VPTaaS: An AI-Driven Cybersecurity Framework for Connected Vehicles—Concept, Validation, and Feasibility Study

The rapid integration of connected technologies in modern vehicles has significantly enhanced functionality, efficiency, and user experience, but it has simultaneously introduced complex cybersecurity vulnerabilities. Traditional IT-centric security solutions fall short in addressing the dynamic and critical nature of threats to automotive systems. This paper presents Vehicle Penetration Test as a Service (VPTaaS), a conceptual framework designed to proactively identify, assess, and mitigate cybersecurity risks in connected vehicles. VPTaaS integrates AI-driven threat prediction, multimodal vulnerability analysis, real-time cyber-health monitoring, and manufacturer-agnostic penetration testing into a unified service offering. To validate the market demand and assess the feasibility of this approach, a structured survey involving 83 stakeholders - including vehicle owners, insurance representatives, service providers, and industry professionals - was conducted. Results indicate strong stakeholder awareness of vehicular cybersecurity threats ($79 \%$ $86 \%$) and a high preference ($86 \%-88 \%$) for proactive cybersecurity assessments. The technical framework is aligned with industry standards such as ISO 21434 and UNECE WP. 29 R155 & R156, emphasizing regulatory compliance and realworld applicability. The findings confirm the market readiness and technical viability of VPTaaS, highlighting its potential to enhance vehicle cybersecurity resilience, protect personal data, and support regulatory compliance. Future work will focus on prototype development, real-world pilot studies, and expansion to autonomous and V2X communication systems.