Managing Cyber Risk in Connected Vehicle Ecosystems

This technical report discusses the evolving landscape of cyber risk in connected vehicle ecosystems, emphasizing the transition from product security to systemic risk. It outlines how modern vehicles increasingly rely on external digital services, leading to vulnerabilities that can affect vehicle functionality and availability. The report details recent incidents that illustrate the propagation of cyber risks from third-party services to the vehicles themselves, highlighting the need for a comprehensive risk management approach. It presents a framework developed by Munich Re and TÜV SÜD that integrates technical cybersecurity with organizational resilience and financial risk transfer. This framework aims to assess cybersecurity maturity across the vehicle ecosystem and establish a risk-based insurability model. The report emphasizes the importance of viewing cybersecurity as an enterprise risk, requiring collaboration among OEMs, suppliers, and insurers to effectively manage exposures and liabilities in a complex mobility ecosystem. It also discusses the necessity of addressing cybersecurity risks as interconnected domains rather than isolated issues.