There’s no longer any debate: cybersecurity is a dealership survival issue.  According to The State of Dealership Cybersecurity 2025, published by CDK Global, 90% of dealership leaders say cybersecurity is very or extremely important.

Dealers get it. You feel the urgency. But here’s the uncomfortable truth the report reveals — awareness isn’t the same as readiness, and readiness isn’t the same as resilience.

Even though confidence is up from last year, less than half of dealership leaders (48%) say they’re confident their protections will hold when it counts. That gap between awareness and confidence is the signal dealerships can’t ignore anymore:  You know cybersecurity matters — but many don’t yet feel equipped to win the fight.

1 in 5 Dealerships Was Hit in the Last Year — and Attacks Are Getting Smarter

The report shows 21% of dealers experienced a cyberattack or incident in the past year — up from 2023.

And while ransomware still dominates headlines, email phishing now rivals it in threat level, especially in larger groups. Dealership leaders described criminals spoofing employees, posing as the Social Security Administration, and even slipping malware into fake resumes.

The creativity, persistence, and precision of attacks are increasing — not decreasing.  Yet dealership defenses haven’t evolved at the same speed.

Dealers Are Fighting Back — But Without Enough People Power

There’s good news:  dealers are actively taking steps to protect their stores. Six out of eight major defensive measures increased this year, including real-time monitoring and securing endpoint devices.

But here’s the gut punch:

• Employee cybersecurity training dropped from 80% to 70%
• Quarterly assessments are down from 56% two years ago to 40%
• 13% of stores still provide no training at all

Why does this matter?  Because people are still the #1 way attacks succeed.  And if your most targeted systems are cloud-based and email-driven, reducing staff readiness is like lowering the shields in the middle of a firefight.

The report even acknowledges that dealers know this is a problem — enhancing training is the #1 cybersecurity priority for the next 12 months.

That’s a step in the right direction — but training alone won’t stop everything.

Budgets Are Rising — But Headcount and Expertise Aren’t Keeping Pace

Dealers are planning to increase cybersecurity investment over the next year, with nearly half expecting to raise their budgets by up to 10%. And importantly, nobody plans to decrease spending.

But look at this contrast:

• 67% of dealers say less than 5% of total operating budget goes to cybersecurity
• Cybersecurity still ranks below marketing, DMS, CRM, and websites in spending

Here’s the message hiding between the lines:

Dealerships are willing to invest — but not yet at the level needed to build the staffing, specialization, and always-on monitoring modern threats demand.

If attackers are operating 24/7, and your defense team clocks out at 5 p.m., you’re leaving the showroom door unlocked overnight — figuratively and potentially literally.

Dealers Increasingly Rely on Third-Party Cybersecurity Expertise — and That’s Smart

The report shows that more than half of dealerships now rely on both managed service providers and internal IT teams to manage compliance and alerting. That’s a shift in the right direction — because no internal team can realistically monitor threats nonstop while also fixing printers, onboarding users, troubleshooting DMS issues, and keeping the network stable.

The reality is this:

Cybersecurity today requires specialized skills, persistent vigilance, and dedicated manpower.
Not “someone who also handles IT.”  Not “an annual assessment” that no one acts upon.  Not “a once-a-year training video.”

If cybercrime was a movie, this would be the part of the movie where the underdog realizes heart alone won’t beat a team packed with paid professionals.

The Message for 2026 Is Crystal Clear:

Dealerships care — now they must commit.

The threat is real — and rising.

The solution requires expertise, people power, and continuous action.

Cybersecurity doesn’t improve because we hope harder.  It improves because dealerships build or partner with teams who have the skills, tooling, and eyes-on-glass coverage necessary to defend against relentless and sophisticated attacks.

And while confidence is climbing, the data tells us the same thing modern dealerships already know:

To win this battle, dealerships can’t do it alone — and they can’t do it halfway.  2026 needs to be the year dealerships turn concern into capability.