Connected car security: Software complexity creates bumps in the road

This report surveys the security landscape of connected vehicles and their software supply chains, highlighting past remote hack demonstrations, life-safety implications of internet-to-physical controls, and systemic risks from outdated open-source components, insecure OTA updates, and slow patch cycles. It reviews emerging standards (UN WP.29, ISO/SAE 21434), advocates SBOM-driven visibility and build-time assurance, and argues for a holistic AppSec approach beyond SAST/DAST to include integrity verification and runtime protections.