Connected Vehicle Cybersecurity Market

Vehicle security stopped being a reputational question when regulators made it a condition of type approval: a car that cannot demonstrate it simply cannot be sold. Douglas Insights values the connected vehicle cybersecurity market at USD 4.18 billion in 2025 and expects USD 13.6 billion by 2035, compounding at 12.53%. The estimate is built from the bottom up: roughly 72 million connected vehicles produced in 2025 carrying cybersecurity content, at an average security spend of USD 58 per vehicle covering embedded security hardware such as hardware security modules, in-vehicle security software such as intrusion detection and secure gateways, vehicle security operations centres and monitoring, and testing, compliance and consulting, triangulated against vehicle production, regulatory requirements and supplier disclosures. Connected vehicles grow 4.0% a year as connectivity becomes standard, while security spend per vehicle rises 8.2% a year as regulation mandates lifecycle security and software defined vehicles expand the attack surface. General automotive software counted in our separate automotive software coverage is excluded. This study sits within our automotive software and E/E coverage and follows the published Douglas Insights methodology.

What changed when regulators made cybersecurity mandatory?

Cybersecurity went from an optional engineering concern to a condition of selling a vehicle, which transformed how carmakers budget for it. For years, vehicle security was addressed unevenly, and demonstrations by researchers showing they could remotely take control of a car’s steering or brakes (whose sensing is sized in our Automotive Steering Angle Sensor Market report) through its connected systems highlighted the risk. The United Nations vehicle regulation on cybersecurity, adopted in the international framework used for vehicle type approval, requires manufacturers to operate a certified cybersecurity management system covering the entire vehicle lifecycle, from design through production and years of operation after sale, and to show how each vehicle type is protected. The European Union made this mandatory for all new vehicles registered from mid 2024, and other markets that follow the framework, including Japan and South Korea, apply it as well, with a companion regulation covering secure software updates. Carmakers that cannot demonstrate compliance cannot sell vehicles in these markets. This created sustained spending on security engineering, testing, monitoring and supplier management. The exclusive chapter of this report maps regulatory requirements by market against security content per vehicle, since compliance obligations largely set spending.

What does this market include?

This study covers products and services that protect connected vehicles against cyber attack. Embedded security hardware covers hardware security modules, secure elements and cryptographic hardware built into vehicle computers. In-vehicle security software covers intrusion detection and prevention systems, secure gateways and firewalls, secure boot and cryptographic software, and security for over the air updates. Vehicle security operations centres and monitoring cover services that monitor vehicle fleets for attacks after sale and respond to incidents. Testing, compliance and consulting cover penetration testing, security assessment, threat analysis and support for regulatory certification. General vehicle operating systems and software, enterprise information technology security for carmakers’ offices, charging station security, and insurance sit outside the boundary. Value is measured at spending by carmakers and suppliers.

Why do software defined vehicles raise the stakes?

Because the more a vehicle’s functions depend on software and connectivity, the more ways an attacker can reach them, and the more serious the consequences of a successful attack. Modern vehicles contain many computers and tens of millions of lines of code, connect to mobile networks, smartphones, charging stations and cloud services, and increasingly receive software updates over the air. Carmakers are moving toward software defined vehicles, in which features are delivered and upgraded through software on centralised computers rather than fixed at the factory. Each connection and software component is a potential entry point, and because centralised computers control many functions, a compromise could affect steering, braking or battery systems, or allow theft of vehicles and personal data at scale. Security therefore has to be built into the vehicle architecture from the start and maintained for the vehicle’s life of a decade or more, which requires continuous monitoring and updates. This lifecycle obligation is why security operations and monitoring services are growing fastest and why security spend per vehicle rises well above vehicle production growth.

What drives demand?

The first driver is regulation. Mandatory cybersecurity management and software update regulations in Europe, Japan, South Korea and other markets require carmakers to invest in security across the vehicle lifecycle.

The second driver is software defined vehicles. Centralised computing, over the air updates and connected services expand the attack surface and the security content required.

The third driver is connectivity growth. Nearly all new vehicles are becoming connected, extending security requirements across the whole market.

The fourth driver is supply chain security policy. Government concerns about foreign connected vehicle technology, including rules in the United States restricting connected vehicle software and hardware from certain countries, add requirements for supply chain assurance.

What restrains the market?

Three restraints are modelled. Cost pressure is the first: carmakers under margin pressure resist adding cost per vehicle, pushing security suppliers toward integrated, lower cost solutions. Skills shortages are second: automotive security expertise is scarce, limiting how quickly carmakers and suppliers can build capability. Fragmentation is third: vehicles combine components from many suppliers with different security approaches, and integrating and managing security across this supply chain is complex, which can slow adoption of comprehensive solutions.

Which categories carry the value?

Embedded security hardware holds 30% of 2025 value, USD 1,252.8 million, built into the vehicle computers that need cryptographic protection. In-vehicle security software also holds 30%, USD 1,252.8 million, covering intrusion detection, gateways and secure update systems. Vehicle security operations centres and monitoring account for 22%, USD 918.7 million, and grow fastest as regulation requires monitoring vehicles throughout their service lives. Testing, compliance and consulting contribute 18%, USD 751.7 million. Each category is modelled through 2035 by region.

Where is vehicle cybersecurity spending concentrated?

Asia Pacific leads with 46% of 2025 value, USD 1,921.0 million, and grows fastest at 13.4% a year, reflecting the region’s share of global vehicle production, particularly China’s large and rapidly digitising vehicle industry and its own vehicle security standards, together with Japan and South Korea applying the international regulation. Europe holds 26%, USD 1,085.8 million, at 11.4%, where mandatory regulation has driven early and extensive investment. North America holds 22%, USD 918.7 million, at 12.2%, driven by connected vehicle supply chain rules and industry standards. Latin America contributes USD 125.3 million at 11.0%, the Middle East USD 83.5 million at 12.0% and Africa USD 41.8 million at 11.6%. Six regional models sum to the global figure, with country tables in the Excel model, and the split follows vehicle production.

Who supplies vehicle cybersecurity?

Suppliers include automotive component companies, specialists and semiconductor makers. Bosch, through its ETAS and ESCRYPT activities, Continental’s Argus, Harman, Aptiv and Vector offer security software and services. Specialists including Upstream, VicOne, Karamba and C2A focus on intrusion detection, monitoring and security operations. Semiconductor companies such as Infineon, NXP, Renesas and STMicroelectronics supply the hardware security modules embedded in vehicle chips. Testing and certification firms provide penetration testing and compliance support, and carmakers build internal security teams and security operations centres. The competitive chapter profiles each supplier’s offering, carmaker relationships and regional presence.

How is vehicle cybersecurity priced?

Average security spend is USD 58 per vehicle in 2025, varying widely by vehicle type and architecture. Hardware security modules are often embedded in microcontrollers, with their cost included in chip prices, while software is licensed per vehicle or per electronic control unit. Security operations services are priced per connected vehicle per year, creating recurring revenue across the vehicle’s life. Testing and compliance are priced as projects for each vehicle programme. Premium and software defined vehicles carry more security content than basic vehicles. As regulation requires lifecycle monitoring and architectures become more complex, spend per vehicle rises, which is the reason for the strong positive value leg. The pricing chapter publishes spend bands by category and vehicle type.

How do the scenarios diverge by 2035?

The base case carries 4.0% growth in connected vehicles and 8.2% growth in security spend per vehicle for a 12.53% revenue CAGR and USD 13,594.5 million in 2035. The cost-pressure scenario, in which carmakers minimise security spend to meet regulatory minimums, sets the legs at 3.0% and 5.4%, landing near USD 9,570 million. The high-threat scenario, in which major attacks raise the priority of security and regulation tightens further, sets them at 5.0% and 10.4%, carrying the market past USD 18,160 million. Each 1-point change in spend per vehicle growth moves the 2035 figure by roughly USD 1,240 million.

Which rules and standards apply?

Three layers matter. Type approval regulation comes first and is decisive: the international regulations on cybersecurity management systems and software update management, applied in Europe, Japan, South Korea and other markets, make security a condition of vehicle approval. Engineering standards are second: the international standard for road vehicle cybersecurity engineering defines how security is managed through the vehicle lifecycle and underpins compliance. Supply chain and data rules are third: restrictions on connected vehicle technology from certain countries, national vehicle security standards in China, and data protection laws governing vehicle data add requirements. The regulatory chapter maps these requirements by market.

Why does security now last as long as the car?

Traditionally, a carmaker’s responsibility for a vehicle’s technology largely ended when it left the factory, apart from recalls. Cybersecurity regulation changes that: manufacturers must monitor for threats, detect attacks and fix vulnerabilities for the whole period a vehicle type is on the road, which can be well over a decade. This means carmakers need security operations centres that watch fleet data for signs of attack, processes to assess new vulnerabilities, and the ability to deploy security fixes over the air to millions of vehicles. It also means that security costs continue long after a vehicle is sold, creating a recurring service market. For carmakers, this is a significant new operational commitment; for suppliers, it creates ongoing revenue from monitoring and update services. The model treats lifecycle monitoring as the fastest growing part of the market, as each year’s new vehicles add to the fleet that must be protected.

Douglas Exclusive: the regulation and security content map

This report maps, by market and vehicle segment, applicable cybersecurity regulations, required security capabilities, security content per vehicle by category, and the size of the connected fleet under lifecycle monitoring, converting vehicle production and fleet forecasts into security spending by category and region. Licence holders receive it as a maintained tab in the Excel model.

Methodology and receipts

The model is built bottom-up from vehicles: connected vehicle production by region and segment, security content per vehicle by category, connected fleet under monitoring, regulatory requirements, and realised prices from supplier disclosures, with general vehicle software, enterprise IT security, charging station security and insurance excluded. Every figure carries a numbered source and a confidence grade in the fact sheet above, and the working model ships with every licence. The next scheduled review of this study is September 2027.