Connected vehicles are automobiles equipped with communication technologies that enable continuous data exchange with external systems such as cloud servers, mobile applications, charging infrastructure, and traffic management platforms. These vehicles rely on onboard connectivity, including cellular networks, wireless interfaces, and software-defined control systems, to support features such as remote diagnostics, over-the-air (OTA) software updates, real-time navigation, and vehicle-to-everything (V2X) communication. Importantly, connectivity is independent of the propulsion system; connected vehicles may be internal combustion, hybrid, or electric. However, electric vehicles (EVs) increasingly rely on connectivity to manage battery performance, charging behavior, and energy optimization, making cybersecurity particularly critical in connected EV architectures.

Modern connected EVs are built around distributed electronic architectures comprising multiple electronic control units (ECUs) interconnected through in-vehicle networks such as Controller Area Network (CAN), FlexRay, and Automotive Ethernet. These ECUs control core vehicle functions, including battery management, motor control, braking, thermal systems, infotainment, and advanced driver assistance systems. External connectivity is typically enabled through a telematics control unit that bridges the in-vehicle network with cloud platforms and external services. While this architecture enables intelligent and adaptive vehicle operation, it also expands the attack surface, exposing safety-critical systems to cyber threats.

One of the most significant cybersecurity challenges arises from the design of in-vehicle communication protocols. Protocols such as CAN were originally developed to prioritize reliability and low latency rather than security. They lack native mechanisms for message authentication, encryption, or access control. If attackers gain access to the vehicle network through compromised infotainment software, wireless interfaces, or diagnostic ports, they may be able to inject malicious messages that influence vehicle behaviour. In connected EVs, such intrusions could affect torque delivery, regenerative braking, or thermal management systems, posing both safety and reliability risks.

Battery management systems represent a unique cybersecurity concern specific to electric vehicles. The BMS is responsible for monitoring and controlling cell voltages, temperatures, current flow, and state-of-charge parameters to ensure safe and efficient battery operation. Because EV batteries store high levels of energy, any cyber manipulation of BMS data or control logic can have serious consequences. Unauthorized changes to charging limits or thermal thresholds could accelerate battery degradation, reduce range, or, in extreme scenarios, lead to unsafe operating conditions. Protecting BMS communication pathways and ensuring data integrity is therefore a critical cybersecurity requirement in connected EVs.

Over-the-air software updates play a central role in connected EV platforms, enabling manufacturers to deploy performance enhancements, bug fixes, and security patches remotely. While OTA capabilities reduce maintenance costs and improve vehicle longevity, they also introduce potential attack vectors. If update mechanisms are not adequately secured, attackers could intercept, alter, or spoof software updates, leading to the installation of malicious firmware across vehicle fleets. Secure boot processes, cryptographic authentication, and end-to-end encryption are essential to safeguarding OTA update pipelines.

Cloud connectivity further extends the cybersecurity boundary beyond the vehicle itself. Connected EVs rely on backend systems for services such as remote vehicle access, navigation, fleet management, and energy analytics. Vulnerabilities in cloud infrastructure, application programming interfaces, or mobile applications can indirectly compromise vehicle security. Weak authentication or improper access control could allow unauthorized users to unlock vehicles, access sensitive data, or issue remote commands. As a result, cybersecurity in connected EVs must be addressed holistically, covering both in-vehicle systems and off-board digital ecosystems.

Vehicle-to-everything communication introduces additional challenges. Connected EVs increasingly interact with charging stations, power grids, traffic signals, and other vehicles to enable smart charging, traffic optimization, and cooperative safety features. These interactions depend on the authenticity and reliability of exchanged data. Spoofed messages or denial-of-service attacks targeting V2X communication could disrupt charging operations, mislead vehicle systems, or degrade overall grid and traffic efficiency, highlighting the need for secure communication frameworks and trust management mechanisms.

The growing reliance on software-defined functions and data-driven algorithms further complicates the cybersecurity landscape. Advanced driver assistance systems, energy optimization strategies, and predictive maintenance tools depend on complex software stacks and continuous data exchange. Attackers may target software vulnerabilities or attempt to manipulate data inputs to influence system behaviour. Ensuring secure software development practices, robust validation, and continuous anomaly detection is essential to protect these intelligent vehicle functions.

Regulatory frameworks are increasingly shaping how cybersecurity is addressed in connected vehicles. Standards such as UNECE WP.29 require automakers to implement cybersecurity management systems and demonstrate continuous risk assessment throughout the vehicle lifecycle. For connected EVs, this means integrating cybersecurity considerations from initial design through production, deployment, and post-sale operation. Compliance with such regulations reinforces the need for cybersecurity-by-design and ongoing threat monitoring.

Connected electric vehicles operate at the convergence of mobility, energy, and digital technologies, offering significant benefits in efficiency, performance, and user experience. At the same time, their connectivity and software-centric architectures introduce complex cybersecurity challenges that span vehicle hardware, communication networks, cloud systems, and data platforms. Addressing these challenges is essential to ensure vehicle safety, protect user data, and build trust in the connected and electrified mobility ecosystem.

Click here to learn more about Electric Vehicles on everything PE.