12 Million Security Events Per Day. Their VSOC Had 4 People.
A European OEM rolled out connected services to 2.3 million vehicles. The security telemetry hit like a fire hose - 47GB per vehicle per day. Their cloud IDS couldn't keep up, and their 4-person VSOC was triaging alerts from last week.
Client
European Automotive OEM
Industry
Use Case
Vehicle Intrusion Detection & Cybersecurity
Products
Timeline
Pilot on 15K vehicles in 8 weeks, fleet rollout over 6 months
ROI
$11.4M annual cloud and cellular cost avoidance
The Solution
We put the IDS on the vehicle. CAN bus traffic analyzes locally. The vehicle knows what 'normal' looks like for that specific car. When something unusual happens - wrong ECU sending a message, abnormal message frequency, injection attempt - the vehicle flags it immediately. Cloud only sees confirmed security events.
On-Vehicle CAN Analysis
Each vehicle learns its own baseline - which ECUs talk to which, normal message patterns, expected frequencies. Anomaly detection runs against that baseline in 0.8ms. No cloud round-trip needed.
Local Event Triage
Vehicle classifies events into categories: confirmed attack, suspicious behavior, unusual but benign, normal operation. Only the first two categories transmit. Normal CAN traffic stays on the vehicle.
OTA Signature Updates
New attack signatures push to the fleet in 4 hours. When a new CAN injection technique appears, every vehicle gets updated before the next parking event. No recalls required.
The Results
The VSOC is now same-day. Four analysts handle 847 confirmed security alerts per day instead of 12 million raw events. They caught their first real attack in week 3 - a researcher probing the telematics unit. Detection time: 0.8ms.
Detection Time
Data Reduction
Daily Alerts
Cost Avoidance
Attack detection dropped from 340ms to 0.8ms - 425x faster
Daily VSOC alert volume reduced from 12 million to 847
Cellular costs dropped from $14.2M to $840K annually
Cloud infrastructure savings of $11.4M in first year
UN R155 compliance achieved 4 months ahead of deadline
Pilot validated on 15K vehicles in 8 weeks
First real attack caught in week 3 - researcher probing telematics
Explore Related Solutions
Your VSOC drowning in vehicle telemetry?
If your connected fleet generates more security data than your team can analyze, we should talk. We've deployed on millions of vehicles.