Resources Categories
INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY
Market Landscape and the Drivers of Cybersecurity Demand in Automotive and Mobility
The business, technology, regulatory, legal, statutory and customer forces that create cybersecurity, audit and assurance work for OEMs, suppliers, EV makers, charging networks, dealers and mobility companies.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: AIS 189/190, CERT-In, SEBI, DPDP and global rules 5. Legal and statutory drivers 6. How the drivers differ by company type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's automotive market is large and growing: record passenger vehicle sales of 4.3 million and two-wheeler sales of 19.6 million in FY2024-25, exports rising faster than domestic demand, and a policy push through the automotive and ACC battery PLI schemes and PM E-DRIVE towards electrification and local value addition. Listed Indian OEMs and global subsidiaries lead; a deep base of component suppliers serves them and exports to global programmes; EV start-ups, battery makers and charge point operators are scaling; and dealer groups, mobility platforms and telematics providers connect the industry to customers.
Cybersecurity demand is rising on three fronts at once. Operationally, the JLR, Toyota and CDK Global incidents proved that plants, suppliers and dealers stop together. Technically, software-defined and electric vehicles, OTA updates, apps and charging networks create attack surfaces that reach the vehicle on the road. And in regulation, AIS 189 and AIS 190 bring cybersecurity into type approval, while CERT-In, SEBI, DPDP and global OEM requirements apply across the chain.
|
4.3 mn Record passenger vehicle sales in FY2024-25 (SIAM) |
₹25,938 cr PLI outlay for automobiles and components |
Oct 2026 Proposed first AIS 189/190 compliance date (draft) |
6 hours Incident reporting to CERT-In |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Vehicle OEMs |
Multi-plant estates, global platforms, connected services, SEBI disclosure and homologation |
CSMS/SUMS programmes, vehicle and API testing, plant resilience, SOC, Board reporting |
|
Tier-1 majors |
Global customers, embedded software, TISAX and ISO/SAE 21434 expectations |
Product security, plant OT, supplier assurance, customer audits |
|
MSME component suppliers |
Single plants, outsourced IT, dependence on one or two OEMs |
Baseline assessment, backups, questionnaire support |
|
EV, battery and charging companies |
Rapid growth, new platforms, PLI conditions, payments |
Embedded, OTA, backend and charger security, PCI alignment |
|
Dealers, DMS and mobility platforms |
Customer data at scale, shared SaaS, fraud exposure |
Platform assurance, DPDP, fraud controls, playbooks |
|
Fleet and telematics providers |
Location and driver data, vehicle commands, enterprise customers |
Cloud and API security, command authorisation, privacy |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Production continuity |
Ransomware or a supplier outage stops plants and dealers |
Resilience, segmentation, supplier risk |
|
Vehicle safety and brand trust |
A vehicle-reaching vulnerability becomes a safety and reputation event |
TARA, vehicle and API testing, incident readiness |
|
Homologation and market access |
AIS 189/190 and UN R155/R156 as conditions of sale |
CSMS/SUMS readiness and evidence |
|
Winning OEM and export contracts |
TISAX, ISO/SAE 21434 and security audits in supplier selection |
Readiness, certifications, independent assessments |
|
Customer data and connected revenue |
Subscriptions and data services depend on trust |
DPDP programmes, app and cloud security |
|
Board accountability and disclosure |
Listed companies disclose incidents; Boards own risk |
Board advisory, incident records, audits |
|
Insurance and lenders |
Insurers and lenders require control evidence after major incidents |
Control validation, ransomware readiness |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Telematics, apps and cloud APIs |
Remote access to vehicle functions and data |
TARA, API and app testing, command monitoring |
|
OTA and software supply chain |
Tampered updates and compromised pipelines |
OTA pipeline, signing and SBOM reviews |
|
EV powertrain, BMS and charging |
Firmware and backend weaknesses affecting safety and revenue |
Embedded testing, OCPP and backend assessment |
|
Plant automation |
Robots, PLCs and MES with vendor remote access |
IEC 62443 assessments, segmentation, monitoring |
|
Dealer and finance platforms |
Shared SaaS holding customer and loan data |
SaaS assurance, DPDP, fraud controls |
|
Fleet and mobility platforms |
Location data and vehicle commands at scale |
Cloud security, authorisation, privacy |
Figure 3: The four groups of drivers behind cybersecurity spending in automotive and mobility.
4. Regulatory drivers: AIS 189/190, CERT-In, SEBI, DPDP and global rules
|
Instrument |
Key requirements |
|
AIS 189 and AIS 190 (draft CMVR rules, 2026) |
Cyber Security Management System and Software Update Management System for type approval, phased from October 2026; aligned with UN R155/R156 |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs; risk-based independent audits covering IT and OT |
|
SEBI LODR Regulations (listed companies) |
Quarterly disclosure of cyber incidents in the corporate governance report |
|
DPDP Act 2023 and Rules 2025 |
Customer, vehicle, location, driver and dealer data safeguards; most obligations from May 2027 |
|
Ministry of Power charging guidelines; BIS standards; PCI DSS |
Public charging infrastructure requirements; card payment security |
|
UN R155/R156, ISO/SAE 21434, TISAX, EU CRA |
Export and OEM customer requirements for vehicles, components and connected products |
|
Confirm applicability AIS 189/190 obligations depend on vehicle category, automation level and the final notification; other obligations depend on listing status, products, customers and markets. Confirm against the official instruments and your contracts. |
Figure 4: Regulatory and standards timeline shaping automotive cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
Motor Vehicles Act and CMVR, 1989 |
Type approval, including AIS 189/190 once notified |
CSMS/SUMS programmes and evidence |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting, logging and protected systems |
SOC, logging, audits and incident response |
|
Companies Act, 2013 and SEBI LODR |
Board risk responsibility; disclosure for listed entities |
Board reporting, incident records |
|
DPDP Act, 2023 and Rules, 2025 |
Personal data across vehicles, apps, dealers and fleets |
Privacy programmes and breach workflows |
|
Consumer protection and product liability |
Vehicle safety and defects, including software |
Secure development, OTA governance, incident readiness |
|
OEM, export and charging contracts |
TISAX, ISO/SAE 21434, UN R155/R156, EU CRA, PCI DSS |
Independent testing, certifications, evidence packs |
|
Cyber insurance policies |
Control conditions and warranties |
Control validation and evidence |
6. How the drivers differ by company type
|
Company type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Vehicle OEMs |
Continuity, safety, homologation, disclosure |
Connected vehicle, OTA, plants, DMS |
AIS 189/190, CERT-In, SEBI LODR, DPDP, UN R155/R156 |
|
Component suppliers |
Keeping OEM contracts, exports |
Embedded software, plant OT, portals |
TISAX, ISO/SAE 21434, CERT-In, EU CRA |
|
EV and charging |
Growth, uptime, payments |
BMS, OTA, OCPP backends |
AIS 156/189/190, Ministry of Power guidelines, PCI DSS |
|
Dealers and mobility platforms |
Sales continuity, customer trust |
DMS, apps, payments |
CERT-In, DPDP, consumer protection |
|
Fleet and telematics |
Enterprise contracts, data trust |
Telematics cloud, devices, APIs |
AIS 140, CERT-In, DPDP, contracts |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Are we ready for AIS 189 and AIS 190?” |
CSMS/SUMS gap assessment, TARA, vehicle and OTA testing |
Per-model and annual reviews |
|
“Could a supplier or our DMS provider stop us?” |
Supplier and platform cyber risk programme |
Per-supplier assessments and renewals |
|
“Can our app or API reach the car?” |
App, API and vehicle-to-cloud testing |
Per-release testing |
|
“Would ransomware stop our plants?” |
Ransomware resilience review and segmentation |
Annual resilience testing and exercises |
|
“Our German OEM customer wants TISAX.” |
TISAX readiness and ISO 27001 gap assessment |
Recertification support |
|
“We need 24x7 monitoring across plants and the vehicle cloud.” |
IT/OT SOC with vehicle-command monitoring |
Continuous monitoring |
|
“We need an independent cyber audit.” |
CERT-In-aligned IT/OT audit |
Annual audits |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. AIS 189 and AIS 190 timelines are taken from MoRTH's draft notification and may change; confirm all obligations against the official MoRTH, CERT-In, MeitY, SEBI and UNECE instruments and your OEM contracts.