Connected Series, Part 1 of 6 | Connected Vehicles
Headline: The car is where this architecture was proven. Everything that follows this week, the plant, the fab, the robot, the battery, is the same pattern moved to a different asset.
This week we are sharing Connected: A Case Study in Six Sections
1. Connected Vehicles (today)
2. Smart Manufacturing and Logistics
3. Semiconductors
4. Robotics
5. Digital Twins
6. Energy and Storage
The Setup
A connected car is any vehicle with a network link to outside systems: the OEM cloud, mobile apps, other vehicles, and road infrastructure. Every one of those connection points is also an attack surface. The threats look like any networked IT system. The consequences are physical.
The Architecture
Five parts carry the load. The Telematics Control Unit is the vehicle’s cellular modem and gateway out. The in-vehicle network, CAN bus plus automotive Ethernet, lets the control units talk to each other. The over-the-air update system pushes software and firmware remotely. The backend cloud handles data, diagnostics, and app connectivity. The Software Update Management System governs all of it.
Risk sits in four places: remote exploitation through the TCU, infotainment, or app APIs; vulnerable components from Tier 1 and Tier 2 suppliers; hijacked OTA updates pushed to a fleet; and exposure of location, driving behavior, and biometric data.
The Compliance Frame: R155 and R156
R155 requires a certified, organization-wide Cybersecurity Management System covering design, production, and in-service monitoring, plus risk assessment, incident response, and supplier verification.
R156 governs how updates are planned, deployed, and verified, with RXSWIN traceability and safe rollback that does not compromise safety-critical systems if an update is interrupted. Both are now a precondition for type approval in major markets.
Note what these regulations actually regulate. They sit on the process, not on the box. That is the single most useful thing to carry into the rest of the week.
Case: Hyundai Motor Group, Owning the Stack
The Group sells into the EU and Korea, both R155 and R156 markets, while converging on one in-house software brand, one consolidated telematics unit, and in-house certification.
Pleos launched as the mobility software brand at the Pleos 25 conference in Seoul in March 2025. The first production deliverable, Pleos Connect, shipped in May 2026 on the new Grandeur in Korea, with the IONIQ 3 in Europe next and a target of roughly 20 million Hyundai, Kia, and Genesis vehicles by 2030. Mobis introduced a 5G antenna-integrated Multi-Function Telematics Control Unit at CES 2026.
AutoEver holds a Level 3 cybersecurity capability certification and earned ASIL-D functional safety certification for its mobilgene platform in February 2025. AllDayEnergy launched in July 2026 as the global V2X brand.
Three design choices raise exposure: continuous OTA feature delivery, which puts R156 discipline on the product roadmap rather than only on recalls; an LLM-based agent that interprets driver intent instead of executing fixed commands; and an open platform giving third-party developers access to automotive endpoints. V2X adds grid interconnection as a new risk category.
Supplier cybersecurity verification is the hardest R155 obligation, because it depends on parties you do not control. Hyundai owns AutoEver, Pleos, and Mobis, so it certifies in house. The advantage is ownership, not technology.
Volvo
Volvo built its connectivity case around safety rather than features. More than one million Volvo models had active OTA capability as of August 2026, and through the European Data for Road Safety ecosystem the alerts reach vehicles Volvo did not build.
Four warnings arrived in 2026 software: Large Animal Alert, Vulnerable Road User Alert, Roadwork Alert, and Accident Ahead Alert.
Sharing safety data outside the brand deliberately widens the R155 boundary.
BCW Take
Two mo, and neither is really a technology strategy. Hyundai reduces exposure by owning the stack. Volvo accepts a wider boundary in exchange for network effect, because a hazard warning is worth more when it reaches cars outside your fleet. Toyota runs software through Woven, Volkswagen through CARIAD. Most other OEMs get neither position and will manage dozens of Tier 1 relationships under an obligation that reaches into every one of them.
Takeaways
- The connected vehicle is a networked system with physical safety consequences. Every connection point is an attack surface.
- R155 and R156 regulate the process, not the product. That pattern repeats every day this week.
- Vertical integration is a compliance strategy before it is a technology strategy.
- Continuous OTA delivery turns compliance from a one-time event into a permanent operating discipline.
Don Southerton
Founder and CEO, Bridging Culture Worldwide
bridgingculture.com
