Enhanced TARA model for heavy-duty vehicles using ISO/SAE 21434 and Fuzzy Analytic Hierarchy Process (FAHP)

• An automated Threat Analysis and Risk Assessment (TARA) model for heavy-duty vehicles, based on ISO/SAE 21434, is proposed. • FAHP, based on expert opinion, is utilized for weight assignment to criteria of feasibility and risk severity for passenger transport and commercial freight vehicles. • Attackers’ knowledge of the system and extended windows of opportunity play a crucial role in the feasibility assessment of heavy-duty vehicles. In recent years, the automotive industry has increasingly recognized the importance of Threat Analysis and Risk Assessment (TARA) as a critical first step in cybersecurity planning. While standards such as ISO/SAE 21,434 provide a structured framework, they are primarily designed for light-duty vehicles and do not fully address the unique characteristics, operational environments, and vulnerabilities of heavy-duty (HD) commercial vehicles—despite their crucial role in public transportation, freight systems, and the supply chain. This study addresses that gap by customizing the ISO/SAE 21,434 risk assessment model specifically for HD vehicles. It employs a Multi-Criteria Decision-Making (MCDM) methodology to assign weights to the severity and feasibility criteria using expert input through the Fuzzy Analytic Hierarchy Process (FAHP). Expert-driven pairwise comparisons were conducted to evaluate the relative importance of each criterion separately for severity and feasibility assessment. The resulting model provides a tailored and robust approach for analyzing and assessing cybersecurity threats in HD vehicles, reflecting their distinct needs and risk profiles.