The exploit is public. The recall isn't.

A researcher finds a disclosure address on a carmaker's website on a Friday afternoon and sends in a careful write-up of the flaw. By Monday the exploit is public. The warranty dashboard is still green. The plant scoreboards are green. The QRQC wall has a fresh red tag for a scratched bumper clip and nothing at all for the car that can be unlocked from another continent. No nonconformance report exists, because the defect arrived as code, and code goes to IT.

I have been on both ends of that email. As the ethical hacker who reported a clickjacking flaw to a telecoms operator – a place on their bug-bounty Hall of Fame came with it – and as the quality director at a greenfield plant of 900-plus people, where field escapes landed on my desk. The two worlds have never exchanged paperwork.

Not long ago a research team catalogued hundreds of vulnerabilities in production cars: software, connectivity, APIs. Almost none of it mechanical. My plant instinct says most of those findings will never touch a manufacturer's quality system. That is the actual scandal, and it is fixable.

A vulnerability is a field escape in disguise

Run the translation. Affected VINs are the lot. The fleet in the field is the containment population. CVSS is a severity rating, no better and no worse than the risk priority numbers your engineers argue about every Tuesday. And a public exploit is a customer complaint with excellent reproducibility – failure mode demonstrated, documented, timestamped, signed by someone who charged you nothing for the test.

IATF 16949 never limited itself to metal. A nonconformance is any non-fulfilment of a requirement, and "unauthorised remote command execution" fails several requirements at once. The quality system already owns every tool this failure mode needs: containment, root cause analysis, corrective action, verified effectiveness. It declines jurisdiction for one reason only – the defect arrived over a network instead of on a pallet. The customer, sitting in the connected car, does not care which inbox the report reached.

The patch is containment, never the corrective action

An OTA update shipped fast is D3, interim containment. Calling it D5 is the oldest mistake in the 8D book – the software twin of swapping suspect stock at the customer's dock at €40 a unit without ever asking why it shipped.

I have watched that mistake in metal for two decades. The pattern transfers exactly.

The real root cause sits upstream: why did the attack surface ship at all? Somewhere there is a design review with no threat modelling on the agenda, a PFMEA with no row for "remote authentication bypass", a supplier integration accepted on functionality alone. Until that gap closes, the same class of vulnerability recurs model over model, carried forward in the architecture like unpaid quality debt – invisible on every dashboard, expensive at every platform renewal.

A silent patch is containment wearing corrective-action clothing.

UN R155 and ISO/SAE 21434 settle this argument in a language quality directors already speak: audit. A certified cybersecurity management system means vulnerability handling must be a documented process – triage records, decisions, verified closure – the same evidence trail a VDA 6.3 auditor demands for a weld. The security engineers I know are brilliant at finding flaws and hopeless at producing audit-grade records. Producing audit-grade records is precisely what the quality function exists to do.

Wire the disclosure into the quality system

The machinery exists. I have built it. At SNOP I stood up the QA/QC department of a 900-employee greenfield plant from an empty building, and QRQC discipline – fast intake, severity called with the right people in the room, containment within hours, closure verified – cut our defect costs by 70% and carried us through a quarter with zero critical customer escalations. Nothing about a software vulnerability overloads that machinery. It is a nonconformance with better documentation than most.

So start with one intake: a single disclosure address owned by quality, fed by researchers and bounty programmes alike, because routing a fleet-wide flaw into the IT ticket queue is how a P1 becomes a quarterly agenda item. Then QRQC speed on triage – safety engineering and cybersecurity in the same room within 24 hours, severity called the same day, affected VINs counted like any suspect lot. Containment ships over the air; it earns closure the old way, with telemetry evidence and sample VIN checks, the same prove-it-worked standard you apply to a containment sort. And agree the disclosure SLAs before the patch ships: acknowledge in 72 hours, status at fixed intervals. Silence teaches researchers to publish, and their paper becomes the recall notice you chose not to write.

Recalls of steel are expensive and honest. The industry pays for lorries, loan cars, field rework and reputational damage, and everyone learns something. Silent patches are cheap and corrosive; the debt compounds quietly until a regulator or a plaintiff reads the changelog. We spent a century building a machine for mechanical escapes – quarantine, sort, containment stock, expedited freight – and it works. The next decade's escapes arrive over the air and over a keyboard, and the winners will treat a CVE with the seriousness of a cracked weld. Same triage. Same containment. Same verified closure. A field escape is a field escape whether it arrives on a pallet or through an API, and the defect has never once asked which department owns the inbox.