There are numerous challenges in building effective incident response capabilities within the automotive industry. Vehicles are complex environments and this creates difficulties in monitoring and controlling, making it challenging to differentiate between anomalies and genuine cyber threats. The complex supply chain involving numerous stakeholders adds another layer of complexity, making it difficult to coordinate all the suppliers. Additionally, the cybersecurity field in the automotive industry is still in its infancy, and implementation guidelines require further development.
In this talk,  I will focus on the challenges of building an effective incident response for the automotive industry and I will give an overview of the current incident response landscape, particularly exploring PSIRT and VSOC, as well as a future perspective.