of Automobile Data Export (2026 Edition)", classifying exported data into three categories for management: general, important, and sensitive, while providing nine exemption scenarios—warranty and maintenance data, OTA remote upgrade data, security vulnerability repair materials, etc., are all included. The threshold for declaration is also clearly drawn: providing important data overseas, or cumulatively providing personal information of over 1 million people or sensitive personal information of over 10,000 people overseas, requires declaring for data export security assessment. For the Chinese automotive industry, which saw a 65.3% year-on-year surge in exports from January to June 2026, this guideline ends the "gray area" of cross-border data, shifting from "exploratory probing" to "definitive compliance". Overseas regulation is also tightening: the 12-step compliance route of GDPR awaits OEMs going global; the amendment to Japan's APPI introduces for the first time a surcharge system based on profits from violations; South Korea's PIPA has entered a high-pressure governance stage—cross-border data flow has become a "mandatory question" with overlapping multi-jurisdictional laws.
OEMs have their own approaches. NIO's guard mode remote viewing function achieves end-to-end encryption throughout the process and real-time desensitization; license plates and faces in the footage are automatically blurred, and even NIO itself cannot decrypt it—it is the first domestic OEM to provide compliant "remote viewing"; its self-developed NPCC framework is the industry's first end-cloud integrated AI agent security framework, where sensitive data is "burned after computation". Leapmotor adheres to the "in-vehicle processing" principle; in-vehicle cameras only collect feature points for local computation and do not upload them to the cloud, using AES-256 end-to-end encryption during transmission. Zeekr's "data safe" uses a zero-trust mechanism for graded access, initiating data circuit breakers within 20 seconds upon detecting abnormal access, and storage media can be physically destroyed. Xpeng looks further ahead, cooperating with Alibaba Cloud to bring post-quantum security algorithms to the brand-new P7, now covering digital keys, remote vehicle control, OTA, and other businesses across all models.
Source: NIO, ZoZoGo
Data security service providers' solutions are also being refined. Yige Cloud's Yunshu AI-DLP expands the governance target from "humans" to the dual subjects of "human employees + AI employees", applying the same identity, same policies, and same audits, with refined control over data leakage actions such as external sending, downloading, copying, and screenshotting. Geely Holding, Li Auto, Leapmotor, and Seres are all its clients; Agile Technology's EDLP solution, with an innovative architecture deeply integrating "encryption + DLP", starts from the data source to build a full closed-loop prevention and control system of "identification-classification-encryption-control-audit", ensuring that core design drawings, R&D data, and other trade secrets remain secure in the AI era. In May 2026, Agile Technology just won the bid for a 5,000-point data security project of a leading enterprise in the automotive industry.
Main Features of Agile EDLP
Source: Agile Technology
In terms of data cross-border compliance, CATARC (China Automotive Technology and Research Center) has turned data cross-border into a four-step full-process service of "path planning - risk assessment - strategy formulation - assessment declaration", helping OEMs clarify data flows and ensure compliance is "preventable, controllable, and traceable".
VI. Security Must Be Transformed from a "Cost Center" into a "Core Capability"
Looking forward from the middle of 2026, several trends are already quite clear.
Source: ZoZoGo
With trends clear, how to implement the engineering? Combining the practices of leading enterprises, there are several things worth OEMs taking immediate action on:
Build the system into processes, rather than hanging it on the wall. Build a CSMS/SUMS system covering the full lifecycle with ISO/SAE 21434 as the main axis, shift TARA forward to the concept and design stages, and let security "shift left"; strictly enforce SBOM and code security requirements for suppliers, and transmit responsibilities layer by layer using CIA (Cybersecurity Interface Agreement).
Transform VSOC from an "alert dashboard" into an "operations hub". The efficiency improvement path is specific: alerts move from "quantity noise reduction" to "root-cause-level closed loop", tagging all alerts with root causes, replacing static grading with dynamic weighting models, and using "one-click context encapsulation" to reduce the analysis time for a single alert to 15 minutes; emergency plans are made into scenario cards, with high-frequency scenarios equipped with semi-automated SOAR playbooks, automatically fixing evidence and generating reports; at the underlying level, build a vehicle security data middle platform so that operations personnel no longer need to log into five or six systems to search for a single VIN; at the team level, build SOP libraries and knowledge bases, replacing annual large-scale drills with normalized "micro-drills".
Make data security a full-link engineering project. Classification and grading are the foundation; encryption, desensitization, access control, and export monitoring are the grips; cross-border business follows the four steps of "path planning - risk assessment - strategy formulation - assessment declaration", shifting from project-based responses to normalized operations.
Use AI in the right places. Use AI TARA to improve threat modeling efficiency, use AI SOC to reduce alert analysis costs, and use digital twins to refine risk granularity—while putting "permission sandboxes" and "functional guardrails" on in-vehicle agents, always leaving a human gate for high-risk operations.
Security construction needs to shift from a "cost center" to a "core capability". Compliance-driven becomes the foundation, and security operations determine the upper limit. In the deep water zone of "AI-defined vehicles", the weight of this statement will only grow heavier.
[Contact Information] Mobile number is the same as WeChat number
Industry Research Department | Mr. Fu 15810027571
Mr. Zhao 18702148304
Data Service Department | Ms. Zhang 13716037793
Strategic Consulting Department | Ms. Han 15810133447
Promotion and Communication Department | Ms. Liao 13718845418
Mr. Du 13910162318