The ‘Active Defense’ Doctrine: Moving Beyond Compliance

As we move through 2026, the landscape of cybercrime and regulation has fundamentally shifted. The defensive posture that worked five years ago is not just outdated; it is dangerous. The CDK Global attack in June 2024, which crippled approximately 15,000 dealerships through a single ransomware strike, proved that the automotive retail industry is a high-value target. Active defense is no longer a luxury reserved for enterprise organizations. It is the standard.

The Threat Landscape for Auto Dealers

Dealerships hold a uniquely valuable combination of data: Social Security numbers, credit applications, bank account details, driver’s licenses, and income verification documents. This makes them attractive targets for both ransomware operators and data theft groups. The BlackSuit group that hit CDK Global demonstrated that threat actors understand the automotive supply chain and know that disrupting a single critical vendor can generate massive ransom leverage.

Beyond targeted attacks, dealers face the same threats as every small-to-mid business: business email compromise, phishing campaigns targeting F&I departments, credential stuffing against web-facing portals, and exploitation of unpatched VPN appliances that provide remote access to the DMS.

What is Active Defense?

Active defense is the transition from a passive, reactive posture to a proactive, hunting posture.

• Passive: You have a firewall and wait for it to alert you.
• Active: You assume you are already breached and use threat hunting to find hidden attackers.
• Passive: You do a penetration test once a year because the regulation says so.
• Active: You conduct continuous security validation to find weaknesses the moment they appear.

The core principle is “assume breach.” Microsoft and CISA both advocate this model. It means you operate under the assumption that an attacker is already inside your network and design your detection, segmentation, and response capabilities accordingly.

The Dwell Time Problem

Mandiant’s M-Trends 2024 report found that the global median dwell time, the period an attacker operates inside a network before detection, is 10 days. For ransomware specifically, it drops to around 5 days because the attacker eventually announces themselves by encrypting your data. But for data theft without ransomware, attackers can remain hidden for months.

IBM’s reporting puts the mean time to identify a breach at 194 days for non-ransomware incidents. That is over six months of an attacker quietly exfiltrating customer financial records before anyone notices. Active defense exists to close that gap.

Threat Hunting and SIEM

Threat hunting is the practice of proactively searching for indicators of compromise (IOCs) and suspicious behavioral patterns within your environment. It requires:

• A SIEM (Security Information and Event Management) platform that aggregates logs from your firewall, endpoints, DMS, email gateway, and identity provider
• Behavioral analytics that flag anomalies: unusual login times, bulk data exports, lateral movement between systems, privilege escalation attempts
• Trained analysts who investigate alerts and correlate them against known threat intelligence

The MITRE ATT&CK framework provides a structured taxonomy of attacker tactics and techniques. For a dealership, the most relevant techniques include initial access via phishing (T1566), credential theft via brute force or stuffing (T1110), lateral movement to the DMS or F&I systems (T1021), and data exfiltration (T1041). Mapping your detection capabilities against ATT&CK reveals where your blind spots are.

Continuous Security Validation

Annual penetration testing is necessary but insufficient. Continuous Security Validation (CSV) uses Breach and Attack Simulation (BAS) platforms to automatically test your controls against real attack scenarios on an ongoing basis. These tools simulate phishing, lateral movement, data exfiltration, and ransomware execution paths to verify that your firewalls, EDR, and SIEM are actually detecting and blocking threats in real time.

This is the difference between checking your locks once a year and having a security system that tests itself every day.

Why Traditional Perimeter Security Fails

The dealership network perimeter dissolved years ago. Remote DMS access, cloud-based CRM platforms, third-party F&I integrations, and vendor VPN connections all create pathways that bypass the traditional firewall. VPN appliance vulnerabilities have been among the most exploited attack vectors in 2024 and 2025, with CISA repeatedly adding VPN-related CVEs to their Known Exploited Vulnerabilities catalog.

Zero Trust Architecture addresses this by eliminating implicit trust. Every user, device, and connection must be verified before accessing any resource, regardless of whether it originates inside or outside the network. For a dealership, this means: MFA on every system (as required by 16 CFR 314.4(c)(5)), network segmentation between the showroom, service, F&I, and back-office systems, least-privilege access controls, and continuous verification of device posture.

The FTC’s Implicit Active Monitoring Standard

The Safeguards Rule does not use the phrase “active defense,” but the requirements point directly to it. The rule mandates continuous monitoring and testing of your safeguards, periodic risk assessment updates, and incident detection and response capabilities. A passive security posture, one that waits for an alert or an annual test, does not satisfy these requirements in a threat environment where attackers move in days, not months.

CISA’s Shields Up Guidance

CISA’s “Shields Up” campaign, launched in 2022 and still active, provides a practical framework for organizations of all sizes. The four pillars are: reduce the likelihood of intrusion (MFA, patching known exploited vulnerabilities), detect intrusions quickly (robust logging, network monitoring), prepare for incident response (crisis teams, tabletop exercises), and maximize resilience (isolated backups, tested recovery procedures). Every recommendation maps to a Safeguards Rule requirement.

Threat Intelligence for Dealers

The Automotive Information Sharing and Analysis Center (Auto-ISAC) exists as an industry body for sharing threat intelligence and best practices. While it primarily serves OEMs and Tier 1 suppliers, its published best practice guides on incident response and risk management are relevant to dealerships. Beyond Auto-ISAC, dealers should subscribe to CISA alerts and ensure their security provider monitors the Known Exploited Vulnerabilities (KEV) catalog for vulnerabilities affecting their specific technology stack.

The Business Case

IBM reports that the average cost of a data breach for organizations with fewer than 500 employees is $3.31 million. Sophos data shows average ransomware recovery costs (excluding the ransom payment itself) at $2.73 million in 2024. Compare that to the annual cost of a managed active defense program, which for a mid-size dealership typically runs between $3,000 and $8,000 per month.

The math is straightforward. A year of active defense costs less than a week of ransomware recovery.

The Future of FTCSafeguards

Compliance is a snapshot in time; security is a constant state of motion. The FTC Safeguards Rule was designed to force businesses to think about security. The Active Defense Doctrine is how you actually achieve it. Do not ask if you are compliant. Ask if you are ready to detect, contain, and respond to an attack in progress. Because the threat actors already know where the dealerships are.