Key Takeaways
- Physical AI enables artificial intelligence to perceive, decide, and control real‑world devices such as vehicles and robots, moving AI beyond pure software.
- Cybersecurity must be embedded from the earliest vehicle design stages and maintained throughout the entire lifecycle to protect physical AI systems.
- Autocrypt’s Red Team systematically identifies external entry points (Wi‑Fi, Bluetooth, sensors) and validates that in‑vehicle security controls are correctly implemented.
- The Cyber Security Test Platform (CSTP) consolidates Red Team expertise to test compliance with international standards and support vulnerability assessments during development.
- Securing centralized fleet‑management systems for autonomous commercial vehicles requires strong encryption and authentication for vehicle‑to‑server communications.
- Autocrypt is extending its cybersecurity solutions to buses, trucks, agricultural machinery, drones, and is exploring applications for industrial robots.
- Proprietary, non‑public data on automotive‑specific attack methods gives Autocrypt an advantage in developing specialized AI for automotive cybersecurity.
- Engineers must master software development and cybersecurity fundamentals; AI can assist but cannot replace human verification of security outcomes.
Introduction and Background
Song Jong‑hyuk, who leads the Automotive Security Threat Research Institute at Autocrypt, stresses that as physical artificial intelligence (AI) gains the ability to operate in real‑world environments, cybersecurity must be considered from the very first steps of vehicle design. Autocrypt, founded in 2019 as a spin‑off from Pentasecurity’s automotive security unit, provides in‑vehicle software security, vehicle‑to‑everything (V2X) technologies, and broader automotive cybersecurity solutions. Physical AI refers to AI models that can sense, make decisions, and directly control physical devices such as cars and robots, thereby extending AI’s influence beyond software into the tangible world.
The Rise of Software‑Defined Vehicles and Physical AI
With software‑defined vehicles (SDVs) becoming central to the automotive industry, physical AI is emerging as a key technology trend. This shift expands the scope of automotive cybersecurity beyond the vehicle itself to include cloud platforms and roadside infrastructure. Autocrypt is leveraging its deep experience in autonomous‑driving security to broaden its business into the physical AI sector, aiming to protect the entire ecosystem where AI interacts with hardware.
Integrating Security Across the Lifecycle
Song emphasizes that security policies must be properly incorporated from vehicle design through the entire development process. Autocrypt is building an architecture that integrates security technologies across the whole infrastructure, covering communications between servers and roadside equipment. The objective is to apply security throughout the product lifecycle so that physical AI can operate safely in real‑world conditions.
Risks in Physical AI Environments
In environments where physical AI governs sensors and actuators, cyberattacks that tamper with sensor data or hijack remote control commands can directly cause accidents. To prevent such incidents, security specifications must be defined early and enforced consistently across in‑vehicle systems, cloud services, and roadside infrastructure. This integrated protection approach ensures that a breach in one layer does not compromise the overall safety of the AI‑driven system.
Role of the Red Team
One of the key units under Song’s leadership is Autocrypt’s Red Team, which focuses on uncovering vulnerabilities in automotive cybersecurity systems by simulating external attack paths into vehicles. The team’s highest priority is to identify possible goal is to discover external entry points that attackers could exploit to gain access to a vehicle.
Testing External Interfaces and Internal Controls
The Red Team examines whether remote intrusions are feasible through common interfaces such as Wi‑Fi, Bluetooth, and various sensors, while also confirming that in‑vehicle security functions have been correctly implemented. Additionally, the team checks whether attackers could seize unauthorized control of a vehicle or extract data even after penetrating external defenses. This includes verifying data encryption, assessing whether each security layer can be bypassed, and determining if identified vulnerabilities could be leveraged in real‑world attacks.
Cyber Security Test Platform (CSTP)
The knowledge gathered by the Red Team has been codified into Autocrypt’s Cyber Security Test Platform (CSTP). CSTP is an automotive cybersecurity testing solution that validates compliance with international standards and national regulations for vehicles and electronic control units (ECUs). It supports vulnerability assessments and penetration testing, enabling security risks to be spotted early in the development cycle.
Adapting CSTP for Suppliers
Autocrypt has incorporated the Red Team’s accumulated insights on automotive vulnerabilities and attack techniques into CSTP. Recognizing that suppliers and component manufacturers often face less extensive testing demands than original equipment manufacturers (OEMs), the company is developing a compact version of CSTP tailored to their needs, with a planned launch later this year.
Securing Centralized Fleet Management
Song also highlights cybersecurity for centralized fleet‑management systems as a critical challenge in the era of autonomous commercial vehicles. In such operations, a central system must monitor the autonomous driving status of each vehicle, manage software versions, and handle abnormal events. Because vital information continuously flows between vehicles and servers, robust encryption and authentication mechanisms are essential. Autocrypt is researching the communication protocols used in commercial vehicles and is building specialized cybersecurity testing tools for these environments.
Expansion Beyond Passenger Cars
Beyond passenger vehicles, Autocrypt is extending its technologies to buses, trucks, agricultural machinery, and drones. The company is also engaged in discussions with industry partners about applying its solutions to industrial robots. This broadening reflects the growing need to secure any platform where physical AI interacts with the physical world.
Limitations of General‑Purpose AI in Automotive Security
Song cautions that general‑purpose AI has limitations when applied to automotive cybersecurity. Autocrypt possesses proprietary data on automotive‑specific attack methods and vulnerabilities that has been amassed through penetration testing and is not publicly available. The company intends to leverage this exclusive knowledge to develop specialized AI models tailored to the unique threats faced by vehicles and related infrastructure.
Fundamentals for Engineers in the AI Era
Finally, Song underscores the importance of mastering core fundamentals for engineers preparing for the AI‑driven future. Even if AI assists in generating code or automating security tests, humans remain ultimately responsible for verifying the outcomes. Effective use of AI is valuable, but developers must still possess a solid grounding in software development and cybersecurity principles to properly validate and trust what AI produces.
Overall, the interview with Song Jong‑hyuk highlights that as physical AI becomes ubiquitous in transportation and adjacent sectors, cybersecurity must shift from an afterthought to a foundational, lifecycle‑spanning discipline. Through proactive design, rigorous testing (exemplified by the Red Team and CSTP), and a focus on both vehicle‑centric and infrastructure‑wide protections, Autocrypt aims to ensure that AI‑enabled mobility remains safe, reliable, and resilient.