etc.[VisualPro Tech Brief] Expecting Attacks Within Three Years? When to Reopen Your TARA

VisualPro Tech Brief

Expecting Attacks Within Three Years? When to Reopen Your TARA

One public exploit moves a risk level from 2 to 5: reassessing post-production cybersecurity with VisualPro TARA

VWAY Tech Brief · November 4, 2026 · About 8 min read

TARAISO/SAE 21434Attack feasibilityRisk treatment decisionOTAPost-production security

01Summary

02What the 83% tells us and what it does not

QNX's "Under the Hood: SDV Developer Report" 2026 edition was fielded online by OnePoll from July 20 to August 4. The security figures are these.

Keep two things in mind when reading these. The survey was commissioned by a company that sells vehicle software, and respondents were paid to take part. And the 83% is a forecast by developers, not a statistic of attacks that happened. It does not mean 83% of vehicles will be attacked.

TheAutoExec's article on the survey goes a step further. Its author writes that manufacturers should be able to say how long a vehicle will receive security updates and how they respond when a vulnerability appears. That is the author's opinion, not a survey finding. For engineers, though, the question immediately turns into another one: is the risk assessment behind that answer still correct?

03A TARA at start of production rests on assumptions

ISO/SAE 21434 does not stop at concept and development. Its scope includes production, operation, maintenance and decommissioning. Clause 8 covers the activities that feed ongoing risk assessment and vulnerability management until the end of cybersecurity support, clause 13 covers incident response and updates, and clause 14 covers end of support and decommissioning. The cyber security management system under UN R155 also reaches the post-production phase.

Why does the assessment change after production starts? In the attack potential method, attack feasibility is the sum of five factors.

A lower score means an easier attack. Most of the reasoning behind "this attack is hard" at start of production sits in these five cells, and all five change when the world outside the vehicle changes. The attack can get easier while the asset and the size of the damage stay the same.

04Example 1: when attack code is published

This is a fictional system for education (not the design of any vehicle or manufacturer). A telematics control unit (TCU) is connected to the cellular network and uses an open-source library in its network stack. An update manager verifies OTA packages with a signature verification key. There are two threats.

• TH-1 Execute remote code through a TCU network stack vulnerability and send forged vehicle control messages (impact Severe)
• TH-2 Read ECU memory through the diagnostic port, extract the signature verification key and install a forged update package (impact Major)

At start of production (T0), both threats were rated hard, because an attacker would have had to find the TH-1 vulnerability personally. Now assume that a vulnerability in the library the TCU uses, together with attack code, has been published (T1). The values of AP-1 change.

Next is the risk calculation screen.

Two things stand out here.

First, there is no need to start over. What changed is the assessment of one attack path, and TH-2 stayed as it was. Once you know which asset and attack path a published vulnerability touches, the area to review narrows.

Second, the risk value is recalculated, but the decision does not change by itself. "Retaining" stays next to risk level 5. That decision was made when the risk level was 2. If nobody reopens it, the document goes on showing a stale decision as if it were still valid. A treatment decision is a judgment that carries responsibility, so a tool should not make it. That is why the procedure has to say who reviews it and when.

In this example we changed the TH-1 decision to "Reducing" and linked two cybersecurity goals to the attack path.

• SG-1 Public vulnerabilities in the TCU network stack are resolved by an OTA patch within a defined period
• SG-2 Only permitted control messages from the TCU pass through the gateway into the vehicle

The "defined period" in SG-1 is where this connects to the support commitment TheAutoExec's author asks about. To state a patch period and a support period, you need a risk assessment behind them.

05Example 2: when OTA adds a feature

The second signal comes from our own side, not from outside. Suppose a remote start feature is added over OTA after production starts (T2). The start-of-production TARA has neither the assets nor the attack paths for this feature. Correcting existing values is not enough; new entries are needed.

In the QNX survey, 79% reported pressure on speed. The more often features ship, the harder it is to treat a TARA as a document you finish once. The release procedure for a new feature needs a line that asks whether the TARA has been updated.

06When to reopen it: four signals

Finding the signal and redoing the assessment are different jobs. Collecting vulnerability information and responding to incidents take a separate system. A TARA is where you record how what that system finds changes the risk and the decision.

07What VisualPro TARA can and cannot do

What it can do

What it cannot do

VisualPro TARA records and calculates assessments. It does not collect vulnerability information or respond to incidents, so the fact that attack code has been published has to be judged and entered by the person responsible.

08What to check tomorrow

Security

• For each treatment decision, can you tell when it was made and what the risk level was at the time?
• When a public vulnerability appears, can you find right away which assets and attack paths to look at?

Development and product

• Does the release procedure for OTA features ask whether the TARA has been updated?
• Are open-source libraries linked to the assets in the TARA?

Quality and regulatory

• Does the procedure name the signals that reopen a TARA, the person responsible and the deadline?
• Does the support period promised to customers match the risk assessment?

09Closing

10Frequently asked questions