Upstream Platform

Regarding my main use case, I can say it is not a traditional IT security tool; it is purpose-built for vehicle fleets and mobility platforms. It includes features that improve specific workflows, such as vehicle and fleet cybersecurity, automotive-focused XDR , agentless architecture, real-time monitoring using telematics and API data, AI and ML-based anomaly detection, digital twin technologies, API and mobility service security, threat intelligence for the automotive ecosystem, and a Vehicle Security Operation Center (V-SOC).

An example of how my team uses Upstream Security  in our day-to-day work is as a specialized cybersecurity platform for connected vehicles with an e-mobility ecosystem providing real-time detection and response using vehicle and IoT data.

Out of the features I mentioned, such as the agentless architecture, digital twin technology, and Vehicle Security Operations Center , I do not have a specific favorite because when using tools Upstream Security, I must combine all those features, and each and every feature I mentioned is mandatory to be secure in the vehicle domain.

I would add that ecosystem integration can be a good area for improvement. It is strong within the automotive ecosystem but limited outside it, as integration with traditional enterprise security tools, SIEM , or XDR platforms may require customization.

The core problem that OEMs face, especially automotive companies who have to take care of cybersecurity for their connected car fleets and vehicles and mobility ecosystem, is securing connected vehicles and mobility ecosystems for cybersecurity threats and misuse. Upstream Security  detects threats using existing vehicle telemetry, APIs, telematics, dealers, and mobility data. It helped us monitor fleets at scale, almost in a real-time basis and supported our cybersecurity compliance requirements. There is a UN regulation R155 and ISO 21434 that we needed to meet.

The number one feature of Upstream Security , based on their technical architecture, is how to inject and analyze data. Data comes in from all different sources, and we needed near real-time detection and anomaly detection within the platform, plus rule-based intelligence. The integration of telematics, over the air updates, APIs, diagnostics, and dealer data is the most important aspect that we used Upstream Security to ingest that data from various different fields and eventually analyze data for us.

Upstream Security is very important for organizations, especially OEMs. If there is a vehicle security operation center which has to be set up for 24 into 7 monitoring of the fleets, if we want to connect it to mobility, all of this involves integration of telematics, API, diagnostic, dealer data, and managing compliance at the end of the day is extremely important. This has really helped us as an OEM to secure connected fleet and meet regulatory requirements, which is eventually very important for us to be able to sell any data to the end customer.

Scalability was very important and Upstream Security was able to meet our requirement. They have a very good machine learning-based detection intelligence. The overheads are potentially operationally very minimal because they have an agentless working model. The cloud-based and agentless architecture works out extremely well for our organization, as we were looking for something on those lines. It has AI and machine learning powered detection and provides GenAI assisted investigations.

In addition to regulatory compliance support, the biggest strengths in summary are that it is cloud-native, agentless, an automotive extended detection and response platform, AI-driven anomaly detection, and digital twin-based visibility. It has the ability to secure our connected vehicle ecosystem at scale and supports our compliance requirements.

From the perspective of what we are referring to, the first thing that we had in our mind is that because of the connected car ecosystem, there are a lot of threats. The company has really benefited from the implementation of Upstream Security by reducing the business risk. From the perspective of regulatory readiness, we needed more than just documentation—we needed operational support and continuous monitoring that is aligned to UN regulation 155 and the ISO standard of 21434. Faster deployment occurred over time, as the start was slow but eventually there is less operational friction and the deployment is faster as time progresses. It has provided visibility through a 24 to 7 vehicle SOC, and we do not have siloed vehicle monitoring anymore. We are using Upstream Security for 24 to 7 fleet visibility. It provides fleet-wide visibility for connected vehicles, takes care of business risks, has helped us with compliance readiness, reduced time for investigating anomalies, and improved our detection capability of any kind of fraud or misuse. Customer impacting incidents have extremely come down.

Before and after analysis shows that mean time to detect anomalies in vehicles came down significantly. It is not only mean time to detect but mean time to respond as well to incidents and containing the incident that came down as well. Fleet  visibility coverage went on to become significantly higher percentage connected vehicles being monitored. Cost avoidance occurred because of proactive detection, defects were caught early, and warranty claim reduction came down. There are operational ROIs, warranty ROIs, compliance ROIs, deployment and operational ROIs, and business risk ROIs. We could measure cost avoidance, efficiency gains, revenue protection, and various things on which we could measure the ROI.

Areas of improvement or enhancement that could be considered are probably a few. Upstream Security can provide deeper native visibility in ECU level behavior. Reduction in false positives is possible because even though the AI and ML detections are very powerful, sometimes security teams want more explainability, and alert fatigue can occur, which is the case with most platforms, nothing very specific to Upstream Security. There could be strong root cause correlation across IT, vehicle, cloud, more improved attack path mapping across telemetrics, and more predictive security. If there is one thing that we would possibly want Upstream Security to look at further enhancing, it is moving beyond detection towards analysis and analytics going forward. This is what most of the OEMs would be looking for.

Upstream Security is a great platform and nothing is apparently or fundamentally missing. We expect more visibility, more reduction of false positives, better explainability, simpler dashboards, stronger root cause analysis, strong ecosystem integration, and so forth. This is the case with every platform, and there is no platform that would rate as 10 on 10 because there is always scope for improvement. Our rating of nine marks all the boxes, but the continuous improvement aspect has taken away one out of that number 10.

I have been using Upstream Security at Nissan Motor for over two years.

Upstream Security has proven to be very stable. The first year was not as business impact focused and ROI driven as what is possibly the third year. The company itself is quite stable. We have been using Upstream Security for all practical use cases for our organization. The strategic investors in Upstream Security are also related to protecting millions of vehicles. Not only is the long-term resilience of the company Upstream Security itself good, but they have been equally good for us.

Scalability was able to meet our requirement in all aspects. Upstream Security has very good machine learning-based detection intelligence. The overheads are potentially operationally very minimal because they have an agentless working model.

Upstream Security's customer support does not require too much effort in order to make sure that we get the support when we require it. Because this is an enterprise software, the support that we have taken from Upstream Security includes a technical account manager who is named and associated with us. We have priority support where we have SLAs with respect to commitment on response times and resolution times. They have a defined escalation model and coverage across the globe in India, Europe, and the US. The SLAs are defined, the responsiveness is good, and the support quality has not been lacking. Our rating for this aspect is nine again.

We did not make a switch, and we did not have a solution before. We were looking at getting a solution and chose Upstream Security as our choice of solution. This was not a replacement, but we could look at choosing Upstream Security for all practical purposes. We also evaluated Harman Shield and Argus Cyber security. Argus and Harman Shield were the other two comparatives that we were comparing Upstream Security against, and we chose Upstream Security.

The setup was not straightforward. It takes time to be able to understand how the agentless model works and how the cloud-native deployment possibly works. There is a lot of handholding that is required before we start to implement and use Upstream Security for all practical purposes. There was a steep learning curve that was involved, but the help from Upstream came in extremely handy. There are limitations as well that needed to be understood before we could implement telemetry data into Upstream Security platform. Understanding how the platform works, how the agentless systems work, and how the cloud-based detection happens with the existing mobility data that we have did not make this entire experience at the start extremely smooth. It took a lot of sitting down with the experts and making a real good understanding of how the system works and how the integration works so that we became independent to a large extent, but we still have the support and maintenance from Upstream Security working for us.

In terms of pricing and licensing, we were able to get not a one-year deal but a five-year deal with Upstream Security. We have a long-term engagement and this gives us a better discounting mechanism as well for Upstream Security. As far as pricing is concerned, the pricing is quite comparative and is on the highest side. The basic model is that platform licensing is annual subscription over a period of five years. It manages all our fleets and vehicles and has data volumes. Setup and onboarding cost was one time for professional services for integration and telemetry normalization. We also have a managed SOC that is managed internally, so we are not taking the support of Upstream Security. We have in-house analysts who do the monitoring 24 to 7. Slowly and slowly, we also looked at getting more API security related modules and detection related modules from Upstream Security. Our licensing is therefore very aligned to fleet coverage, telemetry, integration, and use cases. It is not dependent on endpoint agents. Upstream Security was made known as to how many vehicles we would be talking of or the telemetric volume possibly is. As far as the setup cost is concerned, the setup cost includes data onboarding, ingestion mapping, money for and effort for detection tuning, baselining, integration with the various other platforms like SIEM , SOAR , ticketing, compliance workflows, training, and runbooks.

We purchased this through one of our vendor partners or a consulting partner, and they were the ones who recommended it.

Mean time to detect came down significantly. Time to detect the anomalies in vehicles came down significantly, and mean time to respond as well to incidents and containing the incident that came down as well. Fleet  visibility coverage went on to become significantly higher percentage connected vehicles being monitored. Cost avoidance also occurred because of proactive detection, defects were caught early, and warranty claim reduction came down. There are operational ROIs, warranty ROIs, compliance ROIs, deployment and operational ROIs, and business risk ROIs. We could measure cost avoidance, efficiency gains, revenue protection, and this actually sums up various things on which we could measure the ROI.

The setup cost has been reduced considerably because we are using a cloud. Setup and onboarding cost was one time for professional services for integration and telemetry normalization. The setup cost includes data onboarding, ingestion mapping, money for and effort for detection tuning, baselining, integration with the various other platforms like SIEM , SOAR , ticketing, compliance workflows, training, and runbooks.

We did not make a switch, and we did not have a solution before. We were looking at getting a solution and chose Upstream Security as our choice of solution. This was not a replacement. We evaluated Harman Shield and Argus Cyber security as the other two comparatives that we were comparing Upstream Security against, and we chose Upstream Security.

Upstream Security is both cloud-based and agentless in architecture, which works out extremely well for our organization, as we were looking for something on those lines. It has AI and machine learning powered detection and provides GenAI assisted investigations. In addition to regulatory compliance support, the biggest strengths are that it is cloud-native, agentless, an automotive extended detection and response platform, AI-driven anomaly detection, and digital twin-based visibility. It has the ability to secure our connected vehicle ecosystem at scale and supports our compliance requirements.

Mean time to detect anomalies in vehicles came down significantly. It is not only mean time to detect but mean time to respond as well to incidents and containing the incident that came down as well. Fleet visibility coverage went on to become significantly higher percentage connected vehicles being monitored. Cost avoidance occurred because of proactive detection, defects were caught early, and warranty claim reduction came down. There are operational ROIs, warranty ROIs, compliance ROIs, deployment and operational ROIs, and business risk ROIs. We could measure cost avoidance, efficiency gains, and revenue protection, and this actually sums up various things on which we could measure the ROI. Our overall rating for Upstream Security is nine out of ten.