Manufacturing and process
Automotive
Car plants build to a sequence, fed just in time by hundreds of suppliers. When one plant or one supplier stops, the line stops.
How the process runs
From coil to finished vehicle
Steel and aluminium become panels, panels become a body, the body is painted, then powertrain, battery and interior are fitted in sequence. Every vehicle is tested and its software loaded before it leaves.
Stage 1: Press shop
Steel and aluminium coils are pressed into body panels.
Control systemsPress line PLCsDie change automationStage 2: Body shop
Robots weld and join panels into the body.
Control systemsRobot controllersWelding controllersSafety PLCsChallenge3Stage 3: Paint shop
Bodies are pre-treated, painted and cured.
Control systemsPaint robotsBooth and oven controlPaint shop SCADAChallenge3Stage 4: Powertrain and battery
Engines, or battery modules and packs, are built and tested.
Control systemsMachining linesBattery assembly PLCsFormation and test systemsStage 5: Final assembly
Trim, electronics, powertrain and wheels are fitted in the order customers ordered.
Control systemsConveyor controlTorque toolsSequencing (JIS)Challenge1Stage 6: End-of-line
Every vehicle is tested, its ECU software loaded and its security keys installed.
Control systemsECU flashing stationsKey provisioningTest rigsChallenge2
Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.
For product makers
Building equipment for the automotive industry?
Vehicle components follow UN R155 and sit outside the CRA. The equipment that builds and charges vehicles does not: robots, test systems and EV chargers sold in the EU fall under the CRA, and machines also under the Machinery Regulation.
- Robots and welding systems
- End-of-line and ECU flashing systems
- Battery production equipment
- EV chargers
- Plant software
Production equipment, chargers and software sold in the EU need CE marking under the CRA from 11 December 2027.
Internet-connected chargers and other radio equipment have had to meet the RED cybersecurity requirements since 1 August 2025, usually shown with EN 18031.
Due to apply from 20 January 2027 for robots, test rigs and other machines.
For plant owners
Where it gets hard, and how we tackle it
We start from how your process runs, fix what matters most first, and use what you already own wherever we can.
One supplier can stop every plant
In March 2022, Toyota stopped all 14 of its plants in Japan for a day after malware hit Kojima Industries, one of its parts suppliers. Just-in-time leaves no buffer. Source: Toyota
How we tackle itFor suppliers, a practical programme that holds up in OEM audits and TISAX. For vehicle plants, a plan for running when a key supplier goes dark.
Cybersecurity ProgramEnd-of-line holds the vehicle's secrets
Flashing stations and key provisioning handle the software and cryptographic keys that protect the car on the road. UN R155 requires the manufacturer's cybersecurity management system to cover production, not only design.
How we tackle itWe secure end-of-line as a crown-jewel zone: isolated network, controlled key handling, signed software, and logs that support your R155 evidence.
Risk AssessmentHundreds of robots, many line builders
Body and paint shops run hundreds of robots and PLCs installed by different line builders, many with default passwords and their own remote access.
How we tackle itA passive asset inventory, a zone design for each shop, and one managed remote access route for every line builder. New security tools are tried on a testbed with your PLC models first.
Gap AssessmentPlant and IT are tightly bound
Sequencing, MES and supplier links tie the line to IT. A cyberattack stopped Jaguar Land Rover's production for about five weeks in 2025, and in 2020 one disrupted Honda plants in several countries, including India.
How we tackle itWe define what the plant needs from IT to keep building, separate it, and rehearse recovery with production, IT and management together.
Incident Response TTX
Where plant owners usually start
Three ways in
Rules and standards
What applies in automotive
- IEC 62443International
Zones, conduits and remote access for press, body, paint and assembly shops.
- UN R155UNECE, required in the EU
Vehicle cybersecurity management system covering development, production and post-production. Required for all new vehicles in the EU since July 2024.
- TISAXAutomotive industry
Information security assessment used across the supply chain, including prototype protection.
- AIS-189India
India's standard for vehicle cybersecurity management. Draft rules published in June 2026 propose making it mandatory in phases.
- NIS2European Union
Covers manufacturers of motor vehicles above size thresholds.
Talk to RelyBlue
Operating in automotive?
An honest conversation about your OT environment. No sales pressure, no fear tactics.
- You talk to a senior advisor, never a salesperson