The new battle for trust in the vehicle network: Why MACsec and MKA are becoming an automotive imperative

A clear messages that also emerged from discussions at the Automotive Ethernet Congress (AEC) was that automotive Ethernet has crossed an important threshold. It is no longer simply replacing legacy networks or enabling higher bandwidth applications. It is becoming the foundational communication infrastructure of the Software-Defined Vehicle (SDV).

And when infrastructure becomes foundational, security assumptions must change.

As zonal architectures, centralized compute platforms, and service-oriented communication models mature, cybersecurity concerns are moving decisively down the stack. The question is no longer only how to protect applications and ECUs, but how to establish trust in the underlying in-vehicle network itself.

This is where MACsec and MKA (MACsec Key Agreement) are moving from interesting technologies to architectural necessities.

TSN (Time-Sensitive Networking) is also a major focus area. As deterministic Ethernet becomes central to SDV architectures, security mechanisms must preserve low latency, predictable timing, and system performance. In that context, MACsec is no longer being discussed as a niche security feature or a technology borrowed from enterprise networking. It is increasingly viewed as a practical enabler for next-generation automotive Ethernet deployments.

Traditional vehicle networks relied heavily on segmentation, gateway boundaries, and assumptions around physical access. Zonal architectures fundamentally change that model. As safety, control, infotainment, diagnostics, and software services increasingly share high-speed Ethernet backbones, the consequences of compromised internal communications become far more significant.

Internal traffic can no longer be assumed trustworthy simply because it remains inside the vehicle. This is where MACsec becomes strategically important. By securing communication directly at Layer 2, it helps establish trust within the vehicle network architecture itself. 

Traffic is protected while in transit between connected nodes, independent of the applications running above it. The network becomes trustworthy by design rather than relying entirely on higher-layer protections and increasingly complex overlays.

What makes this especially relevant in automotive is that real-time performance requirements still dominate decision-making. Security only works in production vehicle architectures if it respects predictable timing, controlled latency, and real-time communication requirements. Modern hardware-accelerated MACsec implementations are increasingly viewed as compatible with demanding automotive real-time requirements. Security is no longer seen solely as a performance trade-off. Properly implemented, it can become an enabler of architectural simplification and system consolidation.

But if MACsec is the visible part of the story, MKA may be the more critical one.

The challenge is not the cryptography. The challenge is operationalizing trust across the entire vehicle lifecycle: provisioning, authentication, rekeying, sleep and wake transitions, software updates, service workflows, ECU replacement, and long-term maintainability.

Unlike enterprise environments, vehicles are manufactured at scale, serviced in the field, and expected to remain operational for more than a decade. That makes MKA far more than a supporting protocol. It becomes the trust management control plane for Ethernet-based vehicle networks.

From an ecosystem perspective, this becomes even more important as vehicles move toward heterogeneous network architectures. The discussion around MACsec highlights how Layer 2 Ethernet traffic can be protected, but the real shift is toward making security operationally consistent across the entire vehicle network stack, not just a single protocol domain.

This is ultimately a trust management challenge as much as a networking challenge. Security mechanisms may differ across Ethernet, CAN, LIN, or future communication technologies, but OEMs increasingly need consistent approaches to provisioning, authentication, key management, lifecycle operations, and interoperability across all of them.

This discussion also aligns with broader industry developments. While CANsec is not directly related to MACsec at the protocol level, it reflects the same architectural direction: extending scalable trust models into traditionally less protected in-vehicle networks.

Together, these developments point toward a common industry objective with implications across the value chain:

• Lifecycle-driven trust management

• Consistent provisioning and key handling

• Reduced security fragmentation across Ethernet and legacy networks

• Greater interoperability across the supplier ecosystem

For OEMs, this supports security architectures that scale with vehicle topology rather than being assembled feature by feature.

For Tier 1 suppliers, it raises expectations beyond isolated security functions toward interoperability, lifecycle resilience, and maintainable trust relationships.

For semiconductor vendors, it increases the strategic importance of embedded link-layer security capabilities in switches, PHYs, and controllers as multi-gig automotive Ethernet adoption accelerates.

Another important observation is that the boundary between cybersecurity and system robustness is becoming increasingly blurred. As vehicles become more centralized and software-defined, secure communication and dependable communication are no longer separate concerns. 

Unauthenticated or untrusted traffic is no longer just a cybersecurity issue. It is an architectural risk. Perhaps one of the most important takeaway from AEC 2026 is that security is becoming infrastructure.

The significance of MACsec and MKA is not that the cryptography is new. Their importance is growing because vehicle networks have become too central, too consolidated, and too software-driven to remain implicitly trusted.

From an OEM perspective, Ethernet security can no longer be treated as a loosely interpreted feature set. It requires standards-based, interoperable implementations that behave consistently under real production conditions.

This shifts the primary risk away from the cryptographic algorithms themselves and toward profiling, configuration, startup behavior, key management, and cross-vendor interoperability.

The priority is becoming increasingly clear: support automotive-profiled MACsec and MKA implementations aligned with the TC17 automotive MACsec/MKA profiling initiative and built on IEEE 802.1 standards. Security must be dependable not only in theory, but across real vehicle programs and supplier ecosystems. 

“The future conversation will not be about whether security should be added to the network. It will be about which security mechanisms are robust enough, scalable enough, and lifecycle-ready enough to become part of the network's foundation." Fatemeh Faraji, SBD Automotive, Senior Product Owner

How SBD can help

SBD Automotive can help benchmark your position against the wider industry and identify where action is needed most. To explore how these trends impact your strategy, architecture and supplier roadmap, get in touch with SBD Automotive for a deeper discussion. Email info@sbdautomotive.com