Automotive

Software-Defined Vehicles on Legacy Supply Chains

The modern car runs 100 million lines of code. The systems managing its production, supply chain, and dealer network were built before the smartphone.

Key data points

Lines of code in a modern vehicle

More than a fighter jet. Software is the product now.

~100 million

Automotive supply chain systems over 10yr old

EDI, ERP integrations, and supplier portals built for a pre-digital supply chain.

~55%

Connected vehicle data generated per day

Telematics, diagnostics, location, usage. Flowing into legacy backend systems.

~25 GB per car

Automotive cybersecurity incidents (2025)

Vehicle systems, dealer networks, supply chain attacks. Up 200% since 2022.

~350

Dealer management system average age

DMS platforms managing sales, service, parts, and customer data on legacy infrastructure.

15+ years

Risk factors

What keeps Automotive CISOs awake

●

Dealer management systems on legacy platforms storing customer PII, financial data, and service history

●

Supply chain EDI integrations through 20-year-old protocols with no encryption or authentication

●

Connected vehicle telematics flowing into backend systems not designed for real-time data at scale

●

OTA update infrastructure bolted onto legacy vehicle software architecture

●

EV charging network management on startup-era code with minimal security review

Stack comparison

Typical vs Recommended

Typical Automotive stack

Java 8 31

Oracle Database 40

SAP ERP 29

.NET Framework (4.x) 39

SQL Server 52

Recommended modern stack

Java 17+ 70

PostgreSQL 81

Kubernetes 71

FastAPI 80

React 73

Score your own stack →

Regulatory landscape

Compliance Exposure

UNECE WP.29

Vehicle cybersecurity regulation. Software update management systems must meet security standards. Legacy OTA infrastructure often non-compliant.

ISO/SAE 21434

Automotive cybersecurity engineering. Requires threat analysis across the vehicle lifecycle. Legacy systems create blind spots.

GDPR (Connected Vehicles)

Vehicle data is personal data. Location, driving behavior, voice commands — on legacy telematics backends.

Right to Repair

Diagnostic data access requirements. Legacy DMS and diagnostic systems resist interoperability mandates.