Passeca - Governance, Risk management, and Compliance support
Under attack?
Automotive

Cybersecurity for automotive

TISAX assessment, supply-chain risk on Panorays, and penetration testing — the Passeca bundle for automotive suppliers, OEMs and engineering partners in the ENX network.

Book a free consultationSee all industries

Passeca's automotive cybersecurity bundle is built around TISAX — the European automotive industry's security-assessment label administered by ENX. Passeca defines scope, registers you on the ENX portal, closes the VDA ISA gaps, manages supply-chain risk on Panorays, and runs penetration testing of connected services, so a single partner covers the regulation, the supply chain and the attack surface.

Regulation & threats

What defines automotive cybersecurity?

The automotive sector is governed by one dominant assessment framework (TISAX) and targeted by three classes of threat. The Passeca bundle addresses all of them.

Threat

Supply-chain attacks

Automotive suppliers are connected to OEMs and tier-1 partners through shared development platforms and data-exchange channels. A compromise at a single supplier can cascade across the network, and OEMs increasingly require proof that each link in the chain is secure.

Threat

Intellectual-property theft

Design data, engineering schematics, prototypes and manufacturing know-how are the crown jewels of an automotive organisation. Exfiltration of this data — to a competitor or a state actor — can erase years of R&D investment.

Threat

Connected-vehicle vulnerabilities

Modern vehicles are rolling compute platforms. APIs, infotainment systems, OTA update mechanisms and telematics create remote attack surface that, if exploited, can affect safety-critical functions.

Regulatory anchor

TISAX

The ENX-administered assessment against the VDA ISA catalogue that many OEMs require as part of their supplier security requirements. Passeca supports you from scope registration through preparation and independent assessment, with the aim of obtaining a shareable TISAX assessment result — and maps the evidence so it also serves ISO 27001.

The Passeca bundle

The Passeca bundle for automotive

A named package of compliance, supply-chain risk and offensive security — everything an automotive supplier needs to satisfy OEMs and defend the attack surface.

TISAX assessment support

Scope definition, ENX registration, VDA ISA gap analysis, remediation, internal assessment, and on-site audit support through to a shareable assessment result. Evidence captured in Hyperproof is reusable for ISO 27001 and BSI C5.

TISAX Assessment Support

Supply-chain risk (Panorays)

Automated third-party and supply-chain risk assessment on Panorays — continuous vendor evaluation mapped to the VDA ISA supplier requirements and NIS2 supply-chain obligations, with evidence for customer audits.

Third-Party Risk Management

Penetration testing

Web, API, network and cloud penetration testing of connected services, partner portals and development environments — under OWASP, PTES and NIST methodology, with a gated sample report.

Penetration Testing

Virtual CISO & GRC automation

A vCISO owns the TISAX program end to end from €1,950/month, with Hyperproof automating evidence collection across 160+ prebuilt frameworks so audit readiness becomes continuous rather than a scramble.

Virtual CISO
Case study

An automotive supplier's path to a TISAX label

An anonymised engagement showing how the automotive bundle works in practice.

A tier-2 automotive engineering supplier was invited to join the ENX portal by a German OEM but had no formal information-security management system. Passeca defined the assessment scope at AL2, ran a VDA ISA gap analysis, and built the missing controls — supplier management, prototype handling and access control.

Evidence was captured in Hyperproof and the supplier passed the audit-provider's plausibility check on the first attempt.

FAQ

Automotive cybersecurity, answered

The questions automotive suppliers ask before starting a TISAX-led security program.

What is TISAX and why does it matter for automotive suppliers?
TISAX (Trusted Information Security Assessment Exchange) is the European automotive industry's shared assessment scheme, administered by ENX and assessed against the VDA ISA catalogue. It lets a supplier be assessed once and share the result with many OEMs instead of being audited separately by each customer. Many OEMs make a valid TISAX label a contractual prerequisite for onboarding.
How does Passeca handle automotive supply-chain risk?
Passeca deploys Panorays for automated third-party and supply-chain risk assessment — the same control area that NIS2 and the VDA ISA both emphasise. It continuously evaluates vendor security posture, maps it to regulatory obligations, and produces evidence that satisfies both customer audits and internal risk management.
Which TISAX assessment level do automotive suppliers need?
AL2 generally involves a plausibility check and interview; AL3 includes more extensive verification, including on-site assessment. The required level depends on the customer's protection requirements and TISAX assessment objectives. Passeca determines the correct level during scope definition and registers you on the ENX portal accordingly.
Does an ISO 27001 certificate help with TISAX?
Yes. The VDA ISA is heavily derived from ISO/IEC 27001, so an existing ISO 27001 ISMS closes most of the TISAX control set. Passeca maps evidence once in Hyperproof so the same work serves both assessments, reducing cost and effort.
What penetration testing does the automotive industry need?
Automotive organisations benefit from web and API testing of connected services and partner portals, network testing of development environments, and secure SDLC (SAST/SCA) for embedded and connected-vehicle software. Passeca delivers these under the OWASP, PTES and NIST methodologies.
How long does a TISAX assessment take with Passeca?
From ENX registration to a shareable assessment result, four to eight months is typical for AL2; AL3 takes longer because of the on-site audit. Passeca runs the gap analysis in parallel with registration to compress the timeline.
Can Passeca replace multiple vendors for our automotive security program?
Yes. The automotive bundle combines TISAX consulting, supply-chain risk management on Panorays, and penetration testing under one partner, with evidence captured in Hyperproof — replacing the typical patchwork of separate compliance, testing and risk vendors.
Always-on defence

Told to get TISAX by an OEM?

Tell us which OEM invited you and what protection level you need. We will confirm your assessment level and give you a timeline and cost band for the full automotive bundle.

Book a free consultationSee TISAX support

Related

All industriesThe six industry bundlesTISAX Assessment SupportThe regulatory anchor of this bundleISO 27001 CertificationThe basis of the VDA ISA control setThird-Party Risk (Panorays)Automotive supply-chain riskPenetration TestingConnected-service and network testingVirtual CISOOwn the TISAX program from €1,950/monthBook a consultationFree 30-minute compliance consultation