Cybersecurity experts warn that over-the-air (OTA) updates introduce new risks, including potential cyberattacks, data breaches, and interference with vehicle systems by malicious actors, which could pose national security concerns.

Recent security tests on electric buses revealed remote access to critical systems, prompting investigations by the UK and Denmark and signaling industry-wide vulnerabilities beyond a single manufacturer.

Policy discussions in the United States emphasize stricter security reviews, transparency about data collection, and tighter controls on foreign-made automotive software and hardware.

OTA updates are increasingly used by auto manufacturers to remotely deliver software updates, bug fixes, and new features to connected vehicles, following a trend popularized by smartphone ecosystems.

In the software-defined era, protecting a vehicle means securing the code inside it, as cyber threats may target the vehicle itself rather than external devices.

The scope of OTA risk extends beyond passenger cars to buses, fleets, rail, ships, industrial robots, and drones, underscoring the need to treat cybersecurity as an essential component of automotive safety.

Software-defined vehicles increasingly receive OTA updates, making maintenance easier but creating new cybersecurity risks.

The expanded attack surface from always-connected vehicle software raises concerns about attackers compromising update infrastructure or vehicle systems, potentially affecting safety and privacy.

Experts warn this could become a national security issue, with governments reassessing regulation and oversight of connected vehicles.

Analysts emphasize that OTA vulnerabilities could be exploited to sabotage or disable moving vehicles, raising concerns about data privacy and the integrity of critical vehicle controls.

Norway’s Ruter bus test highlighted OTA security vulnerabilities, such as a battery and power control system accessible via mobile networks through a Romanian SIM card, illustrating how a bus could theoretically be stopped or rendered inoperable.

OTA updates are praised for being faster and cheaper than recalls or service-center updates, improving vehicle software management over time.