Resources Categories
INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY
Main Products and Services in Automotive and Mobility
What India's OEMs, suppliers, EV makers, charging networks, dealers and mobility companies produce and deliver, the plant, enterprise, vehicle and platform systems behind each activity, and where those systems create cybersecurity and compliance exposure.
|
In this document 1. How automotive and mobility companies earn their money 2. Products and services by company type 3. The plant and the supply chain 4. The connected vehicle, the dealer and the charger 5. The systems behind the products and services 6. Trends that change the attack surface 7. Mapping operations to Codec Networks engagements |
1. How automotive and mobility companies earn their money
|
Revenue stream |
How it works |
Security relevance |
|
Vehicle sales |
Passenger, commercial, two- and three-wheelers sold through dealers |
Plant uptime; dealer systems; registration integrations |
|
Components and systems |
Tier-n supply to OEMs on just-in-time schedules |
Delivery performance; OEM audits; design confidentiality |
|
After-sales, parts and service |
Workshops, spares, warranties, connected diagnostics |
DMS, remote diagnostics, customer data |
|
Connected services and software |
Telematics subscriptions, apps, OTA features, data services |
Vehicle-to-cloud security; app and API security; DPDP |
|
Charging and energy services |
Public and fleet charging, roaming, payments |
Backend and charger uptime; payment security |
|
Mobility and fleet services |
Ride-hailing, leasing, subscriptions, fleet management |
Platform availability; location and driver data; fraud |
2. Products and services by company type
|
Company type |
Main products and services |
Key systems |
|
Vehicle OEMs |
Vehicles, connected services, parts and warranties |
PLM, ERP, MES, plant OT, telematics cloud, OTA platform, DMS integrations |
|
Component suppliers |
ECUs, electronics, powertrain, body and interior systems |
CAD/PLM, ERP, plant OT, OEM portals and EDI, embedded software toolchains |
|
EV and battery makers |
EVs, cells, packs, BMS, chargers |
Battery lines, BMS firmware, OTA, telematics, test systems |
|
Charging networks |
Public and captive charging, roaming, payments |
CPO backend, OCPP, charger firmware, payment gateways, apps |
|
Dealers and DMS providers |
Sales, finance, insurance, service, registration |
DMS, CRM, finance and insurance integrations, Vahan links |
|
Mobility and fleet platforms |
Ride-hailing, leasing, fleet tracking, logistics |
Apps, telematics devices, cloud platforms, driver and payment systems |
3. The plant and the supply chain
An automotive plant is a sequence of body, paint, assembly and test shops run by PLCs, hundreds of robots, automated guided vehicles and a manufacturing execution system that sequences every vehicle to its order. Battery and EV lines add cell handling, pack assembly and end-of-line software flashing. Automation OEMs and integrators maintain remote access to robots and PLCs; engineering stations hold the programs; and ERP drives sequencing, parts call-offs and shipping.
The supply chain is just-in-time and just-in-sequence. Tier-1 suppliers deliver modules to the line in build order; tier-2 and tier-3 suppliers feed them. Orders, schedules and shipping notices flow through EDI and supplier portals, so a supplier's IT outage stops its deliveries and, within hours, the OEM's line—as Toyota's 14-plant stoppage showed.
4. The connected vehicle, the dealer and the charger
The vehicle is now a connected product. Telematics control units talk to OEM clouds; companion apps and dealer portals share back-end APIs that can locate, lock, unlock and start cars; OTA platforms push software to ECUs; and diagnostic tools connect in workshops. Flaws in any of these reach the vehicle directly.
Dealers run on dealer management systems that handle sales, finance, insurance, service and registration—often as SaaS shared by hundreds of dealerships, so one provider's incident becomes an industry outage. Charging networks run on OCPP back-ends that command chargers, set tariffs and take payments. Fleet and mobility platforms hold location, driver and payment data for millions of trips and can send commands such as immobilisation to vehicles on the road.
|
Highest-risk moments OTA releases, new app and API features, dealer and DMS onboarding, supplier integrations, robot and PLC vendor remote sessions, charger firmware updates and fleet command functions are where automotive incidents typically begin or escalate. |
5. The systems behind the products and services
Figure 2: Where cyber risk sits across the automotive value chain.
|
Product / service |
Systems that deliver it |
Key cyber and compliance touchpoints |
|
Design and software |
PLM, CAD, ECU firmware, DevOps pipelines, test benches |
IP protection, secure development, pipeline and signing security |
|
Supply chain |
Supplier portals, EDI, JIT/JIS scheduling |
Supplier assessments, portal testing, BEC controls |
|
Plants |
PLCs, robots, AGVs, MES, ERP, end-of-line flashing |
IEC 62443 assessment, segmentation, remote access brokering, OT monitoring |
|
Dealers and finance |
DMS, CRM, finance and insurance, registration portals |
SaaS assurance, data protection, manual playbooks |
|
Connected vehicle |
Telematics, OTA, companion apps, cloud APIs |
TARA, API and app testing, OTA pipeline review, command monitoring |
|
Charging and fleets |
CPO backends, OCPP, charger firmware, fleet telematics |
Backend and charger assessment, PCI alignment, command authorisation |
6. Trends that change the attack surface
|
Trend |
What is changing |
Security implication |
|
Software-defined vehicles |
Features delivered by software and OTA across the vehicle's life |
OTA pipeline, signing and SUMS become critical |
|
Electrification |
EV platforms, BMS, battery lines and charging networks |
New embedded, firmware and charging attack surfaces |
|
AIS 189/190 and UN R155/R156 |
Cybersecurity enters type approval |
Evidence-based CSMS and SUMS across the lifecycle |
|
Connected services and data |
Telematics subscriptions, usage-based insurance, data monetisation |
DPDP, consent and vehicle data protection |
|
Platform consolidation |
DMS, telematics and charging platforms shared across the industry |
Single points of failure; SaaS assurance |
|
Global supply-chain integration |
Indian suppliers in European, US and Japanese programmes |
TISAX, ISO/SAE 21434 and CRA obligations |
7. Mapping operations to Codec Networks engagements
|
If the company operates… |
Recommended starting engagement |
|
Vehicle platforms with telematics, apps or OTA |
TARA per ISO/SAE 21434, vehicle network and ECU testing, OTA pipeline review, AIS 189/190 readiness |
|
Plants with PLCs, robots and MES |
IEC 62443-aligned OT assessment, segmentation, ransomware resilience |
|
Just-in-time supply to OEMs |
Supplier cyber risk programme; TISAX and OEM questionnaire readiness |
|
Dealer networks or DMS platforms |
SaaS and platform assurance, DPDP programme, manual-operation playbooks |
|
Charging networks |
CPO backend, OCPP and charger assessments; payment security |
|
Fleet, telematics or mobility platforms |
Cloud and API security, command authorisation, DPDP for driver and location data |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by company.