Best Automotive Cybersecurity Companies (2026)
Automotive cybersecurity covers everything it takes to secure a modern, software-defined vehicle and the supply chain behind it: offensive testing of ECUs and full vehicles, threat analysis and risk assessment (TARA), product threat intelligence, TISAX assessment support for suppliers, and the engineering evidence UN R155 type approval and ISO/SAE 21434 demand. It is a wider remit than automotive penetration testing alone, and the companies below cover different parts of it.
The list includes pure-play vehicle security specialists with hardware labs and published vehicle research, broader security research firms with genuine automotive credentials, and consultancies supporting TISAX and automotive supply-chain security. PCA Cybersecurity leads the list as the directory's only pure-play automotive specialist, with a dedicated ECU and vehicle lab, Pwn2Own Automotive participation, and reports mapped to ISO/SAE 21434 and TARA outputs.
Related: Automotive pen testing companies · Product threat intelligence providers · TISAX compliance pen testing
What do automotive cybersecurity companies actually do?
The work splits into a few distinct disciplines, and few firms cover all of them.
Offensive vehicle testing is the core: penetration testing of ECUs and components on the bench, full-vehicle assessments, in-vehicle networks (CAN, automotive Ethernet), OTA update backends, telematics, companion apps, and EV charging infrastructure including OCPP. It needs a hardware lab, debug tooling, and software-defined radio capability.
Compliance engineering turns that testing into regulatory evidence. UN R155 makes a certified Cyber Security Management System a condition of type approval across UNECE markets, and ISO/SAE 21434 is the engineering standard authorities expect evidence against. Strong providers deliver reports mapped to 21434 clauses and TARA outputs so findings slot straight into a type approval submission.
Supply-chain assurance is the third strand. TISAX is the assessment standard the German OEMs require of their suppliers, and consultancies in this list support suppliers through TISAX readiness and assessment. Product threat intelligence, the ongoing monitoring of vulnerabilities and attack techniques targeting vehicles, closes the loop by feeding real attack data back into engineering and the monitoring duties R155 imposes.
When shortlisting, match the firm to the discipline you need: a hardware lab and published vehicle research for testing, 21434-mapped reporting for type approval evidence, or TISAX experience for supplier qualification.
PCA Cybersecurity
Munich- and Budapest-based automotive cybersecurity specialist focused on UN R155, ISO/SAE 21434, and vehicle research. Pwn2Own Automotive participant with a dedicated ECU and vehicle test lab.
usd AG
Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.
SEC Consult
Vienna-headquartered Austrian cybersecurity consultancy with a prolific Vulnerability Lab research program and deep expertise in IoT and embedded systems security across the DACH region.
IOActive
Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.
HiSolutions
Berlin-headquartered German cybersecurity consultancy with 30+ years of BSI IT-Grundschutz experience. Trusted by federal agencies, DAX corporations, and critical infrastructure operators.
Best Automotive Cybersecurity Companies (2026), FAQs
What is an automotive cybersecurity company?+
A firm that secures vehicles, vehicle components, and the automotive supply chain. The work spans offensive testing of ECUs and full vehicles, threat analysis and risk assessment (TARA), compliance evidence for UN R155 type approval and ISO/SAE 21434, TISAX assessment support for suppliers, and ongoing product threat intelligence. Most firms specialise in one or two of these disciplines rather than all of them.
How is this list different from the automotive penetration testing list?+
The automotive penetration testing list is scoped to firms with hands-on vehicle and ECU testing capability. This list is broader: it also includes consultancies supporting TISAX assessment and automotive supply-chain security, where the work is assurance and compliance rather than offensive testing of the vehicle itself.
What regulations drive demand for automotive cybersecurity?+
UN Regulation No. 155 makes a certified Cyber Security Management System a condition of vehicle type approval across the EU, UK, Japan, Korea, and other UNECE markets. ISO/SAE 21434 is the engineering standard that type approval evidence is mapped against. TISAX governs supplier information security for the German OEMs, and the EU Cyber Resilience Act adds vulnerability-handling duties for connected products.
Who needs an automotive cybersecurity company?+
Vehicle OEMs commissioning type approval evidence, Tier 1 and Tier 2 suppliers under TISAX qualification or delivering components into an R155-regulated vehicle, EV charging operators, and aftermarket connected-vehicle product manufacturers facing Cyber Resilience Act obligations.