# automotive

Source: https://startwithidentity.com/verticals/automotive/
Last updated: 2026-06-18
License: content by Start with Identity. Cite the source URL.

---

## The job identity does in automotive

Automotive identity spans three very different populations at once: employees and a sprawling dealer and supplier network, the connected vehicles and devices themselves, and the consumers who use owner apps and in-car services. The distinctive and fastest-growing part is [machine identity](https://startwithidentity.com/guides/fundamentals/what-is-machine-identity/): every connected car, ECU, and backend service needs cryptographic identity and certificate lifecycle at fleet scale, often across a vehicle lifetime measured in decades.

## The regulatory and compliance floor

UNECE WP.29 R155 requires a certified cybersecurity management system for vehicle type approval, and ISO/SAE 21434 sets the engineering practices behind it. Owner and telematics data falls under GDPR and CCPA. The practical effect is that vehicle [PKI](https://startwithidentity.com/standards/verifiable-credentials/), secure over-the-air updates, and auditable access to manufacturing and telematics systems are mandatory, not optional.

## The threat landscape here

Connected vehicles expand the attack surface dramatically: compromised telematics backends, forged firmware updates, and stolen credentials into manufacturing and dealer systems. Long-lived vehicle certificates that are never rotated, and over-permissioned dealer access, are recurring weak points.

## What good looks like

- Strong workforce [IAM](https://startwithidentity.com/vendors/iam/) with federated, time-bound access for dealers and suppliers.
- A scalable [PKI and certificate lifecycle](https://startwithidentity.com/vendors/pki/) program for vehicles, ECUs, and services, with automated rotation and revocation.
- [CIAM](https://startwithidentity.com/vendors/ciam/) for owner apps with privacy and consent built in.
- [PAM](https://startwithidentity.com/vendors/pam/) for plant-floor and telematics backends.

## Vendors and fit

Workforce and dealer identity fit [Microsoft Entra](https://startwithidentity.com/vendors/iam/microsoft-entra/) or [Okta](https://startwithidentity.com/vendors/iam/okta/); vehicle and device PKI fits [Keyfactor](https://startwithidentity.com/vendors/pki/keyfactor/) and peers in [PKI](https://startwithidentity.com/vendors/pki/).

## Common pitfalls

- Treating vehicle PKI as one-time issuance rather than a decades-long lifecycle.
- Letting the dealer and supplier network accumulate standing access with no governance.
- Bolting consumer identity on late, after privacy obligations are already in scope.

## Where it is heading

Software-defined vehicles will make machine identity and certificate automation central, and regulatory pressure from WP.29 will keep raising the bar on auditable access across the supply chain.