Supplying Carmakers? The Penetration Testing Vehicle Cyber Security Reviews Expect

Why vehicle mobile companion security assurance now lands on your desk

Vehicle mobile companion security assurance lands on your desk because your app, and the APIs behind it, sit inside the manufacturer’s regulated attack surface, and the carmaker needs evidence that your code will not become the weakest link in their type approval.

This applies whether your agency or product team supplies an OEM companion app, a fleet management app or an SDK that talks to vehicles. Remote lock and unlock, pre-conditioning, location history, charging control and over-the-air update triggers all flow through your code.

The commercial consequence is simple. Manufacturers cannot obtain or keep vehicle type approval without demonstrating that cyber security risks are managed across their supply chain. They discharge that duty contractually: security questionnaires, interface agreements, and a recurring request for independent testing evidence on anything that touches the vehicle. Suppliers with a recent, well-scoped penetration test report move through those reviews quickly. Suppliers without one get stuck in procurement, sometimes for months.

The regulatory driver: UNECE R155, R156 and the VCA

Two UNECE regulations sit behind the questionnaires you are receiving. UNECE Regulation 155 requires vehicle manufacturers to operate a certified Cyber Security Management System (CSMS) covering the full vehicle lifecycle, and UNECE Regulation 156 does the same for software updates. In Great Britain the Vehicle Certification Agency (VCA) acts as the approval authority under the GB type approval scheme, with policy set by the Department for Transport. For applicable vehicle categories, these requirements are mandatory: no CSMS assessment, no type approval, no sale.

Here is the honest position on where penetration testing fits. R155 does not contain a clause that says “your companion app supplier must commission a penetration test”. The obligation sits with the manufacturer, who must identify and manage risks, including supplier-related risks, and verify that mitigations actually work through testing. The regulation’s threat catalogue explicitly treats mobile applications and external connectivity as attack vectors, which is why companion apps get pulled into scope. Because the manufacturer must evidence testing of those mitigations, an independent penetration test of your app and backend is, in our experience, the form of evidence manufacturers most readily accept. It is contract-driven assurance rather than a direct legal duty on you, but in practice the OEM’s review will expect it.

What carmakers expect app suppliers to test

OEM security reviews follow the data and the commands, not just the app binary. A credible scope for a connected-vehicle supplier covers three layers.

The mobile app itself

Static and dynamic analysis of the iOS and Android builds against the OWASP Mobile Application Security Verification Standard: how credentials and vehicle pairing tokens are stored, whether certificate pinning holds up, what an attacker on a rooted or jailbroken device can extract, and whether Bluetooth or NFC pairing flows can be hijacked. Our mobile application penetration testing service is built around exactly this layer.

The APIs and vehicle command backend

This is where the serious findings live. Authorisation flaws in telematics APIs have repeatedly allowed researchers to send commands to vehicles they do not own, simply by swapping a VIN or account identifier in a request. An API penetration test should exercise every endpoint the app calls: object-level authorisation, token lifecycle, rate limiting on unlock and locate functions, and the trust boundary between your platform and the OEM’s telematics gateway.

The cloud estate behind it

Companion platforms typically run on AWS, Azure or GCP, holding location histories, driver identities and command queues. A configuration review of the tenant, identity model and secrets handling closes the loop, because a hardened app in front of a misconfigured cloud account is still a failed review.

How an engagement runs for a vehicle app supplier

An engagement is designed backwards from the document you need to hand the OEM. At EJN Labs we start by mapping the command path, which app actions result in something physical happening to a vehicle and every hop those commands take, because that map decides the scope.

From there we agree test accounts, a staging environment or ring-fenced production window, and any constraints the OEM places on touching live telematics infrastructure.

• Scoping call and threat mapping: half a day, producing a fixed quote and rules of engagement
• Testing: mobile builds, APIs and cloud configuration, typically one to two weeks depending on scope
• Reporting: findings rated by severity with reproduction steps and remediation guidance written for developers
• Retest: included, so the report you hand the carmaker shows criticals and highs verified as fixed

The report is written to be shown to a third party: methodology, scope boundary, accreditation and retest evidence on the page, not a tool export. If you want to prepare before scoping, our penetration testing checklist walks through what to have ready.

What it costs and how scope drives the price

UK penetration testing is priced on effort. Day rates at accredited firms typically run £1,100 to £1,400, and the number of days is driven by how many app builds, endpoints and cloud services sit in scope. Typical ranges for connected-vehicle suppliers:

Scope	Typical effort	Typical UK cost
Single-platform companion app plus its core API	4 to 6 days	£4,400 to £8,400
iOS and Android apps plus full API estate	5 to 8 days	£5,500 to £11,200
Apps, APIs and cloud configuration review	8 to 12 days	£8,800 to £16,800

Vehicle command functionality pushes effort towards the upper end because authorisation testing has to be exhaustive: every endpoint that can affect a car needs to be tried against accounts and vehicles it should not control. These are typical market ranges rather than a quotation; our guide to penetration testing costs in the UK breaks the pricing model down in full, and an exact fixed price comes from a short scoping call.

How EJN Labs approaches vehicle companion app testing

EJN Labs is a UK-based, CREST-accredited penetration testing firm, certified to ISO 27001 and Cyber Essentials Plus, and all testing is delivered by UK-based testers. That matters here for a specific reason: OEM security reviews and VCA-facing CSMS audits weigh the independence and accreditation of the testing firm, and a CREST report carries recognised methodology behind it.

We test companion estates as one connected system rather than three separate quotes. The same testers who pull apart the mobile builds follow the tokens they extract into the API layer and on into the cloud tenant, because that end-to-end path is exactly what the manufacturer’s threat model cares about. Findings are mapped to the risk language OEM reviewers use, so the report answers their questionnaire. If you are comparing firms, our guide to choosing a UK penetration testing provider sets out the questions worth asking any of us.

Frequently Asked Questions

Does UNECE R155 legally require my company to run a penetration test?

Not directly. R155 places obligations on the vehicle manufacturer, who must manage cyber security risk across the supply chain and verify mitigations through testing, so for an app supplier it is a contractual expectation backed by regulation rather than a direct legal duty on your firm.

That duty cascades to app suppliers through contracts and security reviews, where an independent penetration test is the evidence most commonly requested.

What does a penetration test cost for a vehicle companion app?

Between £4,800 and £16,800 at typical UK day rates of £1,100 to £1,400. A single-platform app and its core API runs 4 to 6 days, testing iOS and Android plus the full API estate typically takes 5 to 8 days, and adding a cloud configuration review takes it to 8 to 12 days.

In money terms that is £4,400 to £8,400 for the single-platform scope, £5,500 to £11,200 for both mobile builds and the API estate, and £8,800 to £16,800 with the cloud review included. An exact fixed price comes from scoping.

What should be in scope for an OEM security review?

Both mobile builds and every API endpoint the app can reach, at minimum, with particular depth on authorisation around vehicle commands and personal data such as location history. Most OEM reviews also expect the supporting cloud environment to be assessed.

Scope should follow the command path from the user’s phone to the point where your platform hands over to the manufacturer’s telematics infrastructure.

Can you test against live vehicles?

Only with explicit written agreement from the manufacturer, and usually it is unnecessary. Engagements typically run against a staging environment or test vehicles supplied by the OEM, with production APIs tested under agreed constraints. Sending commands to customer vehicles is never an acceptable test method.

The rules of engagement are fixed during scoping and shared with the OEM where they ask to see them.

How often will carmakers expect us to retest?

Annually as a baseline, and after any significant change to the app or its APIs, because R155 obliges manufacturers to manage risk across the whole vehicle lifecycle, not just at approval. Many supplier contracts now write an annual independent test into the security schedule.

Timing a test to land shortly before your OEM’s yearly review keeps the evidence current when it is examined.

Get the report your OEM review expects

If a carmaker has asked for testing evidence, or you want it ready before they do, a short scoping call will produce a fixed quote for your app, API and cloud estate. Request a CREST penetration testing quote and we will map the scope with you.