The boundaries of the vehicle are expanding as connected services, software-defined architectures, and AI-powered applications become more integrated into vehicles. This growing connectivity extends data exchange beyond the vehicle itself to cloud platforms (V2C), infrastructure (V2I), other vehicles (V2V), and connected devices.
Among these connection points, EV charging infrastructure — particularly Electric Vehicle Supply Equipment (EVSE) — represents a particularly critical interface. It connects directly with the vehicle while simultaneously communicating with backend and network infrastructure, placing it at the convergence of mobility, digital, financial, and energy systems. As these systems become more closely connected, EV charging infrastructure becomes an increasingly important part of the automotive cybersecurity landscape.
This article examines how security can be established and maintained across EV charging infrastructure — from standards and certification that provide a foundation for trusted communication to an integrated approach for continuous security management.
EV Charging Infrastructure Becoming a Cybersecurity Target
Recent cybersecurity incidents across the automotive ecosystem demonstrate how growing connectivity is accompanied by an expanding cybersecurity attack surface. According to Upstream Security’s 2026 Global Automotive and Smart Mobility Cybersecurity Report (Link), 494 publicly reported automotive and smart mobility cybersecurity incidents were analyzed in 2025. Of these incidents, 71% were attributed to black hat threat actors, up from 65% in 2024, while 20% were classified as massive-scale incidents.
The findings also highlight the growing exposure of connected systems beyond the vehicle. Telematics and cloud systems accounted for 67% of attack vectors, demonstrating how external connectivity has become an increasingly significant part of the automotive threat landscape. The impact also extends beyond individual systems, with 34% resulting in service or business disruptions.
For EV charging infrastructure, these risks take on broader significance due to the multiple critical systems interconnected within the charging environment. A vulnerability at one point could potentially expose personal, authentication, or payment information, or lead to the manipulation and disruption of individual chargers and charging networks.
The same technology pathways that enable EV charging infrastructure to connect vehicles with digital services, payment systems, and energy infrastructure also introduce multiple points of cybersecurity exposure. Protecting this environment therefore requires securing not only individual components, but also the communications and interactions between them.
Establishing Trusted Communications across EV Charging Infrastructure
As cybersecurity risks extend across the EV charging ecosystem, secure authentication and communication are essential to interactions among vehicles, charging infrastructure, and backend systems. Two key standards support these interactions: ISO 15118 and Open Charge Point Protocol (OCPP).
- ISO 15118: Communication between the electric vehicle (EV) and Electric Vehicle Supply Equipment (EVSE)
- Open Charge Point Protocol (OCPP): Communication between the Electric Vehicle Supply Equipment (EVSE) and Charging Station Management System (CSMS)
The two standards address different but complementary parts of the same charging workflow, with communications touching up EV charging (EVSE) and newer OCPP versions increasing support for ISO 15118 functionality.
ISO 15118-2, ISO 15118-20
The ISO 15118 standard series defines communication between electric vehicles and EV charging equipment. A key capability enabled by the standard is Plug&Charge(PnC), which uses certification-based authentication to allow a vehicle to be automatically identified and authenticated when connected to compatible charging infrastructure.
The standard has continued to evolve alongside EV charging technologies. ISO 15118-2 (Link), published in 2014, specifies network and application protocol requirements from the Vehicle-to-Grid (V2G) communication interface. ISO 15118-20 (Link), published in 2020, expands the scope of the standard with additional charging methods and communication requirements for bidirectional power transfer, while also supporting wireless communication and automatic connection devices.
Open Charge Point Protocol (OCPP) 1.6, 2.0.1, 2.1
While ISO 15118 covers communication between the vehicle and EVSE, OCPP (Link) defines communication between the EVSE and Charging Station Management System (CSMS). This communication layer enables remote operation and management of charging infrastructure, including charging status and transaction management, remote monitoring and configuration, and device and firmware management.
OCPP has similarly evolved alongside the charging ecosystem, from OCPP 1.6, 2.0.1 and 2.1 (Link), introducing strengthened security capabilities, expanded smart charging functionality, and closer integration with ISO 15118. OCPP 2.0.1 introduced native support for ISO 15118 Plug&Charge, including certificate management and authorization, while OCPP 2.1 further extends this relationship through support for ISO 15118-20 and bidirectional power transfer.
Beyond Protocols and Certification: Importance of Operational Security
While these standards establish trusted communication across the charging workflow, deployed infrastructure remains exposed to evolving cybersecurity risks, including software vulnerabilities, malicious commands, unauthorized access, physical tampering, and unpatched software and firmware. Addressing these risks requires ongoing security management and visibility across the charging environment.
To address these operational security needs, AUTOCRYPT’s Electric Vehicle Supply Equipment Security Operations Center (EVSE SOC) (Link) brings together four security capabilities — EVSE Intrusion Detection System (IDS), SBOM/CVE Tracking, Evidence Management, and Security Monitoring — within an integrated platform for deployed EV charging environments.
(1) EVSE Intrusion Detection System (IDS)
- Analyzes charger events and protocol anomalies
- Detects abnormal commands and behavior
- Identifies authentication failures, configuration changes, and tamper events
(2) Software Bill of Materials (SBOM), Common Vulnerabilities and Exposures (CVE) Tracking
- Collects and manages SBOM, CVE information
- Assesses vulnerability impact by charger model
- Tracks patch status, prioritizes remediation
(3) Security Evidence Management
- Collects and preserves security activity records
- Maintains evidence of incidents, updates, certificate activities
- Automates reporting for regulatory compliance and audits
(4) Security Monitoring
- Collects and correlates security events in real-time
- Monitors authentication, configuration, tamper, firmware status
Providing these four capabilities within an integrated platform, EVSE SOC extends the trust established through secure communication into continuous security management throughout operation.
Maintaining Trust Throughout the EV Charging Lifecycle
As EV charging becomes increasingly connected and bidirectional, cybersecurity must extend beyond individual vehicles and chargers to the broader infrastructure that connects them. Maintaining trust therefore requires cybersecurity to be considered throughout the EV charging lifecycle — from design and deployment to operation, monitoring, and response.
AUTOCRYPT’s EVSE SOC supports this approach by integrating threat detection, vulnerability management, security evidence, and continuous monitoring across deployed charging environments. As mobility continues to evolve toward increasingly connected and AI-driven systems, maintaining trust across the infrastructure that supports them will become an increasingly important part of automotive cybersecurity.
Additional Resources
- EV Charging Solutions: https://autocrypt.io/solutions/ev-charging/
- AutoCrypt PnC: https://autocrypt.io/products/pnc/
- EVIQ Platform: https://autocrypt.io/solutions/eviq/
