According to a Gartner® report titled “Connected Vehicle Market Forecast: Opportunity Spotlight”, “The volume of vehicles manufactured with an embedded telematics control unit will grow from 485 million in 2024 to 852 million by 2032.”* However, our threat intelligence monitoring shows a 600% increase in vehicle cyberthreats over just four years. As more vehicles hit the road, diagnosing problems has become increasingly complex, introducing severe safety risks.
The prevailing model for vehicle cybersecurity has been a cloud-centric approach, heavily reliant on detection and response workflows that require continuously uploading vast amounts of telemetry and event data from every vehicle to a centralized Vehicle Security Operations Center (VSOC). While this architecture offers centralized visibility and advanced analytics, it also creates significant operational and cost pressures. As fleets expand, the sheer volume of data—much of it non-critical—further strains infrastructure and teams.
This is why we bring VSOC capabilities into vehicles by leveraging edge AI, and we are showcasing those capabilities as a SOAFEE blueprint, showing how they can be incorporated in an automotive development flow. This allows vehicles to detect and respond to cyber threats locally, without relying solely on remote teams. By correlating telemetry data and security events across multiple electronic control units (ECUs)—including those flagged by intrusion detection systems (IDS)—we can identify patterns and construct contextualized attack paths directly on CPUs, with strict control over resource consumption to avoid interfering with vehicle functions. When additional computing resources such as NPUs or GPUs are available, our solution adapts to utilize them, maximizing edge computing capabilities. These insights are cross-referenced with threat intelligence to detect suspicious behavior before it becomes critical. The result is reduced vehicle downtime and running costs, lower integration and maintenance overhead, and a more efficient VSOC team.
Challenges
The first and most critical requirement for effective vehicle protection is continuous updates. Cyberattacks evolve rapidly, so in-vehicle AI detection models must constantly learn and adapt. Each time a new threat emerges, its tactics, behavior, and attack path should be quickly incorporated into the detection system.
But today, this is a painfully repetitive cycle. Updating an AI detection model isn’t just a single round of training; it requires an ongoing loop: fine-tuning in the cloud, pushing onto development hardware for edge performance validation, adjusting again, validating once more—and only after multiple iterations—confirming it is safe and effective enough to deploy via OTA. This continuous loop of testing and verification slows down the entire process, making it hardware-dependent and difficult to scale, especially for global OEMs managing teams across multiple regions.
Even after the model finally passes this cycle, deployment itself remains a challenge. Traditional OTA updates are still slow and disruptive, often requiring the entire system to go offline and restart—an impractical approach for vehicles that need continuous availability.
Figure 1: Challenge of continuous loop of testing and verification in traditional OTA updates
Solution
By leveraging the SOAFEE architecture, which enables hardware decoupling and cloud-based validation, VicOne’s xCarbon Edge AI removes one of the biggest roadblocks in AI-based vehicle protection: the dependence on specialized development hardware. Instead of cycling models through physical devices scattered across regions, both model fine-tuning and edge performance validation can now be conducted directly in the cloud—using virtual devices, a key part of the SOAFEE development and deployment methodology.
This cloud-native approach transforms how updates are developed and deployed:
- Cloud-Based Fine-Tuning & Evaluation
Eliminates the need for physical devices and enables full-stack testing, from fine-tuning our TinyLlama model in the PyTorch pipeline to system validation and pre-deployment checks. - Virtual Device Testing
Enables scalable and parallel performance evaluation, accelerating development cycles and reducing hardware dependency. - Integrated DevOps Workflow
Cohesive development pipeline with training, validation, and deployment aligned in one loop. - Efficient and Reliable Updates
Orchestration enables fast and resilient updates, ideal for vehicle embedded units.
Figure 2: A cloud-native approach from VicOne's xCarbon Edge AI powered by SOAFEE architecture
Value for OEMs and Suppliers
- Boost Efficiency: Accelerates threat adaptation so vehicles can respond to new attacks faster. Streamlines analyst workflows, cutting triage time by up to 80%.
- Optimize Cloud Costs: Pre-filters and summarizes security events before syncing with the cloud VSOC, reducing cloud transfer and processing costs by up to 60%.
- Lower Hardware Dependency: Leverages Kleidi to optimize workloads on Arm CPUs without requiring specialized AI processors, and minimizes reliance on specialized test devices and regional labs, driving operational cost efficiency.
With SOAFEE Blueprint, members can explore cloud-native pipelines for GenAI deployment, complete with training, fine-tuning, and virtual device validation. For those focusing on edge AI cybersecurity, our expertise in risk identification and runtime protection is ready to support you. We invite members to engage with us, exchange ideas, and collaborate to advance secure, intelligent automotive systems together.
Learn more about this partnership and solution, watch: SOAFEE Blueprint with VicOne
*Gartner, Connected Vehicle Market Forecast: Opportunity Spotlight, Jonathan Davenport, 18 October 2024. (For Gartner Subscribers only) GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
