Reading Time: 4 Minutes
A commercial vehicle used to be defined largely by what happened beneath its bonnet, between its wheels and inside its mechanical systems. That definition is changing.
Today's truck can communicate with a fleet-management platform, transmit operational data, receive software updates and connect to diagnostic systems. Telematics can reveal where it is and how it is being driven. Remote diagnostics can bring the workshop closer to the vehicle. Over-the-air updates can change software without the truck returning to the depot.
Connectivity is making the commercial vehicle more intelligent. It is also giving the vehicle something the traditional truck never had at this scale: a digital attack surface. And that changes the meaning of fleet safety.
WHY THIS MATTERS
- Cybersecurity was once largely regarded as an IT concern. For the connected commercial vehicle, that boundary is disappearing.
- A modern fleet depends on a network of vehicles, telematics platforms, cloud services, diagnostic systems and software.
- That is why cybersecurity is moving into the vehicle's lifecycle rather than remaining an issue addressed after production.
- For fleet operators, the message is becoming clear: a connected vehicle needs a security strategy just as much as it needs a maintenance strategy.
THE TRUCK HAS BECOME A NETWORK
This transformation did not happen overnight.
Electronic control units became more sophisticated. Telematics brought vehicles into communication with the outside world. GPS and other positioning technologies gave fleets greater visibility. Remote diagnostics reduced the distance between vehicle and workshop. Cloud platforms turned individual vehicle information into fleet intelligence.
Then came increasingly software-defined architectures and over-the-air updates. Each development created operational value. But each also introduced another digital relationship that needs to be secured. The truck is therefore no longer an isolated machine. It is one node in a much larger operational network.
THE NEW ATTACK SURFACE
The cybersecurity challenge lies not only inside the truck, but in the connections surrounding it.
A vehicle generates information. Telematics transmit it. Communications networks carry it. Cloud platforms process it. Fleet-management systems turn it into information for operators. Workshops may subsequently use connected systems to diagnose or service the vehicle. At every stage, questions arise around authentication, permissions, data protection and system integrity.
The same applies to remote access. If a system can be reached from outside the vehicle, the organisation needs to know who can reach it, why they can reach it and what they are permitted to do. Cybersecurity is therefore becoming less about protecting one machine and more about understanding the trust relationships across the entire fleet ecosystem.
WHEN DIGITAL RISK BECOMES FLEET RISK
This is where cybersecurity enters the safety conversation.
Episode 01 of emBRWace Explains, Safety Doesn't Happen by Accident, established that fleet safety is created through the interaction of people, processes and technology. Connectivity adds another dimension. A fleet can have a highly trained driver, a well-maintained vehicle and a strong physical safety culture, yet still face disruption through the digital systems supporting its operation.
That does not mean every cyber incident will affect vehicle control or road safety. The consequences depend on the architecture, the system involved and the security controls in place. But the risk itself has changed. A digital incident can potentially become a fleet-availability issue, a data-security problem, an operational-continuity challenge or, in some circumstances, a safety concern. Cybersecurity therefore belongs in the same risk-management conversation as maintenance and business continuity.
THE SOFTWARE QUESTION
Perhaps nowhere is the changing nature of the vehicle more apparent than in software. A mechanical component generally remains what it is until it is physically replaced. Software can be updated, patched and modified remotely. That creates enormous advantages. Vulnerabilities can potentially be addressed without waiting for every affected vehicle to return to a workshop, while functionality can evolve throughout the vehicle's operating life.
But the update process itself must be protected. An update needs to come from an authorised source. The vehicle must be able to establish that the software is genuine. The process needs to be controlled, monitored and recorded. This is the thinking behind UN Regulation No. 156, which establishes requirements for software-update management. If software can change the vehicle, the process that changes the software must also be secure.
RESPONSIBILITY NO LONGER STOPS AT THE FACTORY GATE
Commercial vehicles add another layer of complexity because many do not remain exactly as they left the original manufacturer's production line. A chassis may pass to a body builder. A vehicle may be converted for a specialist application. Additional electronic systems may be installed. Third-party telematics platforms may be connected. Fleet software may be integrated. Workshops and service providers may require digital access.
The vehicle therefore becomes part of a chain of organisations, systems and technologies., UNECE has specifically examined the implementation of R155 and R156 for multi-stage vehicles, recognising the challenges of managing cybersecurity and software updates across different stages of vehicle completion. The implication is significant: Cybersecurity responsibility cannot simply stop at the OEM factory gate. The vehicle has a lifecycle. Its cybersecurity has to travel through that lifecycle with it.
THE HUMAN CONNECTION
Cybersecurity may sound highly technical, but some of its most important safeguards still depend on people.
- Who has access to the fleet-management platform?
- Who can change permissions?
- Who is authorised to connect diagnostic equipment?
- Who can approve a software update?
- Who knows what to do when something unusual happens?
Technology cannot compensate indefinitely for weak access management or poor organisational discipline. The lesson echoes Episode 01: technology can provide information and protection, but people remain responsible for the decisions that follow. A connected fleet therefore needs not only technological protection, but a culture of digital responsibility.
BUILDING A RESILIENT CONNECTED FLEET
Cybersecurity begins with visibility. A fleet needs to know what is connected: its vehicles, telematics systems, cloud platforms, diagnostic interfaces, software-update channels and third-party service providers. It needs to understand who has access to those systems and how information moves between them. Protection can then be layered around the ecosystem.
Secure architectures can reduce unnecessary exposure. Network segmentation can limit the spread of a compromise. Encryption can protect information in transit. Identity and access management can restrict digital entry to authorised users and devices. Intrusion detection can help identify behaviour that falls outside established patterns.
Software updates can address vulnerabilities as they emerge. But none of this creates a permanent finish line. Cybersecurity is a continuous process of identifying, protecting, monitoring, responding and recovering. A fleet therefore needs to be prepared not only to prevent an incident, but also to recognise one and restore operations when something goes wrong.
THE BUSINESS OF CYBER RESILIENCE
The business case is ultimately straightforward. A vehicle that cannot operate cannot deliver. A disrupted fleet-management system can affect dispatching and visibility. Lost data can complicate planning and customer communication. Recovering from an incident can consume technical resources, management time and operational capacity. For a logistics company, cybersecurity is therefore not simply about protecting information. It is about protecting availability, continuity and confidence.
The question for fleet operators is consequently changing.
Not:
“Do we need cybersecurity?”
But:
“How resilient is our fleet when something goes wrong digitally?”
THE FLEET CYBERSECURITY CHECK
Every fleet does not need to become a cybersecurity laboratory. But every fleet should be able to answer a few basic questions.
- Who has access to our connected-vehicle systems?
- Which external organisations have access to our data or platforms?
- How are credentials and permissions managed?
- How are software updates authenticated and controlled?
- Can unusual activity be detected?
- Do drivers, technicians and managers know what a cyber incident might look like?
- And if an incident occurs, does the organisation know who acts first, what gets isolated and how operations are restored?
These questions belong in fleet governance, not only in the IT department.
THE REGULATORY SHIFT
The regulatory direction is already clear. UN R155 and R156 have established an international framework for managing vehicle cybersecurity and software updates. The European Union has incorporated these regulations into its vehicle type-approval framework, while other jurisdictions are adopting or adapting comparable requirements.
Great Britain, for example, has established a revised implementation timetable, with R155 and R156 requirements beginning to apply to new vehicle types from 1 June 2026, followed by complete and incomplete vehicles from 1 June 2027. For manufacturers, suppliers and operators, this represents more than another compliance exercise.
It reflects a fundamental change in the industry's understanding of the vehicle. The truck is becoming a software-defined and connected asset. Its security therefore has to be managed throughout its life.
MOBILITY ANSWERS
1.Can a commercial vehicle really be hacked?
Connected vehicles contain electronic systems and communication interfaces that create cybersecurity risks. The nature and severity of those risks depend on the vehicle architecture, connectivity and security controls. It would therefore be misleading to suggest that every connected truck is equally vulnerable or that every cyberattack can remotely control a vehicle.
2.Is cybersecurity only an OEM responsibility?
No. Manufacturers have major responsibilities under vehicle cybersecurity frameworks, but the connected ecosystem extends to suppliers, converters, telematics providers, fleet platforms, workshops and fleet operators.
3.Why are software updates part of cybersecurity?
Software vulnerabilities can emerge during a vehicle's operating life. Secure update processes allow manufacturers to address vulnerabilities while controlling the authenticity and integrity of the software being installed. This is one of the purposes of UN R156.
4.Can cybersecurity affect physical safety?
Potentially, depending on which systems are compromised and what functions they influence. Cybersecurity and functional safety are distinct disciplines, but in increasingly connected vehicles their risk considerations can overlap.
5.What should a fleet operator do first?
Begin with visibility. Identify every connected vehicle system, platform, interface and third party associated with the fleet. Then establish who has access, what that access allows and how unusual activity would be detected and handled.
6.Does regulatory compliance mean a fleet is completely secure?
No. Compliance provides a structured framework for managing risk. Cybersecurity remains an ongoing discipline because software, connectivity and threats continue to evolve.
BY THE NUMBERS
155
The number of the UN regulation covering vehicle cybersecurity and Cyber Security Management Systems.
156
The UN regulation covering software updates and Software Update Management Systems.
2021
The year UN R155 and R156 entered into force internationally.
2026
Great Britain's revised implementation schedule begins applying R155/R156 to new vehicle types from 1 June 2026.
2027
The requirements extend to complete and incomplete vehicles from 1 June 2027 under the GB timetable.
emBRWace INSIGHT
The connected commercial vehicle has changed the definition of fleet safety. Yesterday, much of the safety conversation centred on what happened on the road. Today, part of that conversation has moved into the systems supporting the journey. The answer is not to disconnect. Connectivity is one of the foundations of modern fleet intelligence. It enables predictive maintenance, remote diagnostics, operational visibility and increasingly sophisticated fleet management.
The answer is to make security part of that intelligence. Connect intelligently. Secure continuously. Operate confidently.
THOUGHT TO TAKE AWAY
A connected truck expands the definition of fleet safety from protecting the vehicle on the road to protecting the systems behind it.
RESEARCH SOURCES:
- United Nations Economic Commission for Europe (UNECE)
- UK Department for Transport
NEXT ON FLEET BEAT
A connected fleet can generate enormous volumes of information. But data alone does not make a fleet intelligent.
The next episode explores the journey from vehicle data to actionable intelligence — and why turning information into better decisions could become one of the fleet industry's most important competitive advantages.
Coming Soon…
