The key changed hands. What about the company car’s digital access?
Returning a physical key may leave accounts and histories associated with the vehicle. Define who may view information and how to verify that an association has ended.
Читати португальськоюBy Pentesty
The study provides a sample, not a diagnosis of every fleet
The Automatic Transmission study analyzed 21 vehicles and 30 apps from the U.S. market in tests from October 2024 to August 2025. Seven apps transmitted sensitive identifiers to third parties associated with advertising or tracking. Results describe that sample and period. The analysis below proposes an enterprise fleet review.
Assign each capability a purpose and an owner
Start with a vehicle authorized for the exercise and list the apps, profiles, contracted services and integrations the company uses. Distinguish the driver’s account from fleet administration. Record who may view location, history and maintenance information, according to the capabilities actually available in that model and service.
Our hardware custody analysis connects receipt, use and transfer of responsibility. For a connected car, add the association between account and vehicle. Physical possession of the key and digital access need separate verification, including when a rental company or contractor handles the handover.
Rehearse the change with test accounts and journeys
Plan a simulated handover without journeys that reveal employee or customer routines. Use test accounts and a stationary vehicle in a controlled location for the agreed checks. Any capability with physical effects requires specific coordination with the person responsible for operational safety.
- Before handover: record approved associations and the information each account can view. Compare that observation with the service inventory.
- Ending access: remove the previous association through the available procedure and check that the test account lost the intended access, including sessions already open.
- New association: connect the next test driver with approved permissions. Check that they receive only necessary information and do not inherit personal information from the previous profile.
- Continuity: validate that legitimate fleet administration remains available and record dependencies requiring supplier intervention.
Deleting from a display and removing from a service differ
Information may disappear from a screen while remaining associated with an app account or external service. Record exactly what was observed: local removal, session termination, permission change or confirmation from the supplier. Avoid treating one form of evidence as a demonstration of all the others.
This distinction complements the review of devices on corporate networks. Inventory needs to cover the dependencies an asset uses. For information held beyond the company’s reach, identify the request channel and who follows up, without promising an outcome that the exercise cannot demonstrate.
Make the next handover a repeatable test
The handover should produce a simple record: the vehicle and service assessed, versions where available, test accounts, expected outcome and evidence of the result. Restrict access to records, particularly when they contain location. Collection should answer the exercise’s questions without creating an unnecessary new journey history.
Pentesty’s analysis is that a fleet procedure improves when someone else can execute it and check its boundaries. Repeat testing after changing an app, contract, device or owner. Supplier dependencies need deadlines and follow-up; essential maintenance and safety capabilities should not be disabled without assessing their operational effect.
Update: verify the identity service managed by the supplier too
Editorial update: November 9, 2026
The November 9 report adds a different dimension to driver handover. In research published November 7, Shubham Shah and Sam Curry report administrative access to identity services used by two unnamed automakers. The complete chain through to a vehicle was tested only with authorized US accounts and cars. According to the researchers, the automakers remediated the problems the same day and rotated affected credentials. The Australian account describes another chain. This does not establish criminal exploitation or diagnose every vehicle.
The official PingIDM guidance instructs operators to remove or protect development tools before production and explains that Felix console authentication is separate from IDM authentication. For a fleet customer, this becomes a verifiable supplier question: which administrative interfaces exist, who owns their credentials and how was their isolation confirmed? The existence of that guidance does not demonstrate that every deployment is exposed.
In the authorized exercise, retain the driver access termination test and add an unauthorized administration scenario in a laboratory environment. Use fictitious accounts and data to verify that an identity lacking that authorization cannot change another profile or obtain its sessions. Separate configuration evidence, the authorization decision and the observed result. The proposed assessment does not require unlocking or moving real vehicles.
Ask the service’s technical owner for evidence of the applied remediation and the revocation actually performed. Record the version or configuration, date, test identity and response rejecting old access. Changing a password does not, by itself, demonstrate that previously issued tokens are invalid. Fleet acceptance should reconcile that result with continued legitimate access, without collecting secrets or personal journeys.
Frequently asked questions
How should we scope a fleet assessment?
Identify the vehicle, service, version and authorized accounts. Agree on the access and outcomes to check, observation limits and the people responsible for any operational effect.
Does returning a physical key end app access?
Verify that in the service being used. The exercise compares permissions before and after removing the association, including open sessions and access depending on the supplier.
Do we need to record employees’ real journeys?
The proposal uses test accounts, information and conditions. Collect only what is necessary to check the selected access and limit who may view the evidence.
Does a pentest cover every vehicle capability?
The scope should identify authorized digital interfaces and integrations. Automotive components and actions with physical effects require specific planning, authorization and capability before any test.
Sources and references
- Northeastern University: Automatic Transmission summary and methodology
- Automatic Transmission: full research paper
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.