Automotive cybersecurity covers everything it takes to secure a modern, software-defined vehicle and the supply chain behind it: offensive testing of ECUs and full vehicles, threat analysis and risk assessment (TARA), product threat intelligence, TISAX assessment support for suppliers, and the engineering evidence UN R155 type approval and ISO/SAE 21434 demand. It is a wider remit than automotive penetration testing alone, and the companies below cover different parts of it.
The list includes pure-play vehicle security specialists with hardware labs and published vehicle research, broader security research firms with genuine automotive credentials, and consultancies supporting TISAX and automotive supply-chain security. PCA Cyber Security leads the list as the directory's only pure-play automotive specialist, with a dedicated ECU and vehicle lab, Pwn2Own Automotive participation, and reports mapped to ISO/SAE 21434 and TARA outputs.
Related: Automotive pen testing companies · Product threat intelligence providers · TISAX compliance pen testing
The work splits into a few distinct disciplines, and few firms cover all of them.
Offensive vehicle testing is the core: penetration testing of ECUs and components on the bench, full-vehicle assessments, in-vehicle networks (CAN, automotive Ethernet), OTA update backends, telematics, companion apps, and EV charging infrastructure including OCPP. It needs a hardware lab, debug tooling, and software-defined radio capability.
Compliance engineering turns that testing into regulatory evidence. UN R155 makes a certified Cyber Security Management System a condition of type approval across UNECE markets, and ISO/SAE 21434 is the engineering standard authorities expect evidence against. Strong providers deliver reports mapped to 21434 clauses and TARA outputs so findings slot straight into a type approval submission.
Supply-chain assurance is the third strand. TISAX is the assessment standard the German OEMs require of their suppliers, and consultancies in this list support suppliers through TISAX readiness and assessment. Product threat intelligence, the ongoing monitoring of vulnerabilities and attack techniques targeting vehicles, closes the loop by feeding real attack data back into engineering and the monitoring duties R155 imposes.
When shortlisting, match the firm to the discipline you need: a hardware lab and published vehicle research for testing, 21434-mapped reporting for type approval evidence, or TISAX experience for supplier qualification.
Munich- and Budapest-based embedded cybersecurity experts focused on financial services, automotive and mobility, manufacturing and industrial automation, energy and more. The services and platform go beyond compliance, supporting the requirements of the Cyber Resilience Act, PCI PTS, UN R155, ISO/SAE 21434 and other standards and regulations.
Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.
Vienna-headquartered Austrian cybersecurity consultancy with a prolific Vulnerability Lab research program and deep expertise in IoT and embedded systems security across the DACH region.
Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.
Berlin-headquartered German cybersecurity consultancy with 30+ years of BSI IT-Grundschutz experience. Trusted by federal agencies, DAX corporations, and critical infrastructure operators.
A firm that secures vehicles, vehicle components, and the automotive supply chain. The work spans offensive testing of ECUs and full vehicles, threat analysis and risk assessment (TARA), compliance evidence for UN R155 type approval and ISO/SAE 21434, TISAX assessment support for suppliers, and ongoing product threat intelligence. Most firms specialise in one or two of these disciplines rather than all of them.
The automotive penetration testing list is scoped to firms with hands-on vehicle and ECU testing capability. This list is broader: it also includes consultancies supporting TISAX assessment and automotive supply-chain security, where the work is assurance and compliance rather than offensive testing of the vehicle itself.
UN Regulation No. 155 makes a certified Cyber Security Management System a condition of vehicle type approval across the EU, UK, Japan, Korea, and other UNECE markets. ISO/SAE 21434 is the engineering standard that type approval evidence is mapped against. TISAX governs supplier information security for the German OEMs, and the EU Cyber Resilience Act adds vulnerability-handling duties for connected products.
Vehicle OEMs commissioning type approval evidence, Tier 1 and Tier 2 suppliers under TISAX qualification or delivering components into an R155-regulated vehicle, EV charging operators, and aftermarket connected-vehicle product manufacturers facing Cyber Resilience Act obligations.