Best Automotive Penetration Testing Companies (2026): UN R155, ISO/SAE 21434 and NHTSA

On 20 November 2024, researchers Sam Curry and Shubham Shah reported a flaw in Subaru's STARLINK admin portal that, according to their write-up, "gave us unrestricted targeted access to all vehicles and customer accounts in the United States, Canada, and Japan", including the ability to remotely start, stop, lock, unlock and locate vehicles. Subaru fixed it the next day. Two months earlier, a team including Curry had published research on Kia showing remote control of key functions "using only a license plate" on Kia vehicles made after 2013, through flaws in Kia's dealer portal and the API behind it rather than in the cars. Kia told the researchers on 14 August 2024 that it had remediated the issue.

Neither attack touched an ECU. Both ran through web applications and APIs that sit around the vehicle. That is why an automotive penetration test in 2026 has two halves: in-vehicle hardware testing, which is lab work done by specialists, and the companion apps, cloud back ends, portals and networks that connect the car to its owners, dealers and fleets. This ranking is written for OEMs, Tier 1 and Tier 2 suppliers, EV makers, telematics and connected-vehicle platforms, and fleet and mobility apps in the United States and Canada, from Michigan to Ontario's auto corridor. Dealerships buying testing for the FTC Safeguards Rule should read the dealership ranking, and plants and factories the manufacturing ranking.

Quick answer. The best automotive penetration testing companies in 2026 are Stingrai, NCC Group, IOActive, Block Harbor, NetSPI, DEKRA, Pen Test Partners, VicOne and Assured. Stingrai ranks first for the connected half of a vehicle program: a CREST-accredited firm headquartered in Toronto whose penetration testers test companion mobile apps, the cloud APIs behind them, owner, dealer and fleet portals, corporate networks and red team scenarios, with retesting and an attestation letter, as a one-time annual test or a continuous program. Stingrai does not claim in-vehicle ECU or hardware testing; for that half, NCC Group, IOActive, Block Harbor, DEKRA and the other specialists below run automotive labs. UN R155 requires "appropriate and sufficient testing" before type approval without naming penetration tests, and NHTSA and Transport Canada guidance say penetration testing should be used.

What drives an automotive penetration test in 2026

No single North American rule mandates an automotive penetration test. What exists is a UN type approval regime that North American companies meet when they sell abroad, a paywalled ISO/SAE standard that OEMs write into supplier contracts, an information security label for suppliers, and two non-binding government guidance documents. Each is quoted below from its own text, with the modal verb it uses.

UN Regulation No. 155: cyber security and the CSMS

UN R155 applies "to vehicles, with regard to cyber security, of Categories L, M, N and O, if fitted with at least one electronic control unit" (paragraph 1.1). The consolidated text published in the EU Official Journal on 10 January 2025 incorporates Supplement 3, which entered into force that day; the text itself says its status "should be checked in the latest version of the UN/ECE status document TRANS/WP.29/343", so later supplements can apply.

The regulation has two halves. The manufacturer needs a Certificate of Compliance for its Cyber Security Management System (CSMS), valid "for a maximum of three years" (paragraph 6.7), and each vehicle type needs approval. The testing duties, quoted:

• Paragraph 7.2.2.2(e): the CSMS processes "shall include" the "processes used for testing the cyber security of a vehicle type".

• Paragraph 7.3.3: the manufacturer "shall identify the critical elements of the vehicle type and perform an exhaustive risk assessment", and "The risk assessment shall further consider interactions with any external systems." Back ends, apps and portals are in scope of the risk assessment through this sentence.

• Paragraph 7.3.6: "The vehicle manufacturer shall perform, prior to type approval, appropriate and sufficient testing to verify the effectiveness of the security measures implemented."

• Paragraph 5.1.2: the Approval Authority or Technical Service "shall verify by testing of a vehicle of the vehicle type" that the documented measures are implemented, with sampling "focused but not limited to risks that are assessed as high during the risk assessment."

• Paragraphs 7.2.2.5 and 7.3.2: the manufacturer "shall be required to demonstrate how their Cyber Security Management System will manage dependencies that may exist with contracted suppliers, service providers or manufacturer's sub-organizations", and "shall identify and manage, for the vehicle type being approved, supplier-related risks." This is how R155 reaches Tier 1 and Tier 2 suppliers.

• Paragraph 7.4.1: the manufacturer "shall report at least once a year" on its monitoring and confirm "that the cyber security mitigations implemented for their vehicle types are still effective."

R155 never uses the phrase "penetration test". The closest wording is in Annex 5, where mitigation M23 for threat 28.1 (software bugs, "particularly true if software has not been tested") reads "Cybersecurity best practices for software and hardware development shall be followed. Cybersecurity testing with adequate coverage". A penetration test is the usual way to evidence 7.3.6 for exposed interfaces, but the regulation leaves the method to the manufacturer.

Where R155 applies. A UN Regulation binds only the parties to the UNECE 1958 Agreement that apply it. The UN Treaty Collection lists 62 parties to the Agreement, and its R155 status record shows 59 of them applying R155, including the European Union, the United Kingdom, Japan and the Republic of Korea. The United States and Canada are not parties, so R155 is not a US or Canadian legal requirement. It reaches North American OEMs through vehicle types approved for those markets, and reaches suppliers only indirectly, through the manufacturer's supplier-risk duties in the paragraphs above.

UN Regulation No. 156: software updates

UN R156 requires a Software Update Management System and sets requirements for the vehicle type. In the original 2021 text published in the EU Official Journal in March 2021, paragraph 7.2.1.1 reads: "The authenticity and integrity of software updates shall be protected to reasonably prevent their compromise and reasonably prevent invalid updates." Paragraph 5.1.1 has the Approval Authority or Technical Service verify the documented measures "by testing a vehicle of the vehicle type". Those quotes are from the original 2021 text; the 01 series of amendments to R156 (ECE/TRANS/WP.29/2025/142) has been binding on the contracting parties that apply R156 since 4 June 2026, per the UN depositary notification, so check the series your approval authority applies. For a tester, R156 points straight at the over-the-air (OTA) pipeline: update signing, the back end that distributes packages, and rollback protection.

ISO/SAE 21434: what can be quoted from a paywalled standard

ISO/SAE 21434 is sold by ISO and SAE, so its clauses cannot be quoted here. What the public record shows:

• Version. ISO's catalogue page (archived 27 September 2026) lists ISO/SAE 21434:2021, edition 1, published August 2021, 81 pages, from committee ISO/TC 22/SC 32, at stage 90.20, "International Standard under systematic review", since 15 July 2026. As of October 2026, the 2021 edition is the current one.

• Status. The same page states the standard "replaces the earlier SAE J3061 guideline" and answers "Is ISO/SAE 21434 mandatory?" with "While not legally mandatory, it is increasingly becoming a de facto requirement due to regulatory pressures and industry expectations."

• Penetration testing. NHTSA's 2022 best practices, footnote 26, describe the standard this way: "ISO/SAE 21434 recommends penetration testing as part of [RC-10-12] the cybersecurity validation requirements and recommendations." The identifier is a recommendation (RC), not a requirement (RQ), so on NHTSA's reading the standard recommends penetration testing rather than requiring it. NHTSA's footnote 27 adds that a vulnerability analysis (work product WP-08-05) "should be generated for each vulnerability identified during cybersecurity testing."

In practice, OEMs pass 21434 expectations to suppliers by contract, often through a cybersecurity interface agreement, and that contract, not the standard, usually sets the test. Ask the OEM for the exact test evidence it expects before scoping.

TISAX for suppliers: the VDA ISA catalogue

TISAX labels are assessed against the VDA Information Security Assessment (ISA). The ENX download centre lists ISA 6.0.3 as the current catalogue and ISA2027 as "the basis of TISAX Assessments ordered from 2027", noting that "the final date to open an initial assessment under ISA6 is March 2027." The ISA sorts requirements into "must", "should", and additional requirements for "high" and "very high" protection needs. Penetration testing appears twice, both times as an example:

• Control 5.2.6, additional requirement for high protection needs (ISA 6.0.3): "For critical IT systems or services, additional system or service audit requirements have been identified and are fulfilled (e.g., service specific tests and tools and/or human penetration tests, risk-based time intervals)."

• Control 5.3.1, additional requirement for very high protection needs (ISA 6.0.3): "The security of purpose built software or significantly customized software is tested (e.g. penetration testing)" during commissioning, in case of significant changes, or at regular intervals. ISA2027 keeps the same wording in the same column.

The TISAX Participant Handbook (version 2.8) explains why the column matters: at assessment level 2 "the audit provider does a plausibility check", while at assessment level 3 it "does a comprehensive verification." In the handbook's table, the assessment objectives for very high protection needs and for prototype parts and vehicles are assessed at level 3.

NHTSA's cybersecurity best practices (United States)

NHTSA's Cybersecurity Best Practices for the Safety of Modern Vehicles, dated September 2022, describes itself as "non-binding and voluntary guidance". As of October 2026 it is the current edition. Its testing items:

• [G.13] "Manufacturers should also pursue product cybersecurity testing, including using penetration tests, as part of the development process."

• [G.14] "Test stages should employ qualified testers who have not been part of the development team, and who are highly incentivized to identify vulnerabilities."

• [G.39] "The automotive industry should consider carrying out organizational and product cybersecurity audits annually."

• [T.20] "Manufacturers should use appropriate encryption and authentication methods in any operational communication between external servers and the vehicle."

Every item uses "should". NHTSA does not mandate a test, but G.14 is the clearest statement in North America of independence: the tester should not be the developer.

Transport Canada's vehicle cyber security guidance (Canada)

Transport Canada's Canada's Vehicle Cyber Security Guidance (TP 15440E, March 2020) is listed as the current guidance on the department's vehicle cyber security page, alongside its Vehicle Cyber Security Strategy (August 2021) and the Vehicle Cyber Security Assessment Tool, which the page calls "a voluntary tool". The guidance describes Transport Canada's approach as using "non-regulatory guidance and tools". Section 3.2, Security audits, reads: "Self-reviews should be supplemented by penetration testing of systems, networks, and applications to identify vulnerabilities that could potentially be exploited. Independent security audits should be performed regularly."

The US connected vehicle rule (BIS, 2025)

The Bureau of Industry and Security's connected vehicles final rule (90 FR 5360, published 16 January 2025, effective 17 March 2025) is a supply chain rule, not a testing rule. It prohibits connected vehicle manufacturers from importing or selling vehicles that incorporate covered software, and importers from bringing in Vehicle Connectivity System hardware, "designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia." Under 15 CFR 791.308, the software prohibition bites from model year 2027 and the hardware prohibition from model year 2030 (or 1 January 2029 for hardware not tied to a model year). Manufacturers file Declarations of Conformity under 791.305. The rule asks for no penetration test; it matters to testers only through the component inventory it forces.

What gets tested on a connected vehicle program

An automotive scope splits along the vehicle's edge. Inside it, testing needs benches, harnesses, hardware tools and, for full-vehicle work, a garage. Outside it, the attack surface is web, API, mobile, cloud and network, and that is where the Kia and Subaru findings sat.

In-vehicle layers (specialist hardware labs):

• ECUs and gateways. Debug interfaces such as JTAG left from development (R155 Annex 5 threat 28.2 names "debug ports, JTAG ports"), secure boot, firmware extraction, diagnostic services (UDS) and seed-key authentication.

• CAN, CAN FD and automotive Ethernet. Message injection, gateway filtering between domains, and the trust between ECUs.

• Telematics and infotainment units. Cellular, Wi-Fi and Bluetooth interfaces, exposed network services (NHTSA's T.17 to T.19 on network ports) and the path from infotainment to safety domains.

• EV charging interfaces. The vehicle side of charging communication and the charger hardware itself.

Connected layers (application, cloud and network testers):

• Companion mobile apps. Token storage in Keychain and Keystore, certificate pinning, deep links, and the remote commands the app can send: unlock, start, locate. Tested against OWASP MASVS and MASTG; the mobile application penetration testing guide covers scope and cost.

• Cloud APIs and the OTA back end. Object-level authorization on every endpoint that takes a VIN, account or vehicle identifier, the binding between an account and a vehicle, command authorization, and update signing and distribution (R156 7.2.1.1). Broken object level authorization is first in the OWASP API Security Top 10.

• Owner, dealer, fleet and employee portals. The Kia and Subaru issues both came through this layer: a dealer portal and its API at Kia, and an employee admin portal at Subaru. Role-by-role testing of every portal, including internal ones, is the core of this layer; the web application penetration testing guide explains how it is scoped.

• Corporate network, cloud and red team. The engineering network, build servers, signing keys and cloud tenancy behind the products, tested through network, cloud and red team engagements.

The two halves meet at the telematics back end: the API that relays an app command to the telematics unit. Specify which firm owns that boundary so it is tested from both sides. For a comparison of scanning, penetration testing and PTaaS on the connected half, see security assessment services compared.

How the ranking was built

Nine firms were scored on six criteria, and every vendor claim traces to the vendor's own website, checked on 12 October 2026.

1. Published automotive work. A service page, case study or research page showing vehicle, supplier or mobility work; logo walls alone did not count.

2. Penetration testing sold as a service. Scanners, monitoring platforms and type approval bodies that do not sell testing were not ranked.

3. Coverage of both halves. In-vehicle depth, connected-layer depth, or both, stated plainly.

4. Fit with R155, ISO/SAE 21434, TISAX and NHTSA evidence.

5. North American delivery. Offices or labs in the US or Canada, or remote delivery to them.

6. Ownership checked. Each firm's parent company and recent transactions were checked and are stated in its entry.

Quick comparison: best automotive penetration testing companies

1. Stingrai (top rated for connected-vehicle apps, APIs and portals)

World-Class Offensive Security.

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

Stingrai holds CREST accreditation at firm level as a penetration testing service provider, one of a small number of CREST-accredited firms headquartered in Canada, with an office in London, UK. Each engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs, bug bounty Hall of Fame listings at Apple, Google, Facebook, Yahoo, the US Department of Defense, the US Federal Reserve, PaySafe and Zynga, and a founding member of Uber's offensive security team. Stingrai is rated 5.0 out of 5 on Clutch (20 reviews) and 4.9 out of 5 on G2.

For automotive companies, Stingrai's fit is the connected half of the program, and it is plain about the line: in-vehicle ECU, CAN and hardware testing is specialist lab work that Stingrai does not claim, and the specialists ranked below cover it. What Stingrai tests is the layer where the Kia and Subaru findings sat: the companion iOS and Android apps, the cloud APIs that relay remote commands, owner, dealer, fleet and employee portals, the OTA back end's web and API surface, the corporate and engineering network, and red team scenarios against the organization. Its case studies include Mondofix, a Blainville, Quebec automotive aftermarket group that describes its network of collision, glass and mechanical repair facilities as spanning more than 2,000 locations worldwide, where Stingrai tested across multiple scopes and sent weekly updates on findings, as well as eleven-x, a Waterloo, Ontario smart parking company, and a Munich-based EV charging platform.

Services and scope

• Application security: web applications and APIs, mobile applications, and AI and LLM systems.

• Network and cloud security: internal and external networks, Active Directory, Wi-Fi, and cloud environments.

• Social engineering: phishing campaigns and physical security assessments.

• Adversary simulation: red teaming and purple teaming.

For a connected-vehicle platform, the API test is authenticated across every role (owner, secondary driver, dealer, fleet manager, support agent, administrator), centered on broken authorization and IDOR on VIN, account and vehicle identifiers, the account-to-vehicle binding and remote command authorization, and source-assisted when repository access is given. Mobile testing covers the IPA and APK, Keychain and Keystore storage, certificate pinning bypass with Frida and objection, and the backend API, aligned to OWASP MASVS and MASTG.

Delivery and evidence

Findings are posted to the PTaaS platform as they are confirmed, each with a working proof of concept and prioritized remediation guidance, so engineering teams can fix before the report. Clients chat live with their penetration testers, push findings into Jira and Slack, and receive a redactable PDF report that can be filed with R155 risk documentation, shared with an OEM under a cybersecurity interface agreement, or given to a TISAX auditor. Retesting is included, and human-led and hybrid engagements close with an attestation letter and a verified badge. Stingrai's testing produces evidence for SOC 2, ISO 27001, PCI DSS and NIST 800-171 programs, delivered as a one-time annual test or a continuous program that tests each release.

Where Snipe fits

Snipe is Stingrai's autonomous AI agent for web applications and associated APIs. Trained on more than 6,000 HackerOne Hacktivity reports and Stingrai's penetration testers' methodology, it hunts IDOR, broken authorization and business logic flaws, performs white-box code review, opens AutoFix pull requests, gates pull requests and runs automated retests. For an automotive company it fits owner, dealer and fleet portals and their APIs, the class of system behind the Kia and Subaru findings. In a Hybrid engagement the penetration testers and Snipe test together throughout, with the testers directing its focus. Companion mobile apps, cloud, networks and red team scopes are tested by the penetration testers.

Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). Mobile apps, multi-portal platforms, cloud, network and red team scopes are quoted through the Enterprise tier.

2. NCC Group

NCC Group is a cybersecurity firm headquartered in Manchester, UK, listed on the London Stock Exchange, with roots in the National Computing Centre's commercial divisions sold in 1999. In June 2026, after selling its Escode escrow business to TDR Capital, NCC Group concluded a strategic review that had considered a sale of the company and decided to remain listed as a pure-play cybersecurity business (NCC Group interim results, 11 June 2026). Its connected vehicle case study describes work for an OEM that "wanted to ascertain the security posture of the connectivity within a new SUV", covering a web application and infrastructure assessment, a mobile backend assessment and the OEM's mobile application. The same page states that NCC Group "works with many OEMs across the world on cyber security projects delivering technical and risk-based security assessments of Automotive projects, from ECU testing through to full vehicle assessments."

In October 2024 NCC Group became a strategic partner of Auto-ISAC, describing services "ranging from bespoke vehicle security testing and regulatory compliance expertise to helping manufacturers manage complex global supply chains."

Delivery model: consulting across transport, with automotive, aerospace, rail and maritime practices. No list price is published on the pages reviewed.

Best for: OEMs that want one firm to test the vehicle, its back end and its mobile app in the same program.

3. IOActive

IOActive is a privately held security firm founded in Seattle in 1998, which states on its home page that it has been "Independent since 1998." Its vehicle security page lists research on "local and remote CAN bus attacks", "commercial truck testing, autonomous vehicles, electric vehicle supply equipment (EVSE), Electronic Brake Control Modules (EBCMs), infotainment systems", and states: "Our assessments have also covered remote access, web applications, back-end APIs, and embedded systems." The page says IOActive performs threat analysis and risk assessment in compliance with ISO/SAE 21434 and has helped clients toward ISO 24089, R155 and R156.

Delivery model: research-led consulting with hardware and embedded depth. No list price is published on the pages reviewed.

Best for: OEMs and suppliers that want research-grade testing of components and the vehicle, with back-end and web coverage from the same team.

4. Block Harbor

Block Harbor is an automotive-only cybersecurity firm headquartered in Detroit, Michigan, which says on its about page that it was "Born in Detroit with automotive expertise at our core." In April 2023 VicOne, a Trend Micro subsidiary, announced "a significant strategic financial investment in Block Harbor"; the release does not state the size of the stake.

Its Red Team Services page is the only one in this ranking with published prices: a Penetration Assessment Service listed at "$50,000+" with a timeline of 4+ weeks, a Remote Penetration Assessment Service at "$30,000+" with a timeline of 2+ weeks, and reverse engineering, fuzz testing and regression testing priced separately. Testing covers "CAN, Ethernet, USB, Wi-Fi, Bluetooth, Web API, Mobile, GPS, Hardware", and the page says "All testing follows ISO/SAE 21434 and UN R155 standards."

Delivery model: automotive red team services alongside its VSEC platform. Published pricing as above.

Best for: Michigan and Ontario suppliers that want an automotive specialist with a published price before the first call.

5. NetSPI

NetSPI is headquartered in Minneapolis, Minnesota, and lists an office in Toronto, Ontario on its contact page. It is backed by the private equity firm KKR, which in October 2022 agreed to provide an additional US$410 million in growth equity, bringing its total commitment to US$500 million as existing investor Sunstone Partners exited, as NetSPI's newsroom reported; NetSPI was founded in 2001. In October 2026 NetSPI completed a merger with Synack, the continuous security testing company, announced on 2 September 2026; KKR backs the combined company (NetSPI release). Its automotive penetration testing page tests mobile applications, thick client applications, connected environments, internet connectivity, internal network security, sensor data, and containers and hypervisors, and refers to "the automotive Threat Analysis and Risk Assessment (TARA) methods" and to "ISO 26262-1:2018, ISO/SAE 21434, R155 and R156."

Delivery model: platform-delivered testing within a hardware and embedded systems practice. No list price is published on the pages reviewed.

Best for: automotive companies that already test applications and networks on NetSPI's platform and want the vehicle program in the same place.

6. DEKRA

DEKRA is a testing, inspection and certification organization founded in 1925 and headquartered in Stuttgart, Germany, which describes itself as "the world's largest independent, non-listed expert organization in testing, inspection, and certification." In May 2025 it held the grand opening of its Michigan Automotive Test Center of Excellence in Plymouth, Michigan, offering "advanced cybersecurity testing and certifications, specifically penetration testing for components, full vehicles, and compliance with standards like ISO 21434 or regulations like RED-DA or UN R155."

Delivery model: lab testing alongside EMC, EV and connectivity certification work. No list price is published on the pages reviewed.

Best for: suppliers that want component or full-vehicle penetration testing in a Michigan lab next to their other certification testing.

7. Pen Test Partners

Pen Test Partners is a UK firm founded in 2010, organized as a limited liability partnership with its UK office in Buckingham and a US office in New York. Its Transport Systems Testing page lists "Automotive manufacturers, suppliers and mobility providers" among the organizations it supports and describes its automotive work as: "Test in-vehicle networks, ECUs, and mobility platforms." Its about page states: "We've tested everything from ships and planes to cars and EV chargers."

Delivery model: consulting with transport, OT and maritime practices. No list price is published on the pages reviewed.

Best for: mobility platforms, fleets and suppliers that want vehicle networks and the connected platform tested by one consultancy.

8. VicOne

VicOne is an automotive cybersecurity company headquartered in Tokyo and a wholly owned subsidiary of Trend Micro, with operations in Taiwan, Germany and the United States. Its xScope page describes "a comprehensive, flexible automotive-grade penetration testing service" whose target range "can accommodate hardware, software, firmware, document data, and even an entire vehicle", including ECU and in-vehicle infotainment hardware and software, OTA update integrity and communication protocols. VicOne is also the investor in Block Harbor named above.

Delivery model: a testing service alongside VicOne's automotive security products. No list price is published on the pages reviewed.

Best for: OEMs and Tier 1 suppliers that want ECU and infotainment testing from the same vendor as their vehicle security monitoring.

9. Assured

Assured is a security consultancy that began in 2015 in Gothenburg, Sweden, according to its about page, which does not name a parent company. Its automotive penetration testing page covers "vehicles, ECUs, backend systems, mobile apps, and supporting infrastructure", including diagnostic systems, infotainment and connectivity, digital key systems, OTA update pipelines, "Cloud and mobile app ecosystems supporting the vehicle", and "Witnessed audits for type approval according to UNECE R155/R156."

Delivery model: boutique consulting. No list price is published on the pages reviewed.

Best for: suppliers to Nordic OEMs that want one boutique for the vehicle, its back end and its apps.

Also considered

Keysight Technologies' device security research lab, Riscure Security Solutions (Keysight acquired Riscure in February 2024), received approval from the Netherlands Vehicle Authority in May 2024 as a designated technical service for R155 and R156 type approval. Type approval evaluation is the authority's verification under paragraph 5.1.2, a different job from a manufacturer's own pre-approval testing, and Keysight's automotive penetration testing service page could not be loaded for verification on 12 October 2026, so it is not ranked.

An automotive penetration testing checklist

• [ ] Name the driver for each test: an R155 type approval file, an OEM's cybersecurity interface agreement, a TISAX label at assessment level 3, an insurer, or NHTSA and Transport Canada guidance.

• [ ] Split the scope at the vehicle's edge and assign each half: a hardware lab for ECUs, buses, telematics and infotainment units; application and network testers for apps, APIs, portals, cloud and corporate networks.

• [ ] Name one owner for the telematics back end, where an app command becomes a vehicle command, and test it from both sides.

• [ ] Write the role matrix for every portal: owner, secondary driver, dealer, fleet manager, support agent, administrator and service accounts.

• [ ] Put internal and employee portals in scope; the Subaru finding came through an admin portal.

• [ ] Test the OTA pipeline end to end: signing keys, package storage, distribution APIs and rollback protection (R156 7.2.1.1, NHTSA T.22 and T.23).

• [ ] Use testers outside the development team (NHTSA G.14) and record their independence in the report.

• [ ] Ask for a report that records scope, method, findings and retest results in a form the OEM, the approval authority's technical service or the TISAX auditor can file.

How much does automotive penetration testing cost in 2026?

Cost follows scope, and the two halves price very differently. Block Harbor publishes the only in-vehicle prices found in this review: a Penetration Assessment Service listed at "$50,000+" over 4+ weeks and a remote assessment at "$30,000+" over 2+ weeks (Block Harbor). On the connected half, Stingrai publishes package pricing: an Autonomous Pentest at US$3,000 per assessment or US$650 per month on a 12-month plan, and a Hybrid Pentest at US$6,800 per assessment or US$1,275 per month, each covering one web application and associated APIs (pricing page); mobile apps, multiple portals, cloud and network scopes are quoted. For benchmarks, see the penetration testing cost guide and the pentest cost calculator.

Frequently Asked Questions

Who are the best automotive penetration testing companies in 2026?

The best automotive penetration testing companies in 2026 are Stingrai, NCC Group, IOActive, Block Harbor, NetSPI, DEKRA, Pen Test Partners, VicOne and Assured. Stingrai ranks first for the connected half of a vehicle program: companion mobile apps, cloud APIs, owner, dealer and fleet portals, networks and red team, tested by two named penetration testers with retesting and an attestation letter, as a one-time annual test or a continuous program. For in-vehicle ECU and hardware testing, the specialists with automotive labs in this list are the right choice.

Does UN R155 require penetration testing?

Not by name. Paragraph 7.3.6 requires the vehicle manufacturer to "perform, prior to type approval, appropriate and sufficient testing to verify the effectiveness of the security measures implemented", and paragraph 7.2.2.2(e) requires CSMS processes for testing the cyber security of a vehicle type. The regulation does not prescribe the method; a penetration test is the usual evidence for exposed interfaces.

Does R155 apply to companies in the United States and Canada?

Not as domestic law. The United States and Canada are not parties to the UNECE 1958 Agreement. R155 applies through type approval in contracting parties such as the European Union, the United Kingdom, Japan and Korea, so North American OEMs meet it when they sell vehicles there, and suppliers meet it through the manufacturer's duty to manage supplier-related risks under paragraphs 7.2.2.5 and 7.3.2.

Does ISO/SAE 21434 require penetration testing?

The standard is paywalled, so its clauses cannot be quoted. NHTSA's 2022 best practices describe it as recommending penetration testing under recommendation RC-10-12, part of its validation requirements and recommendations. ISO's own page says the standard is not legally mandatory but is "increasingly becoming a de facto requirement". As of October 2026, the current edition is ISO/SAE 21434:2021, under systematic review since 15 July 2026.

Does TISAX require penetration testing?

Not as a general rule. In the VDA ISA 6.0.3 catalogue, penetration testing appears as an example in additional requirements: "human penetration tests" for critical IT systems at high protection needs (control 5.2.6), and testing of purpose-built or significantly customized software "e.g. penetration testing" at very high protection needs (control 5.3.1). ISA2027, the basis for assessments ordered from 2027, keeps the same wording.

What does NHTSA say about automotive penetration testing?

NHTSA's Cybersecurity Best Practices for the Safety of Modern Vehicles (September 2022) are non-binding. Best practice G.13 says manufacturers "should also pursue product cybersecurity testing, including using penetration tests, as part of the development process", and G.14 says testing should use qualified testers who have not been part of the development team.

Can one firm test both the vehicle and the companion app?

Some can. NCC Group, IOActive, Block Harbor and Assured describe both in-vehicle and back-end or app work on the pages reviewed. Many programs split the work: a hardware lab for ECUs, buses and telematics units, and an application and network firm such as Stingrai for the apps, APIs, portals and cloud, with one owner named for the telematics back end where the two meet.

How much does an automotive penetration test cost?

It depends on the half. Block Harbor lists in-vehicle penetration assessments at "$50,000+" ("$30,000+" remote). Stingrai's published packages for the connected half are US$3,000 per assessment for the Autonomous Pentest and US$6,800 per assessment for the Hybrid Pentest, each covering one web application and associated APIs, or US$650 and US$1,275 per month on a 12-month plan. Mobile apps, multiple portals and network scopes are quoted.

Related reading

• Best Penetration Testing Companies for Auto Dealerships (2026), for dealer groups and the FTC Safeguards Rule.

• Best Manufacturing Penetration Testing Companies (2026), for plants, OT and TISAX on the factory side.

• Best Logistics and Transportation Penetration Testing Companies (2026), for fleets, freight and telematics operators.

• Mobile Application Penetration Testing Services (2026), for companion app scope and MASVS coverage.

• Web Application Penetration Testing Services (2026), for owner, dealer and fleet portals.

References

1. Sam Curry and Shubham Shah, Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel, 23 January 2025. https://samcurry.net/hacking-subaru

2. Sam Curry and others, Hacking Kia: Remotely Controlling Cars With Just a License Plate, September 2024. https://samcurry.net/hacking-kia

3. UN Regulation No. 155, consolidated text incorporating Supplement 3, OJ L 2025/5, 10 January 2025. https://eur-lex.europa.eu/eli/reg/2025/5/oj

4. UN Regulation No. 156, original text, OJ L 82, 9 March 2021. https://eur-lex.europa.eu/eli/reg/2021/388/oj

5. UN depositary notification C.N.237.2026.TREATIES-XI.B.16.156, amendments to UN Regulation No. 156 (01 series), binding 4 June 2026. https://treaties.un.org/doc/Publication/CN/2026/CN.237.2026-Eng.pdf

6. UN Treaty Collection, 1958 Agreement, status of participants. https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mtdsg_no=XI-B-16&chapter=11&clang=_en

7. ISO, ISO/SAE 21434:2021 Road vehicles, Cybersecurity engineering, catalogue page archived 27 September 2026. https://web.archive.org/web/20260927121109/https://www.iso.org/standard/70918.html

8. ENX Association, TISAX downloads (VDA ISA 6.0.3, ISA2027, Participant Handbook 2.8). https://portal.enx.com/en-us/TISAX/downloads/

9. NHTSA, Cybersecurity Best Practices for the Safety of Modern Vehicles, September 2022. https://www.nhtsa.gov/sites/nhtsa.gov/files/2022-09/cybersecurity-best-practices-safety-modern-vehicles-2022-tag.pdf

10. Transport Canada, Canada's Vehicle Cyber Security Guidance, TP 15440E, March 2020. https://tc.canada.ca/sites/default/files/2023-03/cyber_guidance_en.pdf

11. Transport Canada, Vehicle cyber security. https://tc.canada.ca/en/road-transportation/innovative-technologies/connected-automated-vehicles/vehicle-cyber-security

12. Bureau of Industry and Security, Securing the ICTS Supply Chain: Connected Vehicles, final rule, 90 FR 5360, 16 January 2025. https://www.federalregister.gov/documents/2025/01/16/2025-00592/securing-the-information-and-communications-technology-and-services-supply-chain-connected-vehicles

13. eCFR, 15 CFR 791.308 Exemptions. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-E/part-791/subpart-D/section-791.308

14. OWASP, API Security Project. https://owasp.org/API-Security/

Talk to Stingrai

An automotive program needs two kinds of testing: a lab for the vehicle and a team for everything the vehicle talks to. Stingrai takes the second: two named penetration testers on the companion apps, the APIs that carry remote commands, every owner, dealer, fleet and employee portal, the OTA back end's web surface, the cloud and the corporate network, with retesting and an attestation letter that an OEM, a technical service or a TISAX auditor can file, as a one-time annual test or a continuous program. Book a free scoping call, get a quote for a multi-portal or mobile scope, or read the published packages on the pricing page.