Observations from over a year of conversations with automotive manufacturers, suppliers, and the people defending them.
The automotive industry has spent over a decade becoming a software industry. Vehicles now run on centralised compute, over-the-air updates, and a permanent connection to the cloud. The data and security implications of those changes are... not minor.
In 2025, researchers documented a 39% year-over-year increase in global automotive cyber incidents, an all-time high. Ransomware made up 44% of them, with 92% of attacks carried out remotely and 86% requiring no physical access to the vehicle. Cross-region, multi-business incidents tripled year over year, with knock-on effects on subsidiaries and platforms.
Regulation has adapted to this new reality. Most of the code in a finished vehicle is written by someone other than the brand on the hood. Under UN Regulation 155, the first binding international vehicle cybersecurity rule, the original equipment manufacturer is held accountable for the cybersecurity of the entire vehicle, including the third-party code it did not write. Only the vehicle manufacturer can obtain cybersecurity type approval, so the party a regulator holds accountable is the manufacturer, not the suppliers who built the components. Suppliers still carry their share through contracts the manufacturer imposes, but a weakness anywhere in that supply chain remains the manufacturer's liability. Vehicle cybersecurity has become a commercial prerequisite, for type approval and sale.
One security leader at a global automaker described his own week in those terms: he would spend it "wearing the compliance hat with NIS2 and DORA directives." A contact at a company working towards an audit put the stakes more bluntly: "how are you going to approve compliance if you don't have something like TryHackMe for CCPA and JSOC?"
With the scope of the threat, and the subsequent responsibilities expanding, automotive teams are actively recognising that security is a responsibility that reaches further than the SOC. The most resilient ones are building out cyber literacy to meet the challenge.
It's not just the security team building security
The clearest thing we hear is that cybersecurity in automotive has become the wider team's shared responsibility. A security leader at a major US automaker described a company-wide capture the flag event built around exactly this new need. It was, in his words, "opened up to the entire company and our bank people," reaching "people from all areas, from general business areas to very technical staff," with a single aim: "to get as many people engaged and to get them to understand the world of cyber." Building cyber champions is now business critical.
A security engineer at a mobility company told us why that increased literacy matters so much with security-adjacent tech teams on the ground. After a major architectural overhaul, he kept finding the need for a stronger baseline: "when we bring on new engineers, co-ops, things like that, we are catching instances where they're just simply not aware of a best practice or a proper way to implement a thing." His reasoning was preventative. It was "something that we would prefer to get ahead of rather than wait for something terrible to make it into production."
The scale of this need becomes clear at the supplier level. One of the world's largest automotive suppliers described a single engineering location with around 4,000 engineers and, in his estimate, "around 10, 15 persons" doing cybersecurity across both automotive and enterprise. That ratio cannot be closed by hiring alone; it requires raising the baseline of the thousands of existing employees, so all eyes are on security and can see a problem coming. This is what regulation is incentivising: R155 requires manufacturers to assign roles and responsibilities to employees with the appropriate skills and competencies to implement security by design.
Even mature teams keep returning to the fundamentals. A security specialist at a European automaker, on a team with experts in threat intelligence, reverse engineering, malware analysis, and EDR, described the goal in plain terms: "currently, we search how to upgrade the general knowledge of the team in the field." That is a group of seasoned specialists asking to strengthen the base itself. The foundations of security do not go out of style, but they do not hold still either. What counts as a basic keeps moving as protocols, tooling, attacker techniques, and the platforms in use all change, so the people who rely on those fundamentals have to revisit them as the ground shifts beneath them. Keeping the basics current is ongoing work, even for experts.
There's no rest for the SOC
While the circle of people who need security literacy keeps widening, the pressure on the specialists at the core has not eased. If anything, our conversations suggest the SOC and incident response functions are the most strained, and the hardest to keep current.
A cyber incident response lead at a multinational certification company described the shape of the problem precisely. What he needed was "a high quality training for level one SOC analysts" because the people filling those seats were struggling. Although training in their organisation was extensive, more junior hires had complained about "not knowing which way to go" because it was not written "for a rookie to understand."
Addressing early-career training required flexibility for this leader's operational reality. His Level 1 analysts "work in 12 hour shifts," there "can be like a huge turnaround," and sometimes "they are away for three weeks." The result was that "not everybody can go through the same training," which he named outright as a pain point: "we can't really train everybody at the same time." A classroom or traditional, rigid training cannot serve a team like that. Analysts need to have self-paced training they can pick up on their own schedule, and be individually measured on.
The breadth of what these core teams own has also expanded. A SOC manager at a tier-one safety supplier listed his team's remit in one breath: "the incident response, including also the SIEM administration, detection engineering, threat hunting," and "also taking care of exposure management and vulnerability management as well." A European automaker's team wanted a concrete and realistic practice environment, where his team could safely work in the same real tooling they use every day, and get real insights into readiness rather than theoretical knowledge or hypothetical planning.
One contact framed his own priorities against the trend line directly, noting that automotive cyber incidents were rising sharply, while "regulators are actively auditing R155 compliance." He emphasised that "making sure our cybersecurity analysts being ready for the job when there is an attack" was his top priority.
Engagement is the ROI
Concern about training "actually sticking" was a recurring theme in several of the conversations. Many teams admitted to having been burned by investing in cybersecurity training only to find that their SOC teams never revisited the platform after the first two weeks.
A security leader at a global automaker described the pattern from direct experience. "Everyone gets excited. They go, wow, we've got HacktheBox. Everyone signs up," and then, "if you look at it, you'll only end up with like three or four people still actively using it by the time you get to the end of the year." He traced part of the drop-off to a lack of guidance. He also felt abandoned after signing: "they're like, got your money, and then you don't hear anything from them until renewal time," at which point the quote went up "10 percent or something like that."
For an industry working to lift competence across thousands of people in multiple time zones, a training platform needs to be up to the task of keeping a globally distributed, mixed-ability workforce engaged for years to come. That requires self-paced, structured, job-aligned paths designed to go from zero experience to senior speciality, with fresh content and learning modalities that feel relevant and rewarding enough to keep returning to. A strong community of leaders and learners, alongside strong customer support, makes the difference between feeling dropped-in and set up for success.
Making the case for training with impact
Content relevance keeps team members returning for more training, but it also puts the value and urgency of that training into context for the leaders approving budget. SOC leaders admit to challenges in securing the funds and attention needed to approve more training. Even managers who see the need clearly described difficulty making the case upward. A manager at a large supplier told us "it's very hard to argue for the management that I need some more money to train guys because they don't see really the business opportunity currently," and that his people were often "so full and busy and booked" on current projects that even a free trial was hard to prioritise. At another company, an earlier training budget request was simply "declined." Once senior leaders see the quality of metrics, the evidence to regulators, and the consistency of new content, the conversation and perception of value change: "they don't want to invest in something that will just sit there unused. But once they see 'this is going to help us prove the team's prepared, and that they're getting more prepared for recent threats every week' it's a different conversation." Certifications and quality metrics are becoming, as one supplier put it, "industry standard" for showing "you're hitting compliance and regulations."
AI as pressure and worry
Almost every conversation eventually reached AI, usually with a mix of pressure and worry that will be familiar to anyone in the sector. A leader at a global automaker captured the internal climate with some exasperation: "AI, AI. I mean, I can't beat it enough. It's honestly obnoxious. The amount that people daily come in and say, what are we doing with AI."
The security teams are less interested in the hype and more focused on the exposure it creates. At a finance arm, the head of a security team named "data leakage" as "the biggest problem," describing "users using AI in a non-compliant way, like uploading company internal information into public AI tools," and predicted "that things like prompt injections will become a very big thing" as these products reach end users. As one SOC leader in the sector mentioned "we want to be able to show that we're not just talking around it, but actually helping teams address AI as an attack surface: understand the risks of misuse, but also how to defend AI."
Raise the floor, keep the ceiling sharp
Unsurprisingly, all conversations boiled down to ongoing readiness. Organisations across automotive need defenders to stay sharp through constant, hands-on practice, and they need security fluency to spread to the engineers, developers, and business teams that security by design now depends on.
That's what TryHackMe is built to practically support. The automaker that ran its people through our SOC Level 1 and SOC Level 2 tracks reported that they "found those tracks to be very useful." The teams that stayed engaged credited the guided, assignable, trackable structure, where a manager could find a module on a framework like MITRE ATT&CK, assign it to teammates, and have them working through it immediately while progress was visible to management. The leaders focused on breadth valued the entry-level, gamified path that gets "fresh" newcomers interested. A contact at a global tyre manufacturer, comparing us with the tool his team already liked, said that for beginners "they like the way your platform is teaching."
TryHackMe for Business keeps teams of all levels coming back to training as a force multiplier, with continuous, measurable practice for the defenders at the centre, and a credible on-ramp for everyone the attack surface has pulled in around them.
Joanna Duffy
