The Compliance Mirage: Why Automotive Safety Standards are Failing You

When you purchase a modern connected vehicle, you are often reassured by acronyms like ISO 21434 or UN Regulation 155. These are the industry’s “gold standards” for cybersecurity, meant to ensure that your car is protected from the remote-control threats we’ve discussed in this series. But behind the closed doors of the world’s leading automakers, the experts who build these systems are sounding a different alarm. They admit that current regulations are not a guarantee of safety—they are merely a baseline for compliance. [1]

The Experts Speak: A Systemic Trust Collapse

In a landmark doctoral study involving in-depth interviews with 15 cybersecurity experts from major manufacturers (including Volkswagen and Audi) and third-party suppliers, a disturbing reality emerged. These practitioners, who handle the day-to-day security of your vehicles, identified 20 critical failure points in how the industry manages risk. [1]

The most alarming revelation? Some practitioners interviewed in academic research reported that compliance requirements can sometimes become the primary focus, potentially limiting broader cybersecurity improvements. As one expert (P3) noted, “We never expect to rely on this regulation to ensure cybersecurity… all we care about is how to pass the standard set up by the regulation.” [1]

The 3 Major Failures of Automotive Regulation

Some automotive cybersecurity practitioners argue that current regulations provide an important baseline but do not, by themselves, guarantee strong cybersecurity outcomes [1]:

• 1. The “Copy-Paste” Problem: Regulations often rely on traditional IT security models that were never designed for kinetic machines. There is a massive gap between a data breach on a laptop and a momentum breach on a highway. Experts report that automotive-specific threats, like sensor spoofing or SOTIF limitations, are often ignored in favor of generic IT checklists. [1]
• 2. Extreme Inefficiency: The process of identifying potential threats (TARA) is almost entirely manual and incredibly slow. Identifying the “assets” in a car can take more than half of the total project time. Because hackers move faster than bureaucracies, rapidly evolving cyber threats can create challenges for manufacturers seeking to keep software and threat assessments current throughout a vehicle’s development lifecycle. [1]
• 3. The “Cost Center” Conflict: Within car companies, security groups often clash with development groups. Development teams prioritize “fancy features” and user experience because they sell cars. Security is viewed as a “cost center” that adds no attractiveness to the product, leading to “just sufficient” security rather than robust protection. [1]

“Just Sufficient” is Not Enough

Perhaps most terrifying is that companies themselves are unsure of what level of protection is “sufficient.” Currently, there are no quantifiable criteria or clear thresholds for how to mitigate a threat. Determining an appropriate level of cybersecurity risk mitigation remains challenging because many threats are difficult to quantify and continuously evolve, trying to find a balance between development effort and regulatory compliance while you are the one behind the wheel during the experiment. [1]

This is why the surge in ransomware was inevitable. In 2025, ransomware incidents in the auto industry doubled, accounting for 44% of all cyberattacks. Major incidents such as the 2025 Jaguar Land Rover cyberattack demonstrate that significant cyber risks remain despite the adoption of cybersecurity regulations and standards. [2, 1]

The Principled Stand for Analog Driving

Regulations can be updated, but they can never move as fast as a malicious code sequence. While the industry hides behind compliance certificates, a “dumb” vehicle relies on the most reliable safety standard ever created: the laws of physics. In an analog car, traditional mechanical systems generally reduce dependence on software, but they remain subject to wear, maintenance requirements, manufacturing defects, and mechanical failure. You don’t need an ISO certification to ensure a hacker can’t swerve your steering; you have a solid steel column.

At Qualitex Trading Co. Ltd., we believe that transparency is the ultimate safety feature. Our expertise in the Japanese used car market allows us to provide our global clients with vehicles that prioritize mechanical integrity over digital vulnerability. In an age of “compliance mirages,” we are sticking with the mechanical and less-connected, which may reduce certain categories of cybersecurity risk.