Insurance costs in this space will be the end of the small mom and pop dealership. They won't be able to afford it, and it will drive them out of business. In 10 years if you don't have 6-10 rooftops, good luck paying for it.

We went through a DMS outage last year, not CDK, a different vendor, and the OEM's response was essentially nothing. No communication protocol, no contingency support, no temporary manual process guidance. We were on our own for eleven days. The manufacturers collect our data constantly and the moment that infrastructure breaks they have zero accountability for what happens to us. That asymmetry does not get discussed enough.

Investment in zero-trust architecture is non-negotiable now. Relying on legacy hardware and basic firewalls is basically inviting disaster. Every entry point needs to be locked down tight with hardware-based authentication. If your infrastructure is wide open, you're essentially just waiting for your turn to get hit.

I’m surprised we haven’t seen more class-action lawsuits from consumers yet. Storing sensitive credit applications on vulnerable systems is a massive legal liability. Eventually, the courts will likely force changes through heavy judgments, since voluntary improvements are clearly moving too slowly for most shops.

It’s not just about keeping them out; it’s about how fast you can come back online. Most stores have no idea if their offsite backups actually work or how long a full restoration takes. If you haven't performed a dry run, you don't actually have a recovery plan.

It’s surprising how little we talk about the competitive advantage of being secure. If you can prove to a customer that their data is safer with you than the guy down the street, that’s a powerful sales tool. Privacy is becoming the new "reliability" in the automotive world.

Retail culture prioritizes speed over caution every single time. Salespeople will bypass any digital defense if they think it delays a deal. Real results require hitting them in the wallet—make compliance a mandatory part of the commission structure or threats will stay rampant on the floor.

Third-party API integrations are the industry's massive, overlooked vulnerability. Every minor app connected to the DMS creates an unmonitored backdoor for attackers. Until dealerships strictly audit every vendor’s access levels and terminate unnecessary data bridges, no amount of perimeter security will stop these breaches from occurring.