Cybersecurity and Compliance
Penetration Testing and Vulnerability Scanning for Dealerships
Find the way into your network before a cybercriminal does. Annual human-led penetration testing and vulnerability scans every 6 months, from a team that works only with car and truck dealerships.
Penetration testing for dealerships is a yearly attempt by a skilled person to break into your stores’ network the way a cybercriminal would, paired with vulnerability scans at least every 6 months that look for known weaknesses first.
Last updated: October 18, 2026
A Scan Lists the Doors. A Tester Tries Them.
Ask a GM how many ways there are into the store’s network and you’ll get a guess. The real number is higher. A store collects them over the years, one vendor visit and one new building at a time. A vulnerability scan checks every one it can reach against a list of publicly known weaknesses. A penetration test is a person who takes what the scan found, and what it missed, and tries to get from the guest Wi-Fi to your customer files.
Both belong in cybersecurity for dealerships, because the attacks are real. CDK Global’s research found 35% of auto dealers had a cyberattack or incident in 2024. We test once a year, and a person does it. Our vulnerability monitoring runs twice a year, and both sit inside Helion Technologies’ compliance program. Want the textbook version first? Our explainer on vulnerability assessments and penetration testing covers it. This page is the service.
A scanner reports what it was told to look for. A person looks for what nobody thought of.
Know what you’re buying
Vulnerability Scan or Penetration Test? You Need Both.
The two get mixed up all the time, sometimes on purpose. They aren’t the same job. The table puts penetration testing for dealerships next to the scans that feed it.
| Question | Vulnerability scan | Human-led penetration test |
|---|---|---|
| Who does the work | Software, checking every system it can reach against a list of publicly known weaknesses | A skilled tester, starting from the scan results and using judgment to try to get in |
| How often the Safeguards Rule asks for it | At least every 6 months, and again after a material change to your operations | Once a year, scoped to the risks your risk assessment found that year |
| What it finds | Missing patches, open ports, outdated software and weak settings | Whether those small weaknesses chain together into a real path to customer data |
| What it can’t tell you | Whether anyone could actually use what it found | What happens next week, since it’s a close look at one moment in time |
| What you get back | A long list of findings, ranked by severity | How far the tester got, and which gaps to close first |
Watch for automated scans sold as penetration tests. They cost less and the report looks official, but nobody tried anything. That’s why Helion’s annual testing is led by a person. Curious what an attacker could reach once inside, before you commit to anything? Our complimentary Hackability Test shows you from the inside.
The Team Behind the Testing
We’ve worked only with car and truck dealerships since 1997. That helps in a pen test. Our people have been inside a lot of dealership networks over the years, so they already know where stores tend to leave a door open, and they don’t spend your testing time working through a generic checklist built for a law firm or a dentist’s office. That’s the point.
A Pen Test Is a Snapshot. Monitoring Is the Alarm.
We’ve said this for years, and it still surprises people. A penetration test tells you how your network held up during the days somebody was testing it. If a cybercriminal gets in the week after the tester packs up, through a phishing email or a vendor’s stolen password, the report sitting in the controller’s office won’t do a thing to stop them. That’s also why the FTC Safeguards Rule lets a dealership skip the annual test and the 6-month scans only if it runs effective continuous monitoring instead.
Our advice is to have both. Around-the-clock monitoring, through managed detection and response, is what catches an attack while it’s happening. Testing and scanning are how you find the weak spots before anybody uses them, and how you check that the monitoring and your other safeguards really work. A scan nobody acts on is just a list. That’s the trouble with buying one on its own.
Testing finds the holes. Monitoring watches them.
Annual penetration test
A person tries to get in, using what the scans found and looking hard for what they didn’t.
One moment, looked at closely.
Continuous monitoring
Security analysts watch for signs of an attack around the clock, every day of the year.
Every other moment, covered.
The compliance side
What the FTC Safeguards Rule Asks For
Testing sits in section 314.4(d) of the rule. At Helion it lives in the compliance program, next to the written risk assessment and vendor risk rating, and apart from security awareness training. We also built our own compliance scanning tool rather than reselling someone else’s. Here’s what the section says, without the legal phrasing.
Fewer than 5,000 consumers?
Section 314.6 exempts a dealership holding customer information on fewer than 5,000 consumers from the testing requirement. Count before you assume either way, and read our FTC Safeguards Rule checklist for the rest.
Section 314.4(d), clause by clause What each part asks a dealership to do
(d)(1) Test or monitor what you’ve built
You have to regularly test or otherwise monitor whether your safeguards work, including the ones meant to spot an attack or an intrusion. Buying a firewall isn’t the finish line. Someone has to show it’s doing its job, and keep showing it.
Prove it works.
(d)(2)(i) A penetration test every year
Without effective continuous monitoring, you need annual penetration testing of your information systems, scoped each year to the risks your risk assessment identified. Added a store since last year? Moved to a new DMS? Then last year’s scope is out of date.
Scoped to this year’s risks.
(d)(2)(ii) Vulnerability scans every 6 months
Vulnerability assessments, including scans for publicly known weaknesses, at least every 6 months. The rule also wants one whenever there’s a material change to your operations or business arrangements, and whenever something happens that you know, or have reason to know, could seriously affect your information security program.
And after big changes.
How Penetration Testing Starts
-
1
Request the assessment
Fill in the short form for our complimentary IT and cybersecurity assessment. There’s no cost and no obligation, and you don’t need to be shopping for a new provider.
-
2
We look at what’s exposed
An engineer reviews your stores, your network and who has remote access, and asks when your last test and scan were, and what actually happened to the findings after the report came in.
-
3
Findings arrive in writing
You see where you stand on testing, monitoring and the rest of the Safeguards Rule, store by store.
-
4
You decide what’s next
Keep your current tester, or let us run the annual test and the 6-month scans in our compliance program. Onboarding starts within weeks of signing. On the co-managed path your own IT manager stays in charge.
Common Questions
Not sure when your last real test was?
A complimentary IT and cybersecurity assessment answers that in writing. Already know what you need? Get a price quote.
Does the FTC Safeguards Rule require penetration testing for dealerships?
What’s the difference between a vulnerability scan and a pen test?
Can an automated scan count as a penetration test?
We already have continuous monitoring. Do we still need a pen test?
How often should a dealership scan for vulnerabilities?
Is penetration testing part of Helion’s security awareness training?
Somebody is going to test your network this year. Better that it’s someone working for you.
Request a Complimentary Assessment →