Automotive Cybersecurity Market Size, CAGR & Forecast, 2025-2035

Regulation has turned automotive cybersecurity from an engineering option into a type-approval requirement

Automakers and suppliers spent USD 3.85 Billion on automotive cybersecurity in 2025, a figure Radial Insights expects to reach USD 4.53 Billion in 2026 and USD 19.48 Billion by 2035, growing at a 17.60% CAGR. The 2025 base of USD 3.85 Billion reflects compliance spending that UN Regulation No. 155 now makes mandatory for every new car sold in the European Union, Japan and Korea.

The Automotive Cybersecurity market includes in-vehicle security software such as intrusion detection and prevention systems, secure gateways and firewalls, hardware security modules and secure elements embedded in microcontrollers, cryptographic key management and public key infrastructure, and services such as vehicle security operations centers (VSOC), penetration testing, threat analysis and risk assessment, and compliance consulting. It covers passenger cars and commercial vehicles. It excludes general enterprise IT security at automaker offices, physical anti-theft devices and keyless entry hardware, which Radial Insights covers separately.

The attack surface keeps widening. Berg Insight counted 338.0 million cars with built-in connectivity at the end of 2025 and expects 583.1 million by the end of 2030. Upstream Security's 2026 report recorded 494 publicly reported automotive and smart mobility incidents in 2025, with 92% carried out remotely and 44% linked to ransomware, more than double the 2024 share.

Electric vehicle cybersecurity is the fastest-growing segment at a 23.40% CAGR, because battery management, charging communication and over-the-air updates add new entry points. Africa is the fastest-growing region at 20.40% from a small base, while Asia Pacific (APAC) leads with a 34.80% share in 2025 after China's mandatory GB 44495-2024 standard came into force in January 2026.

Growth will not be smooth for every vendor. Automakers want fewer suppliers and integrated platforms, and some cybersecurity startups are being acquired or merging into larger software houses. Still, the combination of type-approval rules, software-defined vehicle architectures and costly real-world attacks keeps per-vehicle security spending on a firm upward path.

Electric vehicle and ADAS security budgets grow faster than any other part of the market

Radial Insights tracks the automotive cybersecurity market across offering, security type, application, vehicle type and propulsion. Growth rates differ because new attack surfaces such as charging links, cloud back-ends and automated driving functions need protection that older vehicle domains did not.

Services overtake hardware on growth as automakers buy monitoring

Software holds the largest share of spending and grows at 18.90%, covering intrusion detection, secure boot, firewalls and AUTOSAR security stacks from Vector, ETAS and Elektrobit. Hardware security modules and secure elements grow at 14.20%, because the HSM is often bundled into the microcontroller price. Services grow fastest at 19.70%: UN R155 requires automakers to monitor and respond to attacks for the life of a vehicle type, so VSOC contracts with Upstream, VicOne and Argus become recurring revenue.

Cloud and back-end security grows fastest among security types

Network security grows at 16.80% and endpoint and ECU security at 15.90%. Application security grows at 18.40% as automakers scan code and software bills of materials. Cloud and back-end security grows fastest at 20.30% because Upstream found that 67% of incidents in 2025 involved telematics and cloud systems, not the vehicle itself.

ADAS and automated driving carry the highest growth

ADAS and automated driving security grows at 21.10%, since a compromised perception or control function can cause physical harm. Telematics and connectivity grows at 18.80%, powertrain and battery management at 16.40%, infotainment at 15.20%, and body control and comfort at 13.10%. The PerfektBlue Bluetooth flaws disclosed in July 2025, which affected infotainment units from Mercedes-Benz, Volkswagen and Skoda, show that lower-growth domains still need protection.

Commercial vehicles grow faster than passenger cars

Passenger cars account for most spending and grow at 17.10%. Commercial vehicles grow at 19.40% because fleets rely on telematics for routing, tachographs and remote diagnostics, and a single breach can stop hundreds of trucks.

Electric vehicles need more security per unit

Combustion vehicles grow at 11.20%, slowed by falling volumes in Europe and China. Electric vehicles grow at 23.40% because battery management systems, ISO 15118 charging communication and frequent over-the-air updates each add security requirements.

Market Trends

Vehicle security operations centers become standard

Automakers are moving from one-off compliance projects to continuous monitoring. In January 2026, Škoda signed a strategic partnership with Upstream to bring threat intelligence and risk data for its connected vehicles and digital services into a single workspace. In September 2025, Sasken partnered with VicOne to deploy its xCarbon, xNexus and EV charging protection products to automakers and tier-one suppliers.

Security moves into the software-defined vehicle platform

Security is being designed into base software rather than added later. In June 2025, QNX and Vector signed a memorandum of understanding to build a foundational vehicle software platform for software-defined vehicles, with a certified release expected at the end of 2026 and designed to meet ISO/SAE 21434. In January 2025, VicOne showcased partnerships with Microsoft, NXP, MediaTek and P3 for secure AI cockpits and telematics.

Post-quantum cryptography arrives in automotive chips

Vehicles sold today will still be on the road when quantum computers may break current encryption. In March 2026, Infineon launched the TEGRION SLI22, a 28nm automotive security controller with post-quantum cryptography and Common Criteria EAL6 certification. Automakers are starting to ask for crypto-agility so keys and algorithms can be updated over the air.

Vendors broaden into general product security

Specialists are widening their scope to reach more customers. In October 2025, C2A Security acquired Vigilant Ops, an SBOM automation firm, adding medical, defense and telecom customers. Software bill of materials management is becoming a shared requirement across regulated industries, which helps vendors spread development costs.

Restraints and Challenges

Ransomware and supply chain attacks outpace defenses

Attackers increasingly target automaker IT and production rather than individual cars. A cyberattack in early September 2025 halted Jaguar Land Rover production, including at Solihull, until 8 October 2025, and the company booked GBP 196 million of cyber-related costs in its July to September quarter. Upstream reported that 34% of 2025 incidents caused business or operational disruption.

Fragmented regulation across markets

Suppliers must satisfy several overlapping regimes. The EU published the UN R155 text as Regulation 2025/5 in January 2025, China's GB 44495-2024 took effect in January 2026, and the US Commerce Department's connected vehicle rule of January 2025 bans Chinese- or Russian-linked connectivity software from model year 2027. Each regime has its own audit and documentation demands.

Shortage of automotive security engineers

Vehicle security needs people who understand both embedded systems and modern cloud threats. Tier-one suppliers and automakers compete with banks and technology firms for the same talent, which raises project costs and slows the build-out of in-house VSOC teams, particularly at smaller commercial vehicle makers.

Cost pressure on mass-market vehicles

Automakers facing price wars in China and margin pressure in Europe push back on per-vehicle license fees. Many prefer to pay one platform fee or bundle security into existing tier-one contracts, which limits pricing power for standalone software vendors and pushes consolidation.

Growth Drivers

Mandatory type-approval rules in Europe, Asia and North America

UN Regulation No. 155 has applied to all newly produced vehicles in the EU since July 2024 and is used by contracting parties to the 1958 Agreement, including Japan and Korea. China's GB 44495-2024 vehicle cybersecurity standard, issued by the Standardization Administration of China, took effect on 1 January 2026, covering the world's largest vehicle market. In the United States, the Bureau of Industry and Security finalized its connected vehicle rule on 14 January 2025, banning connectivity and automated driving software linked to China or Russia from model year 2027 and hardware from model year 2030. Each rule obliges automakers to run a certified cybersecurity management system, keep risk assessments current and prove supplier controls. Radial Insights estimates these mandates add about 7.4 percentage points to annual market growth through 2035.

Connected and software-defined vehicles expand the attack surface

Berg Insight counted 338.0 million cars with OEM telematics at the end of 2025 and forecasts 583.1 million by 2030, an 11.5% annual rise. Software-defined vehicles concentrate functions in fewer, more powerful computers that receive frequent over-the-air updates, so a single flaw can affect a whole fleet. Upstream found that 61% of 2025 incidents could affect thousands to millions of assets and 67% involved telematics and cloud systems. The QNX and Vector platform work and NXP and Infineon secure processors show how security is now built into each new architecture. We attribute roughly 5.2 points of the market's annual growth to this rising connectivity.

Electric vehicles and charging networks need new protections

Every electric vehicle adds a battery management system, a charging communication stack and a link to charge point operators and energy markets. VicOne's EV charging protection product and the Sasken partnership announced in September 2025 target this gap directly. With the IEA reporting that electric cars reached about a quarter of global car sales in 2025, the share of vehicles needing charging-related security rises each year. Radial Insights expects electric vehicle security spending to grow at 23.40% a year and to lift total market growth by about 2.6 percentage points.

Opportunities

Lifetime monitoring contracts

Because UN R155 requires monitoring for the life of a vehicle type, VSOC providers can sign contracts that run eight to fifteen years. Vendors that bundle monitoring, incident response and over-the-air patching can build recurring revenue that outlasts any single vehicle program.

Commercial fleets and emerging markets

Truck, bus and delivery fleets in India, Brazil, Mexico and the Gulf states are connecting telematics fast but lack in-house security teams. Managed security packages priced per vehicle per month offer an entry point for providers willing to serve fleets directly.

Asia Pacific (APAC) leads on both size and growth among the three large regions

Asia Pacific (APAC)

Asia Pacific (APAC) held a 34.80% share of automotive cybersecurity spending in 2025, worth USD 1.34 Billion. APAC spending rises at a 19.05% CAGR to USD 7.66 Billion in 2035. China's GB 44495-2024 standard took effect on 1 January 2026, applying to the country's output of more than 16 million new energy vehicles a year. Japan and Korea apply UN R155 to new vehicles, and suppliers such as Denso, Hyundai AutoEver and LG-owned Cybellum serve regional automakers.

North America

North America accounted for 29.60% of the 2025 market, about USD 1.14 Billion. North American spending grows at a 16.00% CAGR to USD 5.03 Billion by 2035. The US connected vehicle rule finalized on 14 January 2025 bans Chinese- or Russian-linked connectivity software from model year 2027 and hardware from model year 2030, forcing supply chain audits. BlackBerry reported QNX revenue of USD 57.5 million in the quarter to 31 May 2025, up 8%, reflecting demand for secure vehicle operating systems.

Europe

Europe represented 28.40% of 2025 spending, valued at USD 1.09 Billion. European spending climbs at a 16.60% CAGR to USD 5.08 Billion in 2035. UN R155 has applied to all newly produced vehicles in the EU since July 2024. The September 2025 attack on Jaguar Land Rover halted UK production for about five weeks and cost GBP 196 million in one quarter, raising board-level attention across the region.

Latin America

Latin America held a 3.40% share in 2025, roughly USD 0.13 Billion. Latin American spending grows at a 19.80% CAGR to USD 0.80 Billion by 2035. Mexican plants exporting to Europe must meet UN R155 supplier requirements, and Brazilian fleets are adding telematics for theft recovery and logistics.

Middle East

The Middle East accounted for 2.30% of 2025 spending, about USD 0.09 Billion. Middle East spending rises at an 18.90% CAGR to USD 0.50 Billion by 2035. Gulf states import most new vehicles from markets that already apply UN R155 or GB 44495, and Saudi Arabia's local assembly plans add demand for in-country compliance services.

Africa

Africa represented 1.50% of the 2025 market, roughly USD 0.06 Billion. African spending grows at a 20.40% CAGR, the fastest of any region, to USD 0.37 Billion by 2035. South Africa, a contracting party to the 1958 Agreement, exports vehicles to Europe from plants run by BMW, Mercedes-Benz, Toyota and Volkswagen, which must meet European cybersecurity rules.

Recent Developments

• In March 2026, Infineon launched the TEGRION SLI22, a 28nm automotive security controller with post-quantum cryptography and Common Criteria EAL6 certification.

• In February 2026, Upstream Security published its 2026 Global Automotive and Smart Mobility Cybersecurity Report, recording 494 public incidents in 2025 with ransomware involved in 44%.

• In January 2026, Škoda signed a strategic partnership with Upstream to unify threat intelligence and risk data across its connected vehicle ecosystem.

• In January 2026, China's GB 44495-2024 vehicle cybersecurity technical requirements took effect as a mandatory national standard.

• In October 2025, C2A Security acquired Vigilant Ops, a software bill of materials automation company based in Pittsburgh.

• In June 2025, QNX and Vector signed a memorandum of understanding to build a foundational vehicle software platform designed to meet ISO/SAE 21434.

Specialist security firms compete with chip makers and tier-one software houses for automaker budgets

The automotive cybersecurity market is fragmented but consolidating. Specialist vendors lead in monitoring and intrusion detection, semiconductor makers control the hardware root of trust, and large tier-one software arms bundle security into wider platforms. Automakers increasingly want one partner per layer, which favors vendors with scale and certified processes.

Specialist security vendors

Upstream Security runs a cloud-based VSOC and publishes the industry's most cited annual threat report. VicOne, backed by Trend Micro, offers xCarbon in-vehicle intrusion detection and xNexus monitoring, plus EV charging protection. Argus Cyber Security, part of Continental's Elektrobit, provides in-vehicle intrusion detection and ECU protection. Karamba Security focuses on runtime integrity for ECUs, while C2A Security sells security orchestration and SBOM tools and widened its reach with the October 2025 Vigilant Ops deal. Cybellum, owned by LG Electronics, offers product security and compliance management.

Semiconductor makers

Infineon embeds hardware security modules in its AURIX microcontrollers and launched the post-quantum TEGRION SLI22 in March 2026. NXP Semiconductors builds secure enclaves into its S32 vehicle processors and supplies V2X security. These firms set the hardware baseline that all software security depends on.

Tier-one and platform software providers

ETAS, part of Bosch and home of the former ESCRYPT, sells cryptographic stacks, key management, intrusion detection and VSOC services. Vector Informatik supplies AUTOSAR security modules and is building a foundational platform with BlackBerry QNX, whose certified operating system and hypervisor run in many vehicles. Harman, owned by Samsung, offers cybersecurity and over-the-air update software, and Aptiv adds secure architecture through Wind River.

Trust and key management providers

Thales and Irdeto provide key management, public key infrastructure and anti-tampering software. As V2X and plug-and-charge expand, demand for certificate management across millions of vehicles grows steadily.