Automotive Threat Matrix (ATM): ATT&CK for Vehicles

How the Auto-ISAC matrix describes attacker behaviour against the vehicle – and how it gives the TARA under ISO/SAE 21434, the evidence under UN R155, the OWASP testing catalogues and the Vehicle SOC a common language.

Last updated: September 2026 · Valeri Milke, ISO 27001 & ISO 42001 Lead Auditor

Book an initial consultation Back to topic area

14tactics in the matrix

75techniques in the matrix (77 in the dataset)

147documented examples from 23 research publications

85.7 %of examples come from work published up to 2018

Since 7 July 2024, no new vehicle of categories M, N and O may be registered in the EU without cybersecurity type approval under UN R155, and ISO/SAE 21434 has supplied the engineering vocabulary for it since August 2021. What both lack is a common language for what attackers actually do to a vehicle. MITRE ATT&CK, the de facto standard of IT security, knows neither CAN bus nor diagnostic protocol nor ECU. That is precisely the gap the Auto-ISAC's Automotive Threat Matrix (ATM) closes: a freely accessible knowledge base modelled on ATT&CK, with 14 tactics, 75 techniques in the matrix and 147 documented examples from research (release v4.02 of 4 December 2025, data as at 11 September 2026). This page explains how the matrix is structured, what its evidence supports and what it does not, and how it fits alongside the TARA, UN R155 Annex 5, OWASP ISTG and ISVS and the MITRE family – based on a complete analysis of the dataset by VamiSec.

From the GM request to v4.02

Five stations of the Automotive Threat Matrix — tap a milestone.

The Essentials at a Glance

Nine topic blocks — tap to expand.

MITRE maintains ATT&CK matrices for enterprise IT, mobile devices and industrial control systems, but none for vehicles. That is a deliberate decision: in 2019, General Motors asked MITRE whether the two could jointly build an automotive-specific version of ATT&CK. MITRE politely declined and encouraged the development of a standalone, non-affiliated version modelled on ATT&CK. From January 2020, a user group of OEMs, suppliers and service providers took shape under the umbrella of the Auto-ISAC, the automotive industry's Information Sharing and Analysis Center founded in 2015. On 27 March 2024, the Automotive Threat Matrix went public at atm.automotiveisac.com, operated by Vultara, Inc. as its strategic partner. There have been six releases since: v1.00 (January 2024), v2.00, v3.00 (August 2024, the first major content change drawn from community contributions), v4.00 (February 2025, first STIX export), v4.01 (June 2025) and v4.02 (4 December 2025). In February 2025, the accompanying Auto-ISAC whitepaper appeared, with authors from GM, Sumitomo Electric Wiring Systems, HORIBA MIRA, PACCAR, Eaton and Auto-ISAC. The matrix is therefore not a MITRE product but an industry taxonomy that adopts the ATT&CK vocabulary and rewrites the content for the vehicle.

Like ATT&CK, the ATM organises attacker behaviour into tactics (the why of a step) and techniques (the how). The 14 tactics are Reconnaissance, Manipulate Environment, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Affect Vehicle Function. Eleven of them are adopted in substance from ATT&CK; in the dataset, eight reference Enterprise tactics and five reference tactics from ATT&CK Mobile, so the matrix treats the vehicle as a mobile computing platform. Three tactics are vehicle-specific: Reconnaissance (since May 2025, split into information “from the vehicle” and “from other sources”), Manipulate Environment (jammers, relay attacks, rogue base stations, sensor and AI deception) and Affect Vehicle Function, the only tactic without an ATT&CK identifier, which describes the effect on powertrain, airbag, displays and audio. The dataset contains 77 techniques, 75 of which appear in the matrix; 13 techniques are assigned to several tactics, “Compromise Cryptographic Security” to as many as four. Each technique carries a description, author, modification date and examples: short sentences from published research demonstrating that the technique has actually been used. What the dataset does not contain: sub-techniques, mitigations, detections and data sources. These fields are provided for in the data model, but they are empty.

32 of the 75 techniques cite no ATT&CK origin in their description. They are the real added value of the matrix and can be organised into families. The ATM's signature is diagnostic protocol abuse: five “Abuse Standard Diagnostic Protocol” techniques are spread across Execution, Persistence, Lateral Movement, Collection and Affect Vehicle Function, joined by “Bypass UDS Security Access”, the circumvention of the seed-key procedure under UDS service 0x27 using secrets shared across an entire model series, static challenge-response mechanisms or short keys. The in-vehicle network family comprises “Unintended Vehicle Network Message”, “Modify Bus Message” and “CAN Bus Denial of Service”; the gateway and persistence family “Bridge Vehicle Networks”, “Reprogram ECU for Lateral Movement” and the reprogramming of co-processors within the same ECU. The cryptography family draws a clean line between broken schemes (“Compromise Cryptographic Security”) and poorly protected keys (“Unsecured Credentials”, “ECU Credential Dumping”). The sensor and AI family, with “Analog Sensor Attacks” and “Adversarial Machine Learning”, covers attacks on lidar, camera, radar and perception models, and “Aftermarket, Customer, or Dealer Equipment” captures OBD dongles, workshop testers and paired phones as entry point, command channel and exfiltration route all at once. Anyone who knows these families can, for the first time, formulate supplier requirements, test plans and detection rules in the same terms.

The ATM's 147 examples come from 23 research publications, and two teams dominate: Charlie Miller and Chris Valasek contribute 54 examples (Ford Escape, Toyota Prius, Jeep Cherokee), Tencent Keen Security Lab 41 (Tesla, BMW, Lexus). A third of all examples concern Tesla vehicles. Sorting the sources by year of publication shows that 126 of 147 examples (85.7 per cent) come from work published up to 2018; not a single example refers to 2025 or 2026. The headline cases of recent years are missing: the CAN injection thefts via the headlight wiring (2023), the Kia dealer portal (2024), the Subaru STARLINK admin panel (2025), Pwn2Own Automotive 2024 to 2026 and the IT attack on Jaguar Land Rover (2025). 29 of the 77 techniques have not a single example, among them – of all things – “Analog Sensor Attacks”, “Adversarial Machine Learning”, “Supply Chain Compromise” and “Disable Software Update”. Conversely, the evidence is heavily concentrated: “Unintended Vehicle Network Message” (35 examples) and “Abuse Standard Diagnostic Protocol for Affecting Vehicle Function” (24) together account for a quarter of all links. Curation is thin as well: 72 of 77 techniques carry a single author, and the most recent release changed three objects. The practical consequence: the ATM is an excellently documented map of the classic vehicle attacks via infotainment, diagnostics and CAN, but a thin sketch of the backend, API, charging and perception attacks that cause the greatest damage today.

Clause 15 of ISO/SAE 21434 defines the Threat Analysis and Risk Assessment in seven steps: asset identification (15.3), threat scenarios (15.4), impact rating (15.5), attack path analysis (15.6), attack feasibility (15.7), risk value (15.8) and risk treatment (15.9). The standard requires attack paths for each threat scenario but supplies none. This is exactly where the ATM plugs in: a threat scenario can be formulated as a triple of asset, ATM technique and violated security property, and the cells of the matrix are the building blocks from which attack paths are assembled; the documented examples are ready-made path templates. The Auto-ISAC whitepaper proposes assigning a default feasibility to each element so that the overall feasibility of a path can be determined immediately and then adjusted. Importantly, this is a method, not data shipped with the matrix. The dataset contains no feasibility, impact or asset values; tools such as ESCRYPT CycurRISK carry the ATM as a threat library, but calibration remains the organisation's task. Using the example values from Annex G (Tables G.6 and G.7: high at 0 to 13 points, medium at 14 to 19, low at 20 to 24, very low from 25), it becomes clear why a default must be tied to assumptions: with a static key shared across an entire model series, “Bypass UDS Security Access” scores around 8 points and is therefore “high”; with genuine challenge-response per ECU and the key held in an HSM, it scores around 38 points and is therefore “very low”. Moreover, it is the entire path that is rated, not the individual cell: ATM defaults are starting values per step, which the analyst consolidates, with justification, into a path rating.

UN R155 requires, in paragraph 7.3.3, an exhaustive risk assessment against the threats in Annex 5 Part A and, in 7.3.4, proportionate mitigations from Parts B and C. Annex 5 is not an attacker taxonomy but a list ordered by attack surface: seven categories (4.3.1 backend servers to 4.3.7 exploitable vulnerabilities), 30 numbered threats, 67 numbered examples and 23 distinct mitigations M1 to M24. The two lists ask different questions. Annex 5 asks which vulnerability could be exploited; the ATM asks what the attacker does next. Our mapping shows: 52 of the 75 matrix techniques map cleanly onto Annex 5 entries, for instance “Bypass UDS Security Access” onto 11.3 (malicious diagnostic messages), “Bridge Vehicle Networks” onto 29.2 (circumventing network separation via unprotected gateways) or “Unsecured Credentials” onto 28.2 (development remnants such as debug ports and developer passwords). Left without any ATM counterpart are the backend threats of category 4.3.1, the manipulation of system logs (21.1), vehicle identity and identity fraud (20.1, 20.2) and personal data on change of ownership (31.1). Conversely, Annex 5 does not know the ATM's Discovery techniques or its pure command channels. The upshot: a TARA needs both lists. Annex 5 is the mandatory cross-check for type approval, the ATM the library of documented attack paths, and the mapping should be maintained centrally with the remainder explicitly documented.

A threat matrix is only a third of the chain. Between “what the attacker does” and “is the vehicle secure” lie requirements the product must meet and test cases that provide the evidence. OWASP supplies both, built for IoT devices and transferable to vehicle components. The IoT Security Verification Standard (ISVS) formulates requirements in five chapters (ecosystem, application, software platform, communication, hardware) with three verification levels L1 to L3; connected vehicles are explicitly named as an example for the highest level. The IoT Security Testing Guide (ISTG, v1.0 of March 2024, actively maintained) provides 101 test cases across eight device components (Processing Units, Memory, Firmware, Data Exchange Services, Internal Interfaces, Physical Interfaces, Wireless Interfaces, User Interfaces) and an attacker model of physical access (PA-1 remote to PA-4 invasive) and authorisation (AA-1 to AA-4) that maps directly onto the attack vector feasibility of ISO/SAE 21434. The mapping is intuitive: diagnostic services (UDS, DoIP) and CAN gateway services are “Data Exchange Services”, the OBD port and JTAG are “Physical Interfaces”, cellular, Wi-Fi, Bluetooth and NFC are “Wireless Interfaces”, and firmware update mechanisms cover “Reprogram ECU” and “Bypass Code Integrity Protections”. One gap remains: the classic ISTG does not know sensors and AI perception (Analog Sensor Attacks, Adversarial ML); MITRE ATLAS fills this gap. Officially, this bridge exists nowhere – neither ETSI EN 303 645 nor the CRA standardisation request references ISTG or ISVS. For pentest planning this yields a simple practice: ATM columns define the scope, ISTG test cases the evidence, and a coverage matrix (planned, executed, finding) per technique structures the report.

The strength of the matrix shows when real attacks are translated into its language. The 2015 Jeep Cherokee is the only fully remote chain in the dataset: entry via the cellular network (Exploit via Radio Interface), shell commands via an open D-Bus service (Command and Scripting Interpreter), takeover of the head unit's V850 co-processor via a manipulated firmware update (Modify OS Kernel, Boot Partition, or System Partition), then door locks and indicators via CAN message and finally the steering via a diagnostic session with the park assist module (Abuse Standard Diagnostic Protocol for Affecting Vehicle Function); the result was a recall of 1.4 million vehicles. Tesla's “Free-fall” of 2016 is the deepest chain: rogue Wi-Fi hotspot, WebKit exploit, kernel privilege escalation, AppArmor bypass, SSH keys and static credentials in the firmware, broken UDS Security Access at the gateway, Telnet to the gateway and, at the end, UDP packets that the gateway translated into CAN messages. Miller and Valasek demonstrated the OBD variant in 2013 and 2016: workshop tool on the diagnostic port, key constants in tool and firmware, a 16-bit checksum broken in under nine hours, engine off and steering via diagnostic services. Across all five chains we reconstructed, “Modify OS Kernel, Boot Partition, or System Partition” appears in every one, bus messages and diagnostic abuse in four out of five, unsecured credentials in three. From this follow five choke points at which defenders sever the chains: secure boot and code signing on every reprogrammable ECU; a gateway that translates no foreign transport into CAN; individual UDS keys with lockout after failed attempts plus message authentication on safety-relevant IDs; no secrets in firmware and workshop tools; and a reduced attack surface on the radio interfaces.

Since release v4.00, Auto-ISAC has supplied, alongside the native JSON, a STIX 2.1 file described as “MITRE-compliant”. It uses the ATT&CK object model (302 objects: one matrix, 14 tactics, 77 attack patterns, 151 examples modelled as “campaign”), but it is lossy: only 59 “uses” relationships stand against 221 links in the dataset, the kill chain is named “not applicable”, and there is neither an identity nor a licence object. For the ATT&CK Navigator the bundle is usable after adjusting the domain reference; the native JSON remains the only complete release artefact and should be the archived reference. Version and live state drift as well: the download file from December 2025 contains 151 examples, the live API in September 2026 still only 147. Commercial tools are already taking up the matrix, for instance ESCRYPT CycurRISK as a threat library, and Upstream AutoThreat PRO and VicOne for tagging threat intelligence. For adoption we recommend ten steps: freeze the version used per TARA and archive the export; maintain a separate extension layer with its own ID range for backend, companion app, OTA server, charging and V2X; link ATM techniques to EMB3D threats and mitigations, because that is the only way to fill the empty mitigation layer in a citable manner; map centrally onto R155 Annex 5 and document the remainder; build Navigator heatmaps for documented, tested and observable; anchor ATM IDs in PSIRT, bug bounty and incident tickets; derive VSOC use cases from the best-documented techniques, for which AUTOSAR IdsM supplies the event types; contribute current cases via the Contribute button; treat the data as data and keep it in cleaned form under version control; and add the missing dimensions locally, such as an impair-versus-inhibit distinction along the lines of ATT&CK for ICS and a feasibility note per technique. In short: in 2026 the ATM is the best available common language for vehicle attack behaviour, but it is a vocabulary, not a management system.

The vehicle-specific technique families

32 of the 75 techniques cite no ATT&CK origin — the real added value of the matrix, organised into five families.

The ATM's signature

Five “Abuse Standard Diagnostic Protocol” techniques are spread across Execution, Persistence, Lateral Movement, Collection and Affect Vehicle Function.
“Bypass UDS Security Access” circumvents the seed-key procedure under UDS service 0x27 using secrets shared across an entire model series, static challenge-response mechanisms or short keys.

Abuse Standard Diagnostic ProtocolBypass UDS Security AccessUDS service 0x27seed-key procedure

In depth

The Automotive Threat Matrix in detail

Thirteen chapters on its origins, the data model, the evidence base and its integration into TARA, type approval and testing – complete on this page, with no download.

01Origins

Why MITRE has no “ATT&CK for Automotive”

MITRE maintains ATT&CK matrices for enterprise IT, mobile devices and industrial control systems. A vehicle matrix is missing, and that is not an oversight but a deliberate decision that General Motors made public in 2025.

Demand from the industry was there early on: in 2019, General Motors asked MITRE whether an automotive-specific version of ATT&CK could be created jointly. MITRE declined, but encouraged GM to pursue a project of its own, unaffiliated with MITRE.

The answer was a sensible one: vehicles differ so markedly from corporate networks in attack surface, life cycle and impact that an appendage to ATT&CK Enterprise would have served neither the IT nor the automotive community. Instead, a working group of OEMs, suppliers and service providers formed under the umbrella of the Auto-ISAC, adopting the ATT&CK vocabulary and rewriting the content.

The signature of the working group

The result bears the signature of this group: 72 of the 77 techniques are recorded in the data set with Karl Leboeuf as their author; the descriptions of 43 techniques refer explicitly to their ATT&CK origin, those of 32 do not. It is precisely these 32 that constitute the actual added value of the matrix; they address vehicle-specific subjects:

Abuse of diagnostic protocols
Bus messages
Gateway bridging
Sensor and AI deception

72Techniques with Karl Leboeuf as author

43Techniques with an explicit ATT&CK reference

32Techniques without an ATT&CK reference in the description

From the refusal to release v4.02

Date	Event
2019	GM approaches MITRE; MITRE declines and encourages a project of GM’s own
01/2020	Auto-ISAC founds the ATM user group
08/2023	Creation of the core data set: 72 techniques carry the creation date 9 August 2023
03/2024	Public launch of the ATM at atm.automotiveisac.com
08/2024	Major revision: 61 techniques last modified in August 2024
02/2025	Auto-ISAC publishes the white paper “The Automotive Threat Matrix”
03/2025	GM presents usage, roadmap and JSON export publicly
05/2025	The tactic “Reconnaissance” is added, with two new techniques
12/2025	Release v4.02: Supply Chain Compromise revised, current status

Sources: GM presentation March 2025; Auto-ISAC press release March 2024; time stamps in the ATM data set (API status 11 September 2026).

02Under the bonnet

Three object types, two export formats, one Contribute button

The ATM is more than a table in a browser. Behind the web application lies a data set that can be downloaded in full and integrated into your own tooling. Anyone intending to use the matrix productively should be familiar with the objects and their limits.

The data set knows three object types: tactics as the attacker’s objectives, techniques as concrete courses of action, and examples as evidence from research publications. Everything else that is familiar from ATT&CK is either absent so far or remains empty.

14Tactics (ATM-TA0000 to TA0013)

77Techniques in the data set, 75 of them in the matrix

147Examples (ATM-P), assigned to 48 techniques

24Source publications behind the examples

The three object types

Tactic

The attacker’s objective, with a description and its order in the matrix. The mitreId field points to the corresponding ATT&CK tactic; only “Affect Vehicle Function” remains without a reference.

Technique

A concrete course of action with description, author, creation and modification date, tactic assignment (more than one possible) and references.

Example

A sentence from a research publication demonstrating that a technique has genuinely been applied, such as ATM-P0002: “The researchers defeated the UDS Security Access on the gateway ECU by breaking its weak cryptography.”

Sub-techniques are provided for in the data model, but the data set contains none. A technique therefore remains the smallest described unit, and depth of content only emerges through the assigned examples.

What the download provides

File	Content	Relevance in practice
v4.02.json	Native format: 242 objects (14 tactics, 77 techniques, 151 examples) with HTML descriptions, time stamps and links.	Suitable for your own scripts, TARA tools with an import function and internal knowledge bases.
mitre-v4.02.json	“MITRE-Compliant”: STIX 2.1 bundle with 302 objects: 14 x-mitre-tactic, 77 attack-pattern, 151 campaign (the examples), 59 uses relationships and one x-mitre-matrix.	Basis for ATT&CK Navigator, Workbench and STIX-capable threat intelligence platforms.

What is missing is equally instructive: no mitigations, no detections, no data sources, no group or software objects. The fields exist in the data model but are empty. Anyone looking for countermeasures must add them themselves, for example from MITRE EMB3D or UN R155 Annex 5 Parts B and C.

All figures relate to release v4.02 of the ATM data set, API status 11 September 2026.

03The 14 tactics

What the attacker wants to achieve

The columns of the matrix follow the life cycle of an attack: from gathering information through initial access and movement within the in-vehicle network to what distinguishes a vehicle from every other IT system – influencing the vehicle function.

A tactic describes the why of an attack step, the technique the how. The Automotive Threat Matrix adopts eleven of the 14 tactics from MITRE ATT&CK in substance; three are newly defined for vehicles. The identifier in brackets names the ATT&CK tactic that Auto-ISAC references in the data set.

ID	Tactic	Techniques	What it covers
ATM-TA0000	Reconnaissance	2	Gathering information, inside and outside the vehicle.
ATM-TA0001	Manipulate Environment	8	Attacking the surroundings: radio, sensors, AI models.
ATM-TA0002	Initial Access	8	First foothold in the network: radio, apps, supply chain, dongles.
ATM-TA0003	Execution	3	Executing attacker code on an ECU.
ATM-TA0004	Persistence	5	Retaining access across restarts and updates.
ATM-TA0005	Privilege Escalation	8	Obtaining higher privileges on an ECU.
ATM-TA0006	Defense Evasion	5	Circumventing protective mechanisms, up to and including UDS Security Access.
ATM-TA0007	Credential Access	8	Stealing keys, tokens and passwords.
ATM-TA0008	Discovery	8	Exploring files, processes, the network and the vehicle position.
ATM-TA0009	Lateral Movement	6	Moving from control unit to control unit.
ATM-TA0010	Collection	9	Collecting position, camera, audio, SMS and files.
ATM-TA0011	Command and Control	6	Control channels: mobile networks, internet, short-range radio, broadcast.
ATM-TA0012	Exfiltration	7	Extracting data, by radio or removable media.
ATM-TA0013	Affect Vehicle Function	8	Influencing powertrain, airbag, displays or audio.

Three tactics with a special status

Reconnaissance (ATM-TA0000, 2 techniques) is new since 2025 and deliberately divided in two: information from the vehicle, that is diagnostic data, bus recordings and firmware, and information from other sources such as documentation, forums and suppliers. The data set references ATT&CK Enterprise TA0043.

Manipulate Environment (ATM-TA0001, 8 techniques) is vehicle-specific: attacks on the surroundings without physically touching the vehicle, that is jammers, relay attacks on radio keys, spoofed mobile base stations and Wi-Fi access points, downgrades to insecure protocols, and the deception of sensors and AI models. The reference points to the former mobile tactic “Network Effects” (TA0038).

Affect Vehicle Function (ATM-TA0013, 8 techniques) has no counterpart in ATT&CK; the closest match is “Impair Process Control” from ATT&CK for ICS. Affected are powertrain, airbag, displays or audio, by means of unintended bus messages, the alteration of legitimate messages, a denial of service on the CAN bus or the misuse of diagnostic services. With 35 documented examples, “Unintended Vehicle Network Message” (ATM-T0071) is the best-evidenced technique in the entire matrix.

04The technique families

The 75 techniques and their families

At technique level, what separates the Automotive Threat Matrix from an IT matrix becomes apparent: alongside familiar patterns such as ATM-T0015 Phishing there are diagnostic services, bus messages, ECU reprogramming and sensors. The 75 techniques cluster into a few families; the number of examples shows where the evidence is dense.

Abuse of diagnostic protocols: five techniques share the same name stem and differ only in purpose – ATM-T0020 (Persistence), ATM-T0074 (Execution), ATM-T0050 (Lateral Movement), ATM-T0055 (Collection) and ATM-T0067 (Affect Vehicle Function). Only two of them carry examples: ATM-T0067 with 24, ATM-T0055 with 2. ATM-T0033 Bypass UDS Security Access targets the same protocol (Defense Evasion, 5 examples).

Effect on vehicle functions: ATM-TA0013 bundles eight techniques. By our own count, ATM-T0071 Unintended Vehicle Network Message carries the highest value in the overview with 35 examples, ahead of ATM-T0069 Local Function (7), ATM-T0072 Denial of Service on Vehicle Function (3) and ATM-T0068 CAN Bus Denial of Service (2); ATM-T0070 Modify Bus Message remains without an example.

Lateral movement: ATM-TA0009 comprises six techniques. ATM-T0054 Reprogram ECU for Lateral Movement carries the most examples (11), ahead of ATM-T0053 Remote Services (7) and ATM-T0051 Bridge Vehicle Networks (2); ATM-T0052 and ATM-T0050 remain without an entry.

Cryptography and credentials: ATM-T0040 Unsecured Credentials leads Credential Access ATM-TA0007 with 12 examples, ahead of ATM-T0038 Network Sniffing (8) and ATM-T0039 ECU Credential Dumping (1). ATM-T0075 Compromise Cryptographic Security is listed under four tactics but, like ATM-T0066 Standard Cryptographic Protocol, carries no entry.

Sensors and AI: by our own count, only ATM-T0004 Analog Sensor Attacks and ATM-T0005 Adversarial Machine Learning appear in both Manipulate Environment ATM-TA0001 and Affect Vehicle Function ATM-TA0013 – neither with an example. The radio environment, by contrast, is evidenced, for instance ATM-T0003 Manipulate Communications (5).

The best-evidenced techniques

ID	Technique	Tactic(s)	Examples
ATM-T0071	Unintended Vehicle Network Message	Affect Vehicle Function	35
ATM-T0067	Abuse Standard Diagnostic Protocol for Affecting Vehicle Function	Affect Vehicle Function	24
ATM-T0022	Modify OS Kernel, Boot Partition, or System Partition	Persistence	12
ATM-T0040	Unsecured Credentials	Credential Access	12
ATM-T0012	Exploit via Radio Interface	Initial Access	11
ATM-T0054	Reprogram ECU for Lateral Movement	Lateral Movement	11
ATM-T0010	Aftermarket, Customer, or Dealer Equipment	Initial Access, Command and Control, Exfiltration	10
ATM-T0038	Network Sniffing	Credential Access, Collection	8
ATM-T0065	Short Range Wireless Communication	Command and Control, Exfiltration	8

Figures from the technique overview of the Automotive Threat Matrix; ATM-T0053 Remote Services and ATM-T0069 Local Function follow with 7 examples each.

05Evidence base

147 examples, 23 sources, two research teams

What distinguishes the ATM from a collection of ideas are its examples: sentences from published research demonstrating that a technique has genuinely been applied. We have evaluated all 147 – a strength and a caution at the same time.

54Examples from Miller & Valasek (36.7 percent)

41Examples from Tencent Keen Security Lab (27.9 percent)

49Examples with Tesla as the target (33.3 percent)

12Sources with exactly one example

Two teams supply 95 of the 147 examples; the seven largest sources cover 114 examples (77.6 percent). This is the research era from 2010 to 2018: WebKit in the head unit, telnet to the gateway, unauthenticated UDS services.

Source (title as given in the ATM)	Year	Team / target	Examples
Adventures in Automotive Networks and Control Units	2013	Miller & Valasek; Ford Escape, Prius	27
Free-fall: Hacking Tesla from wireless to CAN bus	2016/17	Keen Security Lab; Tesla Model S	17
CAN Message Injection	2016	Miller & Valasek; Jeep, Prius	17
Over-the-Air: Gateway, BCM and Autopilot ECUs of Tesla cars	2018	Keen Security Lab; Tesla S/X	15
Experimental Security Analysis of a Modern Automobile	2010	Koscher et al. (UW/UCSD); two saloon cars	15
Hacking a Tesla Model S: What we found and what we learned	2015	Mahaffey/Rogers (DEF CON 23); Tesla Model S	13
Remote Exploitation of an Unaltered Passenger Vehicle	2015	Miller & Valasek; Jeep Cherokee	10

Year and author attribution by VamiSec; only 10 of the 147 examples cite a source URL; one title appears twice, hence 23 publications rather than 24.

29 of the 77 techniques without a single example

Analog Sensor Attacks and Adversarial Machine Learning, although lidar spoofing has been published for years
Supply Chain Compromise, revised in December 2025 but still without evidence
Disable Software Update, the core subject of UN R156
Compromise Cryptographic Security, listed under four tactics since April 2025, without an example
Modify Bus Message, although examples of suppressing CAN IDs are merely assigned elsewhere
Three of the five techniques added since 2024

Persistence is the thinnest: four of five techniques without evidence; Credential Access and Collection follow with five empty techniques each. By our own attribution, no example originates from 2025 or 2026.

What the data set also reveals

One author, one account

72 of 77 techniques name Karl Leboeuf (GM) as author, and only six have an editor. One account is the last editor of 73 techniques and 10 tactics: curated quality, bus factor of one.

Growth has stalled

Of the 87 examples with a creation date, 82 were created in December 2023, four in August 2024 and one in May 2025. The 51 gaps in the ID range P0001 to P0198 show that around a quarter of the examples ever created have been removed again.

Not everything has been demonstrated

At least seven examples from “CAN Message Injection” begin with “Researchers discussed the possibility”, so they are hypotheses. Seven inserted abstracts alone generate 34 technique links: read the evidence, do not merely count it.

06Threat landscape 2026

Why now: attacks are scaling, and they arrive remotely

The number of publicly known cyber incidents in the automotive industry has been rising for years, and their character has shifted: away from the laptop at the OBD port, towards telematics, cloud and the supply chain.

494reported incidents in 2025 (Upstream, 409 in 2024)

92%carried out remotely, 86% of those without physical proximity

67%of incidents via telematics and cloud

44%with a ransomware link, twice as many as in 2024

Germany: the BSI situation report

The BSI sector report “Cybersicherheit im Straßenverkehr 2025” evaluates 107 reports between February 2024 and March 2025. Of 67 cases that could be classified by access route, 18 ran via the internet, 23 via the proximity range (Bluetooth, Wi-Fi), 21 via physical access, 3 via the local network and 2 via disassembly. Of 59 cases assessed by status, 46 were proof of concept, 9 theoretical and 4 actively exploited.

For 2018 to 2024 the BSI counts 1,663 vehicle-related CVEs; the average CVSS score fell from 8.08 (2019) to 7.19 (2024), but remained within the “high” band.

Pwn2Own Automotive

Edition (Tokyo)	Zero-days	Prize money	Master of Pwn
January 2024	49	$1,323,750	Synacktiv (Tesla modem, IVI)
January 2025	49	$886,250	Sina Kheirkhah (Tesla Wall Connector only)
January 2026	76	$1,047,000	fuzzware.io (German team)

Source: Zero Day Initiative / Trend Micro. In Berlin (May 2025) no one entered the automotive category.

Two branches of attack

Year	Case	Entry point → effect	ATM reference
2015	Jeep Cherokee (Miller/Valasek)	Mobile network → Uconnect → V850 reflash → CAN: brakes, steering, engine; 1.4 million vehicles recalled	Attack chain 1
2016/17	Tesla Model S/X (Keen Security Lab)	Wi-Fi and browser → kernel → gateway firmware → CAN; first remote attack on the CAN bus of a Tesla	Attack chains 2 and 3
2018	BMW (Keen Security Lab)	14 vulnerabilities in head unit, telematics and gateway; arbitrary diagnostic requests on CAN	ATM-P0006, 13 techniques
2023	CAN injection, headlight wiring (Tindell/Tabor)	Device in the speaker housing spoofs smart key frames, the immobiliser is defeated; Toyota RAV4	T0016/T0071, no example
2025	Nissan Leaf (PCAutomotive)	Bluetooth → IVI → secure boot bypass → mobile network C2 → CAN: steering while driving	no example
2024	Kia dealer portal (Curry et al.)	Dealer token → VIN → registered keeper data → vehicle controllable within 30 seconds via the number plate	Backend, outside the ATM
2025	Subaru STARLINK (Curry/Shah)	Password reset without a token, 2FA only client-side → start/stop, location history accurate to 5 m	Backend, outside the ATM
2024	Cariad/VW (CCC, 38C3)	Misconfigured cloud environment → location data of around 800,000 electric vehicles	Backend, outside the ATM
2025	Jaguar Land Rover	IT attack, around five weeks of production standstill, £196 million in quarterly costs, £1.9 billion in damage (CMC)	Enterprise IT, ATT&CK

Branch A: the vehicle itself

Entry via radio, infotainment or diagnostics, then privilege escalation, a jump across the gateway, effect on CAN. Stable since 2015 and described by the ATM.

Branch B: backend, portals, supply chain

Kia, Subaru, Cariad and JLR did not touch a single ECU and still hit fleets and plants. UN R155 Annex 5 begins with these threats (4.3.1).

07Regulatory framework

Three layers, one vehicle: who requires what in 2026

Vehicle cybersecurity is regulated on three levels in Europe: product (UN R155/R156), organisation (NIS2, TISAX) and component outside type approval (CRA).

ISO/SAE 21434 is the engineering reference for the product level, not the law. UN R155 takes effect through Regulation (EU) 2019/2144: new types from 6 July 2022, all new vehicles from 7 July 2024; Supplement 3 has applied since 10 January 2025 to classes L, M, N and O with at least one ECU.

NIS2 and the BSIG 2025 have been in force since 6 December 2025, the registration deadline ran until 6 March 2026; the component level is governed by the CRA.

Framework	What applies	Deadline	Relation to the matrix
UN R155 (CSMS)	Certified CSMS (max. 3 years, 6.7), exhaustive risk assessment against Annex 5 Part A (7.3.3), attack detection (7.2.2.2 g), annual report (7.4.1)	All new vehicles since 7 July 2024	Annex 5 = threat list, ATM = adversary behaviour
UN R156 (SUMS)	Update management system, authenticity and integrity of updates; the 01 series makes RxSWIN mandatory	01 series in force 4 June 2026; transition until 1 September 2028/2030	ATM-T0021, T0022, T0054
ISO/SAE 21434:2021	Cybersecurity engineering across the lifecycle; Clause 15 = TARA; Annexes E and G are informative	August 2021; second edition: development from 2026	Attack paths (15.6), feasibility (15.7)
ISO/SAE PAS 8475, TR 8477, SAE J3322, ISO/PAS 5112, ISO 24089	CAL/TAF refinement, verification and validation; audit guideline for the CSMS; update engineering under R156	DPAS 8475 July 2026; J3322 since 3 May 2025; 5112: 2022; 24089: February 2023	Test planning, evidence
Cyber Resilience Act	Not applicable to products under Regulation 2019/2144 (Art. 2(2)(c)); separately sold components, dongles and charging stations are covered	Reporting obligations from 11 September 2026, full application 11 December 2027	ATM-T0010 “Aftermarket, Customer, or Dealer Equipment”
NIS2 / BSIG 2025	NACE C 29 and C 30 = important entities; risk management (Section 30), reporting obligation (Section 32), fines up to €7 million or 1.4% (Section 65)	In force 6 December 2025; registration deadline 6 March 2026	Incidents with technique IDs
TISAX (ENX)	Organisational security and prototype protection; ISA 6 until 31 December 2026, VDA ISA2027 from 1 January 2027	ISA2027 announced 1 July 2026	Supplier requirements in ATM columns
Data Act, Delegated Regulation 2026/699	Access to vehicle data (access by design from 12 September 2026); new Annex X of Regulation 2018/858	Data Act has applied since 12 September 2025; Delegated Regulation in the Official Journal 3 June 2026	Diagnostic access as an attack surface

Worldwide: the same logic, different deadlines

Japan

R155/R156 through the safety standards under the Road Transport Vehicle Act; OTA-capable new types since July 2022, the existing fleet without OTA since May 2026.

South Korea

CSMS pre-approval by MOLIT; new types since 14 August 2025, existing types from August 2027.

United Kingdom

SI 2025/1110 transposes R155/R156 into GB type approval: new types from 1 June 2026, all vehicles from 1 June 2027.

China

GB 44495-2024 and GB 44496-2024 have applied to new types since 1 January 2026 and to approved types from 1 January 2028.

08TARA under ISO/SAE 21434

The standard requires attack paths. It supplies none.

ISO/SAE 21434 requires threat scenarios, attack paths and a justified attack feasibility. The standard deliberately does not supply concrete adversary behaviour. That is exactly where the Automotive Threat Matrix plugs in, with documented building blocks and stable IDs.

Clause 15 of ISO/SAE 21434 defines seven steps from asset identification to risk treatment. Two of them presuppose knowledge of adversary behaviour that the standard deliberately does not supply: the identification of threat scenarios (15.4) and the analysis of attack paths (15.6). Attack feasibility (15.7) is the third connecting point.

15.3Identify assets: integrity, availability, confidentiality
15.4 connecting pointThreat scenario from asset, ATM technique and the property violated
15.5Impact rating for safety, financial, operational and privacy: negligible to severe
15.6 connecting pointAttack paths from ATM cells; 22 attack chains held in the data set, 147 examples
15.7 connecting pointAttack feasibility: a calibrated starting value per technique, adjusted per path
15.8Risk value 1 to 5 from impact and feasibility, example matrix in Annex H
15.9Risk treatment: avoid, reduce, share, accept

For feasibility the standard permits three approaches: attack potential with five parameters (elapsed time, specialist expertise, knowledge of the item, window of opportunity, equipment), CVSS exploitability or the attack vector under Table G.9; Annex G is informative and expressly calls its tables examples. The Auto-ISAC white paper of February 2025 describes the matrix as a library of potential steps in an attack path and proposes assigning a default feasibility to each element. These defaults are a method, not data: the data set contains no feasibility values, no impact classes and no asset references. Calibration remains the task of the organisation.

Default feasibility per technique: worked examples

Technique	Assumption	Parameters (time, expertise, knowledge, window, equipment)	Total	Feasibility
T0033 Bypass UDS Security Access	static key per model series, derivable from a workshop tool (as in ATM-P0033, P0167)	1, 3, 3, 1, 0	8	high
T0033 Bypass UDS Security Access	genuine challenge-response per ECU, key in the HSM, lockout after failed attempts	17, 6, 7, 4, 4	38	very low
T0012 Exploit via Radio Interface	Bluetooth heap overflow in the infotainment system (as in Lexus 2020, ATM-P0060)	17, 8, 3, 4, 4	36	very low
T0054 Reprogram ECU for Lateral Movement	after gateway access, the target ECU checks only a CRC (as in ATM-P0117)	1, 3, 3, 4, 0	11	high

Values based on ISO/SAE 21434:2021, Annex G, Table G.6 (example aggregation) and G.7 (example mapping: high 0–13, medium 14–19, low 20–24, very low from 25); both informative. The choice of parameters is our own assessment for illustration, not an evaluation of real products.

The default depends on the control

The same technique jumps from 8 to 38 points, depending on whether UDS access rests on a secret shared across the model series or on individual keys.

Low feasibility does not mean low risk

The Bluetooth entry point is very low at 36 points, yet scalable from a distance; rated by attack vector under Table G.9 it would even come out as medium (adjacent). The risk value under 15.8 keeps it in scope.

The path is assessed, not the cell

In isolation, reprogramming an ECU is highly feasible; within the chain it inherits the window of opportunity and the equipment of the preceding entry point.

09UN R155 Annex 5

Two lists, one risk assessment

UN R155 requires in 7.3.3 an exhaustive risk assessment against all threats in Annex 5 Part A, ISO/SAE 21434 requires attack paths. We have mapped the 14 ATM tactics and 75 techniques onto the 67 Annex 5 entries: high overlap inside the vehicle, clear gaps at its edges.

Annex 5 is the only part of R155 that names threats concretely: not a taxonomy of attackers, but a list of vulnerabilities and attack methods, ordered by attack surface. Annex 5 asks which vulnerability could be exploited; the matrix asks what the attacker does next, and orders by objective. For the exhaustive risk assessment required under 7.3.3, Annex 5 is mandatory; for attack paths the matrix is the better tool.

52 / 75techniques with a clear Annex 5 counterpart

9techniques with a partial counterpart

14techniques without an Annex 5 entry

26 / 30Annex 5 threats with at least one ATM technique

ATM tactic	Primary Annex 5 entries (Part A, Table A1)	Inherited measures
Reconnaissance	7.1 eavesdropping, 28.2 development leftovers; 1.2/1.3 only as a reconnaissance objective	M12, M23
Manipulate Environment	4.1 spoofing (V2X, GNSS), 6.2 man-in-the-middle, 8.2 black hole, 16.3 jamming of short-range radio and sensors	M10, M13, M20
Initial Access	16.1 remote functions, 17.1 third-party apps, 18.1–18.3 USB/media/OBD dongles, 5.1 code injection, 11.2 V2X	M20, M21, M22, M10, M6
Execution	22.2 introduction of malicious software, 23.1 falsification of software, 11.3 diagnostic messages	M7, M10
Persistence	12.1/12.2 compromise of OTA and local updates, 23.1	M16, M7
Privilege Escalation	9.1 privilege escalation, 28.1 software bugs, 28.2 debug ports	M9, M23
Defense Evasion	11.3 diagnostic messages, 6.3 replay/downgrade, 12.x updates, 26.1–26.3 cryptography	M10, M16, M11
Credential Access	19.2 registered keeper data, 19.3 key extraction, 28.2, 7.2 unauthorised file access	M8, M11, M23
Discovery	largely no counterpart; 29.1 open ports	M9
Lateral Movement	29.2 circumvention of network segregation (gateways), 23.1, 6.3	M7, M10, M16
Collection	19.1 product piracy, 19.2 registered keeper data	M7, M8
Command and Control	no direct entry; R155 only knows the effect, not the channel	–
Exfiltration	19.x; partly 31.1 change of ownership	M7, M8, M12
Affect Vehicle Function	24.1 CAN flooding, 25.1 vehicle parameters (brake, airbag), 11.1–11.3 malicious internal and diagnostic messages, 8.x	M13, M15, M10, M7

Mapping by VamiSec on the basis of the technique descriptions (ATM v4.02) and the wording of Annex 5 (OJ L 2025/5). Measures from Parts B/C, among others M7 access control to data and code, M9 protection against unauthorised access, M10 authenticity and integrity of messages received, M11 key storage, M13 DoS detection, M16 secure update procedures.

Known to Annex 5, not to the matrix

The backend server (4.3.1) almost in full: 1.1 insiders, 2.1 failure of the backend, 3.1–3.5 data leakage and loss in the cloud; for threats 2 and 3 there is not a single ATM counterpart. In addition 15.2 security procedures not followed, 20.1, 20.2 and 20.5 on identity and diagnostic data, 21.1 deletion of event logs as well as 31.1 change of ownership, 25.2 charging parameters and 4.2 Sybil attack.

Known to the matrix, not to Annex 5

The entire discovery family after the entry point (T0045–T0049, T0060), the channels for control and exfiltration (T0062–T0066) as well as Adversarial Machine Learning (T0005), Native API (T0019) and Process Injection (T0029). The most frequently addressed entries are 28.2 development leftovers and 19.2 registered keeper data with eight techniques each, followed by 11.3, 23.1 and 19.3 with six each.

The annual report under 7.4.1 must show which new attacks have been observed and whether the chosen controls still work. With stable IDs on both sides this becomes a coverage table that a technical service can follow: Annex 5 entry, ATM techniques, evidence from ATM-P and your own cases, measure from Part B and proof from a penetration test or an IdsM event. For 2.1 and 3.x the column of ATM techniques remains empty; there, entries from ATT&CK Enterprise carry the load.

10From risk to test case

The matrix says what attackers do. It does not say how to test.

A threat matrix is only one third of the chain. Between attacker behaviour and the question of whether a vehicle is secure lie two further catalogues: requirements for the product and test cases for the evidence. OWASP supplies both, built for IoT devices.

Auto-ISAC ATM

14 tactics, 75 techniques, plus R155 Annex 5 Part A and EMB3D (81 threats).

OWASP ISVS

Five chapters, verification levels L1 to L3, plus R155 Parts B/C (23 measures) and EMB3D (89 mitigations).

OWASP ISTG

101 test cases across eight components, plus FSTM and SAE J3322 / ISO/SAE TR 8477.

The ISTG is an OWASP incubator project by Luca Pascal Rotsch and Aaron Guzman: version 1.0.0 of 1 March 2024, 1.0.1 of 1 June 2024, most recently new test cases in July 2026. The attacker model combines physical access PA-1 (remote) through PA-4 (invasive) with authorisation AA-1 to AA-4; the IDs read, for example, ISTG-FW[UPDT]-CRYPT-004.

The ISVS arranges requirements in five chapters: V1 IoT ecosystem, V2 user space application, V3 software platform, V4 communication, V5 hardware platform. Level 3 of the three verification levels applies to devices whose compromise is to be avoided “at any cost”, with connected vehicles named as an explicit example.

Take care with the version status: the only release tag is 1.0RC of December 2020 with 124 requirements, while the main branch names “Version 1.0, October 2025” with 156 to 169 requirements. Annex B maps to CRA Annex I, the RED Delegated Regulation 2022/30 and ETSI EN 303 645, not to UN R155.

ATM techniques mapped to ISTG components

ISTG component	Vehicle equivalent	ATM techniques	ISVS chapter
Processing Units (PROC)	Infotainment SoC, telematics CPU	Process injection, privilege escalation (T0026, T0029, T0024)	V3 software platform
Memory (MEM)	Flash, RAM, secure storage	Credential Dumping, memory access (T0039, T0074, T0022)	V5 hardware
Firmware (FW, INST/UPDT)	ECU firmware, update, OTA	Reprogramming, cryptography (T0031, T0054, T0075, T0021)	V3 software platform
Data Exchange Services (DES)	UDS/DoIP, CAN gateway	Diagnostic abuse, bus messages (T0067, T0071, T0068, T0050)	V4 communication
Internal Interfaces (INT)	ECU buses, debug UART	Network bridging, filter bypass (T0051, T0032)	V4 communication
Physical Interfaces (PHY)	OBD-II, JTAG, USB	Fault Injection, modification (T0016, T0028, T0073, T0013)	V5 hardware
Wireless Interfaces (WRLS)	Cellular, Wi-Fi, Bluetooth, NFC, TPMS	Radio exploit, relay (T0012, T0065, T0007, T0009)	V4 communication
User Interfaces (UI)	Touchscreen, voice assistant	Input capture, Screen Capture (T0037, T0061)	V2 application
ISTG gap	Camera, lidar, radar	Analog Sensor Attacks, Adversarial ML (T0004, T0005)	via MITRE ATLAS

Specialisations such as ISTG-DES[UDS] are provided for by the ID scheme, but they are not filled in. Neither EN 303 645 nor M/606 references ISTG or ISVS; the mapping is our own analysis.

11MITRE family and STIX

Five maps for one vehicle

No single framework covers a connected vehicle together with its backend, app, control units and AI. The ATM is the map for the vehicle itself. Knowing the neighbouring maps tells you where to read on.

Knowledge base (status)	Structure and scope	Purpose in the automotive context	Limitation
Auto-ISAC ATM v4.02 (4 December 2025)	14 tactics, 75 techniques (77 in the data set), 147 examples	TARA paths, pentest scoping, CTI tagging	ends at the vehicle boundary, evidence from 2010 to 2018
ATT&CK Enterprise v19 (28 April 2026)	15 tactics, 222 techniques, 475 sub-techniques	OEM IT, OTA backend, cloud, R155 category 4.3.1	knows neither CAN nor UDS nor ECU
ATT&CK Mobile v19	12 tactics, 77 techniques, 47 sub-techniques	Companion apps, template for five ATM tactics	end device, not vehicle
ATT&CK for ICS v19	12 tactics, 79 techniques, 18 sub-techniques	ancestor of “Affect Vehicle Function”	process control technology, not the in-vehicle network
EMB3D v2.0.2 (1 June 2026)	81 threats, 89 mitigations, STIX 2.1	which ECU property opens up which threat	no tactics, no chains
ATLAS v2026.08 (1 September 2026)	16 tactics, 114 techniques, 83 sub-techniques, 72 case studies	AI attacks on perception, models, training data	no vehicle case study
CAPEC v3.9 (24 January 2023)	559 attack patterns, ICS/OT perspective	bridge to CWE	effectively frozen since 2023

ATT&CK is released every six months and ATLAS monthly; the ATM has had six releases since March 2024 and none in 2026.

ATT&CK has three times as many techniques as the ATM, but not a single one for diagnostic protocols. EMB3D has 89 mitigations, but no attack chain. Only the chain from ATM technique to EMB3D threat to EMB3D mitigation closes the gap.

“MITRE-compliant” means format, not membership

Since v4.00 (12 February 2025), Auto-ISAC has supplied a STIX 2.1 file in the ATT&CK object model alongside the native JSON. We decomposed mitre-v4.02.json: 302 objects, of which 1 matrix, 14 tactics (ATM-TA0000 to TA0013), 77 attack-pattern, 151 campaign with alias ATM-P0001 onwards, 59 relationship and 0 course-of-action.

Lossy: 59 relationships instead of 221 technique-to-example links; 140 of 151 examples are left dangling, and only 37 techniques are evidenced.
All 91 kill chain phases are named “not applicable” instead of a domain; the Navigator requires a consistent domain reference.
Neither an identity nor a marking-definition object, hence no machine-readable terms of use.
The native v4.02.json (242 objects) contains all the links and is the complete release artefact.

Prepare the bundle

Unpack mitre-v4.02.json from the base64 wrapper of the release API, set kill_chain_name to a domain name, add the missing relationships.

Configure the Navigator

Enter the bundle as a local file in config.json (STIX 2.0 and 2.1), create a layer 4.5 with customDataURL.

Three layers, one backlog

Layer A: evidenced ATM techniques (48). Layer B: your own pentest scope. Layer C: observable by the VSOC. The differences are the backlog.

12Attack chains in ATM language

Reconstructed chains from entry point to vehicle function

Real vehicle attacks can be translated into the tactics and techniques of the matrix. We have ordered two cases along the tactic columns; each step names the technique, the ATM ID and the evidence.

The attack by Charlie Miller and Chris Valasek on a Jeep Cherokee is the only fully remote chain in the data set that reaches as far as actuation; ten ATM examples describe it.

Initial AccessExploit via Radio InterfaceATM-T0012 · ATM-P0074
Every Cherokee responded to every other Sprint device over the Sprint cellular network.
Discovery / ExecutionSystem Network Configuration Discovery; Command and Scripting InterpreterATM-T0048, T0018 · ATM-P0093, P0176
GPS query and arbitrary shell commands via the open D-Bus service.
Persistence / PivotModify OS Kernel, Boot Partition, or System PartitionATM-T0022 · ATM-P0075
The V850 chip of the head unit taken over by means of a manipulated firmware update.
Affect Vehicle FunctionLocal Function; Unintended Vehicle Network Message; Abuse Standard Diagnostic ProtocolATM-T0069, T0071, T0067 · ATM-P0073, P0144, P0145, P0192, P0094
Climate control and display, then indicators and door locks, finally steering commands via a diagnostic session.

What is decisive is not the entry point but the takeover of the V850 chip, a co-processor in the same head unit without signature verification. In R155 terms: Annex 5 items 12.2 and 11.3, measure M16. FCA recalled 1.4 million vehicles on 24 July 2015.

Tesla Model S 2016: Wi-Fi, browser, kernel, gateway, CAN

Manipulate Environment / Initial AccessRogue Wi-Fi Access Point; Browser CompromiseATM-T0009, T0011 · ATM-P0103, P0042
A spoofed hotspot, then a WebKit exploit for CVE-2011-3928.
Privilege Escalation / Defense EvasionExploit OS Vulnerability; Bypass Mandatory Access ControlATM-T0026, T0034 · ATM-P0001, P0003
Kernel vulnerability CVE-2013-6282, after which AppArmor was bypassed.
Credential Access / Defense EvasionUnsecured Credentials, Network Sniffing; Bypass UDS Security AccessATM-T0040, T0038, T0033 · ATM-P0004, P0105, P0149, P0002, P0043
SSH keys, static credentials, UDS keys from a CAN capture.
Lateral Movement / Affect Vehicle FunctionRemote Services; Unintended Vehicle Network MessageATM-T0053, T0071 · ATM-P0044, P0106, P0045
Telnet and SSH to the gateway; the gateway translated UDP packets on ports 20100/20101 into CAN.

“Free-fall” by Tencent Keen Security Lab is the deepest chain in the data set: 17 examples, 13 techniques, 9 tactics. Tesla closed it on 18 September 2016 by OTA update; CISA lists it as ICSA-16-341-01. The largest block of evidence comes from Miller and Valasek at the OBD port, with 44 examples.

Technique	in chains	Examples
T0022 Modify OS Kernel, Boot Partition, or System Partition	5 / 5	10
T0071 Unintended Vehicle Network Message	4 / 5	33
T0067 Abuse Standard Diagnostic Protocol	4 / 5	24
T0018 Command and Scripting Interpreter	4 / 5	5
T0040 Unsecured Credentials	3 / 5	12

Our own analysis across five reconstructed chains.

Secure boot on every reprogrammable ECU breaks T0022 in all five chains, and also T0031 and T0054.
Individual instead of static UDS keys devalue T0033 and T0067; SecOC addresses T0071.
Keeping no secrets in firmware and workshop tools makes T0040 collapse.

13Critical appraisal

What the matrix is good for, and what it is not

A fair assessment separates what the matrix achieves from what users read into it: 147 source-backed examples on the one hand, an empty mitigation field on all 77 techniques on the other.

This is what the matrix is good for

A common language across OEM, supplier, tester and VSOC: 14 columns familiar from ATT&CK.
An attack path library for the TARA: 147 evidenced examples and 22 chains for ISO/SAE 21434 Clause 15.
CTI and pentest tagging with stable IDs, unchanged since August 2023, plus a STIX 2.1 export.
Test planning through column-by-column scoping; UDS and CAN techniques are well evidenced with 57 examples.
R155 annual report: the threats considered become an auditable coverage table.

This is what the matrix is not

No risk analysis: no attack feasibility, no impact, no probability field. It is an input to the TARA, not a substitute for it.
No control catalogue: the mitigation field is empty on all 77 techniques.
No detection library: no data sources, no analytics, no telemetry references.
No compliance checklist: no mapping to R155 Annex 5, ISO 21434 clauses or TISAX.
Neither current nor neutral: 85.7 percent of the evidence dates from 2018 or earlier, one third is Tesla, the backend is almost empty.

The governance of the data set also determines how robust it is in an audit.

Bus factor of one

72 of 77 techniques come from a single author, six releases in two years, none so far in 2026. Treat the matrix like an open source dependency: pin the version, review the diffs.

Silent drift

No deprecation mechanism: T0056 and T0057 are effectively retired, yet they remain in the export. The release file (151 examples) and the live API (147) diverge.

ID confusion

One vendor example tags a diagnostic persistence case with “ATM:T1543”, an ATT&CK Enterprise ID. ATM IDs take the form ATM-T00xx.

Ten steps take the matrix out of the browser and into the TARA, the pentest and the VSOC.

Step	What to do
1 Pair with EMB3D	Map the techniques you use to EMB3D threats and inherit their mitigations.
2 Maintain an extension	Your own ID range for backend, app, OTA server, charging (ISO 15118, OCPP), V2X.
3 Freeze the version	Record ATM v4.02 (4 December 2025) in the TARA and the CSMS artefact, archive the STIX export.
4 Map to R155 Annex 5	4.3.2 to 4.3.7 map well, 4.3.1 backend remains largely open.
5 Build heat maps	Evidenced (48) against pentest scope against VSOC visibility; the difference is the backlog.
6 Anchor the IDs in PSIRT	Tag vulnerabilities, bug bounty cases and incidents; after twelve months you have your own trend data.
7 VSOC use cases	Start with T0067, T0071 and T0033: 25.8 percent of all examples.
8 Contribute cases	Submit via the Contribute button; 29 of the 77 techniques have no example.
9 Treat data as data	Import the JSON, clarify the duplicate P0083, the orphaned examples and the techniques without a tactic.
10 Add dimensions	Impair vs. Inhibit from ATT&CK for ICS and attack feasibility per Annex G for each technique.

In-Depth Whitepaper

Automotive Threat Matrix – ATT&CK for Vehicles: From Dataset to TARA

34 pages on the Auto-ISAC matrix: the complete dataset analysed, three real attack chains reconstructed in ATM language, mapping onto ISO/SAE 21434, UN R155 Annex 5, OWASP ISTG and ISVS as well as MITRE EMB3D – with worked examples on attack feasibility and a ten-point playbook for adoption.

The Complete Dataset Analysed

14 tactics, 75 techniques, 147 examples from 23 sources: origin, technique families, authorship and the evidence with its blind spots.

Three Attack Chains in ATM Language

Jeep Cherokee 2015, Tesla “Free-fall” 2016 and Miller/Valasek step by step – with the five choke points at which defenders sever the chains.

Mapping onto R155, ISO/SAE 21434 and OWASP

Annex 5 against the ATM, TARA steps 15.4 to 15.7 with default feasibility under Annex G, ISTG components per vehicle component.

STIX Reality and Ten-Point Playbook

What the “MITRE-compliant” export really contains, how Navigator heatmaps are built and which ten steps bring the matrix into TARA, pentest and VSOC.

Request the Whitepaper

German-language whitepaper, as at September 2026 – free of charge after a short registration.

Standards & Sources

The content on this page is based on the following publicly available guides and studies.

Auto-ISAC / Vultara · 2025

Automotive Threat Matrix (ATM), Release v4.02

Public knowledge base with 14 tactics, 75 techniques in the matrix and 147 examples; data as at 11 September 2026 for this page. Free to read and downloadable as native JSON and as a STIX 2.1 bundle.

Auto-ISAC · 2025

The Automotive Threat Matrix (ATM) – Whitepaper

Seven use cases from the TARA through threat intelligence to R155 reporting; describes the method of default feasibility per element. Authors from GM, Sumitomo, HORIBA MIRA, PACCAR, Eaton and Auto-ISAC.

General Motors (Karl Leboeuf) · 2025

Enhancing Vehicle Cyber Security: Updates to the Automotive Threat Matrix Tool

Presentation from March 2025 with the origin story: in 2019 MITRE declined GM's request and encouraged a standalone version; roadmap and JSON export.

ISO / SAE International · 2021

ISO/SAE 21434:2021 – Road vehicles – Cybersecurity engineering

Engineering standard across the vehicle lifecycle; Clause 15 defines the TARA methodology, Annex G the example tables for attack feasibility, Annex E the Cybersecurity Assurance Levels.

UNECE / Official Journal of the EU (OJ L 2025/5) · 2025

UN Regulation No. 155 – Cyber security and cyber security management system (consolidated version with Supplement 3)

Type-approval regulation with CSMS certificate, exhaustive risk assessment under Annex 5 Part A and mitigations from Parts B and C; binding in the EU for all new vehicles since July 2024 via Regulation (EU) 2019/2144.

OWASP Foundation · 2024

OWASP IoT Security Testing Guide (ISTG)

Test methodology with 101 test cases across eight device components and an attacker model of physical access (PA-1 to PA-4) and authorisation (AA-1 to AA-4); version 1.0 of March 2024, continuously maintained.

OWASP Foundation · 2025

OWASP IoT Security Verification Standard (ISVS)

Requirements catalogue in five chapters with verification levels L1 to L3; connected vehicles are named as an example for level L3.

MITRE · 2026

MITRE EMB3D Threat Model, Version 2.0.2

Threat model for embedded devices: device properties, 81 threats and 89 tiered mitigations with STIX 2.1 export; automotive explicitly named as a target sector. A natural complement to the mitigation-less ATM.

MITRE · 2026

MITRE ATT&CK, Version 19

Enterprise, Mobile and ICS; the ATM references ATT&CK identifiers for 13 of its 14 tactics, some of them from the Mobile matrix. ATT&CK itself contains no vehicle domain.

Federal Office for Information Security (BSI) · 2025

Cybersecurity in Road Traffic 2025 – Sector Situation Report (Cybersicherheit im Straßenverkehr 2025 – Branchenlagebild)

107 reports between February 2024 and March 2025, distribution by access route and status, plus 1,663 vehicle-related CVEs from 2018 to 2024 – the national baseline for comparison with a threat landscape recorded using ATM IDs.

Upstream Security · 2026

Global Automotive & Smart Mobility Cybersecurity Report 2026

494 publicly reported incidents in 2025, 92 per cent executed remotely, 67 per cent via telematics and cloud systems, 44 per cent ransomware-related.

Zero Day Initiative (Trend Micro) · 2026

Pwn2Own Automotive 2026 – Results

76 zero-days and USD 1,047,000 in prize money in Tokyo; infotainment via USB, charging stations via NFC. Shows where the research front stands in 2026 and what is still missing from the ATM evidence.

Related Services

Product Security & TARA nach ISO/SAE 21434 — Beratung Threat Modeling — Beratung IoT- und Fahrzeugkomponenten-Pentesting Whitepaper: Automotive Threat Matrix Pentest anfragen

Your TARA, Your Tests and Your SOC in One Language?

In a no-obligation initial consultation, we show you how the Automotive Threat Matrix can be built into your TARA under ISO/SAE 21434, your pentest planning and your evidence under UN R155 – including the gaps you will need to close yourself.

Book an initial consultation Back to topic area

Automotive Threat Matrix (ATM): ATT&CK for Vehicles

From the GM request to v4.02

User group under the Auto-ISAC

ISO/SAE 21434 supplies the vocabulary

ATM goes public

UN R155 for all new vehicles

Release v4.02

The Essentials at a Glance

The vehicle-specific technique families

The Automotive Threat Matrix in detail

The signature of the working group

From the refusal to release v4.02

The three object types

Tactic

Technique

Example

What the download provides

Three tactics with a special status

The best-evidenced techniques

29 of the 77 techniques without a single example

What the data set also reveals

One author, one account

Growth has stalled

Not everything has been demonstrated

Germany: the BSI situation report

Pwn2Own Automotive

Two branches of attack

Branch A: the vehicle itself

Branch B: backend, portals, supply chain

Worldwide: the same logic, different deadlines

Japan

South Korea

United Kingdom

China

Default feasibility per technique: worked examples

The default depends on the control

Low feasibility does not mean low risk

The path is assessed, not the cell

Known to Annex 5, not to the matrix

Known to the matrix, not to Annex 5

Auto-ISAC ATM

OWASP ISVS

OWASP ISTG

ATM techniques mapped to ISTG components

“MITRE-compliant” means format, not membership

Prepare the bundle

Configure the Navigator

Three layers, one backlog

Tesla Model S 2016: Wi-Fi, browser, kernel, gateway, CAN

This is what the matrix is good for

This is what the matrix is not

Bus factor of one

Silent drift

ID confusion

Automotive Threat Matrix – ATT&CK for Vehicles: From Dataset to TARA

The Complete Dataset Analysed

Three Attack Chains in ATM Language

Mapping onto R155, ISO/SAE 21434 and OWASP

STIX Reality and Ten-Point Playbook

Standards & Sources

Related Services

Your TARA, Your Tests and Your SOC in One Language?