Twenty years ago, automotive connectivity was about horsepower. Today, it’s about whether an eSIM architecture designed to run for 15+ years can withstand a quantum-computing threat that doesn’t exist yet.

For most of the automotive industry’s history, connectivity was an afterthought – a feature added to sell a car, not a system anyone expected to still be running fifteen years later. That’s no longer true, and the shift explains why Tele2 IoT increasingly talks about SIM security in the same breath as automotive strategy.

At the Tele2 IoT Talks Paris event, Gianni Uglietti, representing IDEMIA Secure Transactions (IST), Tele2 IoT’s SIM technology partner, whose backend platforms already manage 80+ million vehicles worldwide, opened with the industry’s own timeline of what mattered.

“Twenty years ago, we worried about horsepower.

Ten years ago we started worrying about connectivity. Today, we worry about software.”

That shift changes the SIM’s job description entirely. “A connected car is something that carmakers ship,” Gianni said. “A software-defined vehicle is something that carmakers must maintain and operate – not for two years, not for five years, but for more than 15 years.”

Eight of the world’s top ten carmakers already run on IDEMIA’s connectivity, which means the question of how to secure a 15-year-old piece of software running inside a moving vehicle isn’t hypothetical. It’s a live operating requirement.

Three Requirements for Vehicle Connectivity Architecture

Gianni framed the challenge as three requirements that most current vehicle connectivity architectures only partly meet:

• Availability: The connection has to work everywhere, at scale
• Agility: It has to evolve across the vehicle’s entire operating life, not just at launch
• Survivability: It has to stay secure against threats, including quantum computing

Most fleets today run on eSIM M2M (SGP.02), the current industry standard: solid on availability, but, in his words, never designed with agility or the coming quantum threat in mind.

IFPP: Vehicle Connectivity as Software

The fix IST is furthest along on is called In-Factory Profile Provisioning (IFPP) – injecting a carrier’s SIM profile into a vehicle digitally, at the point of manufacture, instead of shipping a physical SIM and locking in a connectivity decision months in advance.

“We are able to decouple hardware from software,” Gianni explained. Carrier connectivity becomes “another piece of software which is injected in the vehicle end of line,” alongside whatever else the carmaker is deploying on its factory floor, including private 5G.

Tele2 IoT and IST unveiled the first quantum-safe IFPP version of this at Mobile World Congress Barcelona earlier this year. He described it on stage as “it’s not a demo… but a real implementation,” which is already available for carmakers to trial.

Why Carmakers Can’t Wait on Quantum-Safe eSIM Security

Quantum-safe matters now, not later, because of a timeline problem rather than a hypothetical one.

Current cryptography, which protects eSIM communications, vehicle-to-cloud (V2C) connections, and authentication, is breakable by a sufficiently powerful quantum computer.

Large-scale quantum computers don’t exist yet, but the threat is accelerating faster than expected: NIST has already standardised post-quantum algorithms, and Google and Apple are urging readiness by 2029 – well ahead of NIST’s 2030–2035 migration timeline.

For a carmaker building a vehicle today that’s still on the road in 2040, this isn’t a future problem to schedule around – it’s a decision embedded in this year’s connectivity architecture. Gianni put the business exposure bluntly: “carmakers who get this wrong face recalls, liability, class actions, and revenue risk”, what he called the “one billion-dollar time bomb.”

Three Questions Every Automotive Connectivity Strategy Must Answer

Quantum-safe eSIM architecture isn’t a side conversation in an automotive connectivity strategy – it’s the layer everything else sits on.

IST handles SIM and profile security, Tele2 IoT provides the managed connectivity and roaming – a platform layer like Cisco’s IoT Control Center ties it together operationally. A weakness in any one of those pieces becomes a fleet-wide liability question, not a single vendor’s problem.

Gianni closed with three questions that determine whether a connected device is actually built to last:

1. Have you started the move to SGP.32-based architecture?
2. Can you run a global platform on a single connectivity model?
3. Will today’s security decision still be valid fifteen years from now?

For anyone responsible for a connectivity strategy that has to survive a 15-year vehicle lifecycle, those aren’t rhetorical questions – they’re the ones being answered right now, one architecture decision at a time.

Building a connectivity architecture that lasts means planning for what’s ahead, not just what’s needed today. If you’re ready to explore solutions built for long-term security and scale, our team is here to help. Get in touch with our IoT experts to explore what’s right for your business.