The small piece of hardware that keeps a connected car online is becoming a much bigger part of the automotive security conversation. Kigen has announced GSMA eUICC Security Assurance certification for its new automotive eSIM platform, combining the company’s eSIM operating system with Infineon’s TEGRION SLI22 automotive security controller. Kigen describes the product as the first eSA-certified automotive eSIM supporting the latest SGP.32 v1.3 IoT eSIM specification.
The timing is notable. Automakers are putting more vehicle functions online while regulators, researchers and consumers are paying closer attention to what happens to the enormous quantities of information those vehicles generate. Secure cellular credentials are only one piece of that puzzle, but the certification illustrates how connectivity itself is becoming a security-critical component of modern vehicle architecture.
Kigen Is Bringing the Latest IoT eSIM Standard Into Cars
Kigen announced the certification on September 23, saying its automotive eSIM combines its software with Infineon’s TEGRION SLI22 controller. The company says it is the industry’s first eSA-certified eSIM implementation supporting GSMA SGP.32 version 1.3. That specification is designed for remote provisioning and management of eSIMs in IoT devices, including equipment where a person may not be available to manually change a SIM or interact with a conventional screen. GSMA published SGP.32 v1.3 in May 2026 alongside the corresponding SGP.31 architecture specification.
That model has an obvious attraction for vehicles. A car can remain on the road for well over a decade while mobile networks, roaming agreements and connectivity providers evolve around it. An embedded SIM that can securely receive and manage network profiles offers manufacturers more flexibility than designing connectivity around a removable physical SIM. Kigen says automotive samples in the soldered MFF2 form factor are scheduled to become available to manufacturers beginning in October 2026.
GSMA Certification Is Significant, but Its Scope Matters
The certification should not be interpreted as a blanket security approval for an entire vehicle. GSMA’s eUICC Security Assurance program concentrates on the security of the eUICC hardware and software used to hold and manage mobile subscription profiles. The scheme uses a Common Criteria-based methodology intended to demonstrate resistance to sophisticated attacks and forms part of the broader GSMA compliance framework surrounding remote SIM provisioning. Other elements of that ecosystem address areas such as functional interoperability and security at manufacturing and subscription-management facilities.
That distinction becomes important in a vehicle containing dozens of electronic systems, external communication interfaces, smartphone connections and cloud services. A hardened eSIM can protect an important connectivity trust point without deciding what information an automaker collects after the cellular connection has been established. It also does not determine whether a mobile application is securely coded or whether location information is shared appropriately. In practical terms, the certification strengthens one foundational layer of the connected-car stack rather than certifying every layer above it.
SGP.32 Could Make Vehicle Connectivity Easier to Manage for Years
SGP.32 was created with large IoT deployments in mind. Instead of assuming that someone will physically handle every device, its architecture allows eSIM profiles to be remotely provisioned and managed. The latest v1.3 specification describes the architecture, interfaces and security functions used for remote eUICC management in network- or user-interface-constrained devices. Kigen says its implementation adds support for v1.3 capabilities including direct and indirect profile downloads, digital activation codes and emergency profile handling.
For an automaker, the operational implications can extend long after a vehicle leaves the assembly plant. Cars may cross borders, change owners and remain in service through several generations of cellular infrastructure. Fleets can be even more complicated, with thousands of vehicles operating in different telecommunications markets. Remote profile management gives manufacturers and connectivity providers another mechanism for maintaining service without physically replacing SIM cards across an entire fleet. The significance is less about making the vehicle visibly different to its driver and more about giving the infrastructure behind connected services greater flexibility over a long product life.
Automotive Security Now Has to Think Further Into the Future
The Infineon hardware underneath Kigen’s implementation highlights another challenge: automotive electronics can remain deployed much longer than typical consumer gadgets. The TEGRION SLI22 is an automotive security controller designed for uses including eSIM, telematics, V2X communications and vehicle access. Infineon says the controller has Common Criteria EAL6+ certification, AEC-Q100 automotive qualification and hardware support for post-quantum cryptographic algorithms including ML-KEM and ML-DSA. Its published specifications also cite typical data retention of 17 years.
Kigen is similarly emphasizing preparation for post-quantum cryptography, although it makes an important qualification: PQC is not currently part of the GSMA eSIM specifications involved in this certification. Instead, the company says its platform can let manufacturers experiment with hybrid key-establishment techniques combining established cryptography with quantum-resistant approaches. That does not mean quantum computers are about to compromise connected cars. It reflects a more basic automotive problem—hardware selected today may still be operating deep into the 2040s, making future security migration something engineers increasingly consider during current vehicle development.
Protecting the Connection Does Not Settle the Vehicle-Data Question
The security milestone arrives while authorities are paying much closer attention to what connected vehicles know about their occupants. In January 2026, the U.S. Federal Trade Commission finalized an order resolving allegations that General Motors and OnStar collected, used and sold precise geolocation and driving-behaviour information from millions of vehicles without adequately informing customers or obtaining appropriate affirmative consent. The order restricts certain data sharing and requires greater transparency and consumer choice surrounding connected-vehicle information.
Canada is examining similar issues from its own privacy perspective. In April 2026, Privacy Commissioner Philippe Dufresne told a parliamentary committee that modern connected vehicles can collect and transmit substantial quantities of information, including location history, driving behaviour and personal preferences. His office has also established a connected-cars working group with privacy regulators in Alberta, British Columbia and Quebec. That illustrates why eSIM security and data privacy cannot be treated as interchangeable. Securing the cellular identity can make unauthorized connectivity attacks harder; it does not by itself decide which data should be collected, where those data should travel or who should receive them.
The Attack Surface Extends Far Beyond the SIM
Transport Canada already treats automotive cybersecurity as a whole-vehicle and whole-ecosystem problem. Its guidance identifies risks across physical interfaces such as diagnostic and USB ports, wireless technologies including cellular, Bluetooth and Wi-Fi, and telematics systems capable of handling personal information. The department’s cybersecurity strategy therefore encourages risk management across the vehicle lifecycle—from design and production through deployment, repair, maintenance and the aftermarket. That broader approach reflects how dramatically vehicle architecture has changed.
Recent academic work reaches a similar conclusion. A 2026 review of 77 studies on automotive telematics security examined threats and protections across in-vehicle networks, vehicle-to-everything communications and cloud or IoT systems. Its authors argued that security cannot be treated as a collection of isolated technical problems because vehicle information continually moves between those layers. A perfectly protected cellular credential would offer limited comfort if another interface exposed a cloud account, an insecure application allowed unauthorized commands, or vulnerable software opened a path deeper into the vehicle. The defensive model increasingly has to be layered.
Automakers Are Moving From Connectivity to Governed Connectivity
For years, putting a vehicle online was largely presented as a feature story: navigation became live, software could be updated remotely, apps could communicate with parked cars and emergency systems could contact outside services. The next stage is more complicated. Manufacturers now have to demonstrate that those connections can be authenticated, updated, monitored and governed throughout vehicles that may remain active for 10, 15 or more years. International rules and guidance are also pushing manufacturers toward lifecycle cybersecurity, while regulators are placing greater emphasis on access to and handling of vehicle-generated information.
That makes certifications such as GSMA eSA valuable, but most useful when viewed as one verifiable piece of a much larger security program. Automakers still have to address software updates, backend infrastructure, supply-chain components, application security, consumer consent and data retention. Kigen’s latest eSIM milestone shows how deeply telecommunications security has become embedded in automotive engineering. The bigger shift is that simply keeping a car connected is no longer enough. The industry increasingly has to explain how that connection remains secure—and what happens to the data travelling through it.
