It depends on the scope. ECU-level testing of individual electronic control units, telematics unit firmware analysis, and backend API testing can be conducted without a physical vehicle using ECU benches and provided firmware images. Full vehicle-level testing including CAN bus injection across multiple domains, keyless entry relay attack testing, TPMS radio frequency testing, and OBD-II port exploitation requires a physical vehicle or a hardware-in-the-loop test rig. Qualysec scopes each engagement to match the available test environment and the regulatory evidence requirements of the client.

TARA stands for Threat Analysis and Risk Assessment, the core risk assessment methodology required by ISO/SAE 21434. It identifies vehicle assets, defines threat scenarios, assesses attack feasibility and impact, and assigns risk ratings that drive security control selection. Qualysec's penetration test validates the TARA by attempting to exploit the highest-risk attack paths identified in the threat model. Qualysec can also assist in conducting or reviewing the TARA prior to testing.

Qualysec tests all major vehicle system categories depending on scope: powertrain and chassis ECUs via CAN bus injection, infotainment and connectivity systems via Bluetooth, Wi-Fi, and USB interface testing, telematics control units via cellular API and firmware analysis, body control modules via LIN bus testing, ADAS and safety ECUs via CAN injection and sensor spoofing, keyless entry and PEPS systems via RF protocol testing, TPMS sensors via radio frequency spoofing, and OTA update pipeline from backend server to ECU acceptance. Scope is agreed based on the client's TARA, vehicle architecture, and regulatory evidence requirements.

An automotive penetration test at Qualysec takes two to six weeks depending on the scope. A focused ECU-level firmware and API assessment runs faster than a full vehicle-level engagement covering in-vehicle networks, wireless interfaces, backend systems, and OTA pipeline simultaneously. The final report is delivered within five business days of testing completion and includes severity-rated findings mapped to ISO/SAE 21434 attack categories, proof-of-concept exploitation evidence, remediation guidance, and a compliance mapping section.

Automotive penetration testing cost depends on the scope of systems tested, whether physical vehicle access is required, the number of ECUs in scope, regulatory frameworks the report must address, and whether TARA review or supply chain assessment is included. Qualysec provides a fixed-price scoped quote after an initial technical call covering vehicle architecture, testing objectives, and regulatory evidence requirements. All deliverables including the re-test and CSMS-formatted report are included in the base cost.