Are You Ready for UN R155? The Real Work Behind Automotive Software Security Compliance
Modern vehicles are software systems on wheels with over 100 ECUs, millions of lines of code, and globally distributed supply chains.
The UNECE regulations R155 and R156 have transformed cybersecurity and software update management into conditions for type approval.
If you build or secure automotive software, you must be able to prove that you can defend it.
The Regulatory Stack That Matters
Each standard ultimately asks the same question: can you show that your controls work?
Readiness Means Proof, Not Paperwork
A defensible security posture aligns three capabilities:
- Governance – ownership, accountability, supplier oversight
- Engineering – security embedded in code, updates, and telemetry
Response – measurable incident handling and remediation evidence
Control Mapping — From Mandate to Mechanism
Readiness converts regulatory requirements into verifiable engineering artifacts.
Runtime Proof as the New Baseline
Auditors now seek runtime evidence rather than static compliance documents.
Telemetry, exploitability validation, and continuous monitoring demonstrate control effectiveness in real operating conditions.
This closes Part 1.
Part 2 will examine how runtime analysis and exploit intelligence extend these requirements into measurable proof.
References
- Applied Intuition. (2023). ISO/SAE 21434: Shaping automotive cybersecurity.
- Cybellum. (2023). Introduction to automotive cybersecurity regulations.
- European Commission. (2024). Cyber Resilience Act: Proposal and implementation overview.
- International Organization for Standardization. (2021). ISO/SAE 21434: Road vehicles – Cybersecurity engineering.
- National Highway Traffic Safety Administration. (2022). Cybersecurity best practices for the safety of modern vehicles (Report DOT HS 813 417).
- United Nations Economic Commission for Europe. (2021). UN Regulation No. 155: Cybersecurity and cybersecurity management system requirements.
- United Nations Economic Commission for Europe. (2021). UN Regulation No. 156: Software update processes and management systems.
- Verband der Automobilindustrie (VDA). (2023). Trusted Information Security Assessment Exchange (TISAX) Assessment Levels Guide.
More blogs
Prompt Injection Was Never the Real Problem
A review of “The Promptware Kill Chain”Over the last two years, “prompt injection” has become the SQL injection of the LLM era: widely referenced, poorly defined, and often blamed for failures that have little to do with prompts themselves.A recent arXiv paper, “The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multi-Step Malware,” tries to correct that by reframing prompt injection as just the initial access phase of a broader, multi-stage attack chain.As a security researcher working on real production AppSec and AI systems, I think this paper is directionally right and operationally incomplete.This post is a technical critique: what the paper gets right, where the analogy breaks down, and how defenders should actually think about agentic system compromise.
.png)
CVE-2026-21858: Ni8mare: Unauthenticated Remote Code Execution in n8n
An unauthenticated Remote Code Execution (RCE) flaw, tracked as CVE-2026-21858 (CVSS 10.0), has been discovered in n8n, the widely-adopted workflow automation platform. With over 100 million Docker pulls and an estimated 100,000 locally deployed instances, this vulnerability transforms n8n from a productivity tool into a severe single point of potential failure for organizations globally.
A Primer on Runtime Intelligence
See how Kodem's cutting-edge sensor technology revolutionizes application monitoring at the kernel level.
Platform Overview Video
Watch our short platform overview video to see how Kodem discovers real security risks in your code at runtime.
The State of the Application Security Workflow
This report aims to equip readers with actionable insights that can help future-proof their security programs. Kodem, the publisher of this report, purpose built a platform that bridges these gaps by unifying shift-left strategies with runtime monitoring and protection.
.png)
Get real-time insights across the full stack…code, containers, OS, and memory
Watch how Kodem’s runtime security platform detects and blocks attacks before they cause damage. No guesswork. Just precise, automated protection.
Stay up-to-date on Audit Nexus
A curated resource for the many updates to cybersecurity and AI risk regulations, frameworks, and standards.