Electric vehicles (EVs) and their charging infrastructure are undergoing rapid digital transformation. More connectivity, more software, more data — but also more attack surface. While much of the attention in EVs centers on battery, range, charging speeds, and business models, a quieter yet critical challenge is lurking: cybersecurity.

As EVs and EV chargers become part of a cyber-physical network (vehicles, cloud, grid, communications), vulnerabilities in these systems can be exploited — with consequences ranging from privacy breaches to grid instability or even physical damage. In this post, we explore:

1. Key threat vectors in EV infrastructure
2. The EVSOAR approach (SOAR via charging stations) from arXiv
3. Best practices for manufacturers, operators, and users
4. What the future may hold

If you’re a vehicle OEM, charging station operator, infrastructure planner or even an EV-enthusiast, understanding these hidden risks is essential as EV adoption ramps worldwide.

Why EV Cybersecurity & Infrastructure Security is Critical ?

• Interconnected systems = expanded attack surface. EVs connect over cellular, WiFi, V2X, CAN bus, cloud APIs. Charging stations (EVSE)—wired to grid, to backend, to payment systems—are also part of this chain. An attacker may exploit weak links in any segment. (See broad threat overview in the DOE “Securing EV Charging Infrastructure” series).
• Grid & operational risk. Malicious control of many chargers could destabilize local grids, create surge or blackout risks, or overload transformers.
• Vehicle compromise & physical safety. Some attacks may target the EV’s internal systems: battery management, braking, power electronics. For example, overcharge or overdischarge attacks on battery systems could damage cells or reduce lifetime.
• Data privacy & identity theft. EVs collect a lot of telemetry (location, usage, charging patterns). Attackers compromising EV or charger backends can exfiltrate driver data.
• Manipulation of smart charging / demand response. In “smart charging” environments, decisions (time, rate, schedule) can be manipulated — e.g. a charge manipulation attack that shifts loads to times that benefit the attacker economically or harm the grid.
• Firmware / software hijacking & malicious payloads. Chargers have firmware and diagnostic interfaces that—if unsecured—can be overwritten or controlled remotely.
• Standards vulnerabilities. Standards such as ISO 15118 (for vehicle–charger communication) have known gaps; attackers may exploit handshake or certificate weaknesses.

In short: the more integrated and “smart” the system, the higher the stakes of security failure.

Threat Vectors & Attack Scenarios

Here’s a breakdown of common or emerging threat vectors to EV / infrastructure security, along with examples:

EVSOAR: Embedding SOAR via Charging Stations

What is EVSOAR?
EVSOAR is a new proposed architecture (described in an arXiv preprint) that leverages EV charging stations as edge computing and connectivity nodes to offload security orchestration, automation and response (SOAR) functionality closer to the vehicle, rather than relying solely on centralized cloud or cellular infrastructure.

Why EVSOAR? What problem it solves:

• Traditional SOAR tools rely heavily on cellular, 4G/5G, WiFi networks, which may suffer from latency, congestion or cost. EVSOAR minimizes dependency on those networks by using charger infrastructure (Power Line Communication or local links) to route threat data.
• Vehicles often have limited compute resources. EVSOAR shifts compute-heavy threat analysis tasks to chargers (edge) or central SOAR systems, improving responsiveness and detection.
• EVSOAR is designed to support real-time threat detection, automated responses (isolate vehicle, block charger), over-the-air (OTA) patching, threat intelligence sharing, and distributed model updates across charger network.

How EVSOAR works (high-level):

1. Edge-SOAR at charger nodes – each participating charging station hosts a lightweight SOAR agent (Edge-SOAR). It collects logs, monitors vehicle-charger interactions, sensor/firmware anomalies, etc.
2. Central SOAR system + VSOC integration – the central SOAR entity aggregates telemetry, orchestrates responses, shares intelligence, and interfaces with a Vehicle Security Operations Center (VSOC).
3. Data transport via charger network – instead of relying purely on cell/WiFi, EVSOAR may use power line communication (PLC) or in-network links embedded in EV charging infrastructure to route security data, reducing bandwidth load and latency.
4. Automated responses – e.g. when anomaly detected, Edge-SOAR may block a particular session, isolate communications, force firmware rollback, or quarantine an EV or charger.
5. OTA patch & updates – security patches or updated detection rules can be pushed via the charging network.
6. Scalable & distributed detection – the architecture supports distributing computational load across multiple charger nodes and central nodes, rather than overloading any one system.

EVSOAR is a promising paradigm to bring security “closer to the metal” in EV systems. Its experimental results (as of the paper) show improved latency, stability, and scalability compared to purely cloud-based models.

As EV adoption grows, architectures like EVSOAR will likely become part of the toolbox for securing integrated EV ecosystems.

Best Practices & Security Frameworks

Here is a breakdown of recommended practices for each stakeholder.

For Vehicle / Charger Manufacturers & OEMs

1. Security by Design / Secure Development Lifecycle
   • Integrate threat modeling, fuzzing, code reviews, formal verification from early stages.
   • Use hierarchical software quality assurance (HSQA) for charger software to detect vulnerabilities systematically.
   • Employ secure boot, measured boot, hardware root-of-trust.
2. Standards & Protocol Hardening
   • Implement and verify secure modes of ISO 15118 (e.g. certificate-based authentication, TLS).
   • Use OCPP 2.0 with security profiles, mutual authentication, encryption.
   • Follow cybersecurity standards such as ISO/SAE 21434 (automotive cybersecurity) and NIST / NIST-based EV profiles.
3. Over-the-Air (OTA) Secure Updates
   • Support secure, authenticated OTA updates with rollback prevention and integrity checks.
   • Ensure minimal disruption and safety constraints when updating.
4. Segmentation & Least Privilege
   • Isolate critical subsystems (BMS, safety ECU) from non-critical ones (infotainment, diagnostics)
   • Enforce least privilege access for internal modules and external interfaces
5. Intrusion Detection & Anomaly Detection
   • Equip ECUs or subsystems with lightweight anomaly detection (e.g. unexpected command sequences, timing anomalies)
   • Use threat intelligence and telemetry to monitor for known attack signatures
6. Physical & Environmental Hardening
   • Tamper sensors, secure enclosures, intrusion alarms on chargers
   • Secure diagnostic ports (disable or restrict when not in use)
7. Red-Team / Penetration Testing & Bug Bounty
   • Regular pentest of hardware, firmware, communication flows
   • Incentivize external security researchers via responsible disclosure / bug bounties

For Charging Station Operators / Infrastructure Owners

1. Network isolation & hardened comms
   • Use private APN / VPN networks (avoid open internet exposure) for charger-backend comms
   • Limit SIM-to-charger mapping, restrict which endpoints chargers can reach Driivz
2. Secure Charger Management System (CMS / CPMS)
   • Secure APIs, enforce role-based access control (RBAC)
   • Use TLS, certificate pinning, secure tokens
   • Enforce logging, audit trails, anomaly alerts
3. Edge security & distributed detection
   • Deploy intrusion detection / anomaly monitoring at charger or site level
   • Possibly use architectures like EVSOAR to move detection closer to edge
4. Patch management & lifecycle planning
   • Keep firmware, software, OS up to date; plan for regular security patches
   • Decommission unsupported chargers carefully
5. Redundancy, fallback & safe failover
   • Design fallback if communication with backend fails
   • Ensure chargers revert to safe mode rather than become unsafe
6. Threat intelligence & SOC / VSOC integration
   • Integrate with cybersecurity operations centers to monitor global threats
   • Share anonymized threat data across charger network
7. Physical security at site
   • Surveillance, tamper detection, lockable enclosures, environmental sensors
8. Penetration tests & audit
   • Regular security audits of charger sites, network, APIs
   • Use third-party assessors

For End Users / Drivers

1. Use secure authentication methods
   • Prefer mobile apps / secure tokens over weak RFID cards
   • Always logout, avoid sharing credentials
2. Be cautious about networks & interfaces
   • Avoid pairing your phone or device with EV over unsecured Bluetooth / Wi-Fi unless needed
   • Do not plug external USB / unknown devices into car/charger ports
3. Keep firmware / software updated
   • Accept or install OTA updates from trusted OEMs
   • Avoid unofficial or third-party firmware patches
4. Monitor anomalies
   • Watch for unusual battery drain, charging behavior, or notifications
   • Report suspicious charger behavior (e.g. charger changing rates, unexpected messages)
5. Privacy hygiene
   • Limit data sharing where possible
   • Use anonymization features (if available)
   • Review privacy policies & permission requests

Emerging Research & Future Directions

• Multimodal intrusion detection in EVSE (using network, kernel logs, power metrics) with federated learning to detect attacks across distributed charger networks.
• Distributed / edge SOAR models like EVSOAR, which embed intelligence at charger level to reduce latency and bandwidth constraints.
• Side-channel attacks on EV battery telemetry (e.g. “Leaky Batteries”) as novel privacy breach vectors.
• Deep learning detection of charge manipulation attacks, to safeguard smart charging mechanisms.
• Stronger standardization & regulation, e.g., NIST / national EV charging cybersecurity profiles (e.g. NIST IR 8473 for extreme fast charging).
• Cross-industry collaboration & threat intelligence sharing between OEMs, charger operators, utilities and cyber agencies.

As EV fleets and infrastructure scale, cybersecurity will no longer be a “nice to have” but a core pillar of trust, safety, and resilience.

Summary & Call to Awareness

EVs and their charging infrastructure offer immense opportunity in decarbonizing transport, but they also bring hidden cyber risks that deserve strong attention now — not later. From supply chain hacks to grid destabilization, the vulnerabilities are real and evolving.

Architectures like EVSOAR point toward a future where security intelligence lives at the edge (chargers) as well as in cloud/SOC layers, enabling faster and more localized responses. But to realize that future, manufacturers, infrastructure operators and users must adopt security-first mindsets and practices from design to operations.

If you’re working in the EV / charging space (OEM, operator, fleet, policy), now is the time to:

• Audit your threat surface
• Adopt security best practices
• Engage in collaborative threat intelligence
• Explore edge-centric security architectures
• Plan for a future where cyber & physical converge