Red Flag: The Cybersecurity Challenges Facing F1 Teams

F1 engineers can spend months refining a car, testing designs in simulations and looking for tiny performance gains. It would be a shame if all that careful work were undermined by someone clicking a dodgy link in an email. Cybersecurity might not get the same attention as a new front wing or a perfectly timed pit stop, but teams have plenty to lose if they get it wrong. Their operations rely on valuable information, connected systems and people communicating across factories and race circuits, giving attackers more than one possible way in.

Car designs, telemetry, simulation results and race strategy are all worth protecting and anyone after that information doesn’t need to sneak into the garage wearing a suspiciously oversized team shirt. Teams need data moving quickly between trackside engineers and the factory, which means keeping it secure without slowing down the people who need it.

Data Is the New Horsepower (And It Needs Protecting)

According to Williams’ cybersecurity partner Keeper Security, each race produces terabytes of intellectual property, including race strategies, car designs and performance metrics. Team Principal James Vowles summed up its value by saying, “In Formula 1, information is power”.

A stolen file doesn’t have to contain a finished car to be worth having. Engineering findings, setup information or simulation results could give a rival clues about where a team has been spending its development hours. Nobody needs to nick the front wing when they can have a peek at the homework that went into designing it.

During a race, engineers use telemetry to monitor performance and make decisions while the car’s on track. Specialists back at the factory can analyse the data and help identify potential problems. That information needs to reach the right people quickly, while access to the systems carrying it needs to stay under control.

Phishing: The One Pit Stop Nobody Wants to Make

Phishing can get past even advanced security systems by tricking someone into trusting a malicious message. According to Computer Weekly, Oracle Red Bull Racing’s senior manager of technical partnerships Morgan Maia identifies spam, phishing and ransomware among the threats the team encounters. The team sends employees fake attack emails once or twice a month to keep them alert to suspicious messages.

Race weekends aren’t exactly a relaxing inbox-management retreat. Staff are juggling deadlines, travel arrangements, last-minute changes and messages flying between different parts of the operation. An email that looks like an urgent request from a colleague could easily get a second, less-than-thorough glance. The weakest link in an engineering operation this precise might be someone clicking a dodgy link because it looks like the one thing they need to sort out before lights out.

In July 2024, the FIA disclosed that phishing attacks had led to unauthorised access to personal data in two of its email accounts. It told TechRadar that the incidents formed part of a wider phishing campaign across motorsport rather than an attack specifically targeting the organisation. The breach shows that even those at the heart of F1 aren’t immune to a threat that starts in an inbox.

24 Races, Temporary Networks And A Lot Of Luggage

For each of the 24 races a year, Aston Martin has to establish full operations at temporary sites around the world. Trackside engineers also need to stay connected to specialists at the factory, meaning the team’s systems have to work across different locations while keeping access secure.

Mark Carter, Aston Martin’s Chief Architect and Cybersecurity Officer, says, “Whatever we run trackside has to be efficient”. The systems also need to be performant and resilient without interfering with race-day operations. In other words, security can’t become another thing the team has to troubleshoot when it’s already trying to get a car ready for qualifying.

There’s a logistical challenge here that a normal office doesn’t have to deal with. F1 teams move equipment and people around the world, often working with different hardware and connectivity arrangements at different events. Alpine’s Head of IT, Joshua David, has discussed how the equipment used can differ depending on whether it’s transported by sea or air freight.

Packing for 24 races is already a pain as is, so making sure all the equipment, connections and access permissions are ready at every stop adds another checklist to the pile.

When a Cyberattack Throws a Spanner in the Works

Stolen secrets are one problem; being locked out of your own systems is another. Ransomware, unavailable services or compromised accounts can disrupt the work a team needs to finish before the next session, even if nobody gets anywhere near the car itself
.
Aston Martin’s cybersecurity team puts system availability high on its priority list. Carter explains that the team needs to sift through security signals quickly to decide whether something is malicious. That’s not just about spotting an attack, but working out what needs attention and responding before the disruption spreads.

Engineers might struggle to access information, staff could lose access to essential services and IT teams might have to spend valuable time restoring systems instead of supporting the work happening at the circuit. Nobody needs to be remotely steering an F1 car for a cyber incident to cause a headache. Sometimes, getting the right information to the right person is already complicated enough.

An IT outage doesn’t wait for the safety car, and the team can’t ask the race director to pause the weekend while someone restarts a server.

Nobody Wants IT To Become The Bottleneck

Alpine’s Head of IT, Joshua David, told Infosecurity Magazine that he wants visibility into the services staff use, including tools adopted without IT’s knowledge, commonly known as shadow IT. He also wants more precise controls than simply blocking or allowing a service.

“Formula 1 engineers are some of the most intelligent people in the world and if there is a barrier in their way, they will find a way around it,” he told the magazine. The goal is to understand what engineers need to do and give them access in a way that manages the risk.

If security controls make engineers’ jobs harder than they need to be, they may find their own workarounds. That can leave IT with less visibility over the tools people are using and create gaps that attackers could exploit. Security needs to protect the team’s systems without getting in the way of the work happening inside them.

Protecting the Secrets Behind the Speed

F1 teams spend enormous amounts of time looking for performance gains, from refining car designs to analysing data that can help them make better decisions on track. Much of that work depends on information moving between people, systems and locations, often under serious time pressure. Protecting it isn’t a job that can be squeezed in once the car’s ready for the next session.

The aim isn’t to turn every login into a ten-minute ordeal or treat every email as an international incident. It’s to make sure engineers can get on with their jobs without giving someone else an easy route into the operation. That means protecting the data, keeping essential systems available and making security practical enough that people actually use it.

A team might spend an entire weekend hunting for a few thousandths of a second. The last thing it needs is to spend Monday hunting for whoever got into its systems.

Calling all cybersecurity startups and SMEs! Enter TechRound’s Cybersecurity40 today.